launchpad-reviewers team mailing list archive

[Gavin Panella <gavin.panella@xxxxxxxxxxxxx>]

Gavin Panella has proposed merging lp:~allenap/launchpad/ec2-images-no-env-via-ssh into lp:launchpad/devel with lp:~allenap/launchpad/create-bucket-first as a prerequisite.

Requested reviews:
  Launchpad code reviewers (launchpad-reviewers)


This changes the bin/ec2 update-image command to not pass any LANG or
LC_* environment variables when bootstrapping the new image, and then
it modifies sshd_config on the new image to prevent these variables
from being passed via future ssh connections. This fixes two things:

- Ensures that PostgreSQL gets set up correctly. If the locale
  specified by LC_ALL (say) is not recognized, the postgres
  post-install script fails to create a default cluster.

- Stops the endless blah blah locale blah warnings while bin/ec2 does
  it's thing (in land, test, etc).

Although I've only encountered problems from LC_ALL, I decided to
eliminate both LANG and LC_* because that's what the stock OpenSSH
does. In fact, it does not allow *any* environment variables to be
passed from the client. See AcceptEnv in sshd_config(5), and the notes
about the Debian openssh-server in the same manpage.

-- 
https://code.launchpad.net/~allenap/launchpad/ec2-images-no-env-via-ssh/+merge/41700
Your team Launchpad code reviewers is requested to review the proposed merge of lp:~allenap/launchpad/ec2-images-no-env-via-ssh into lp:launchpad/devel.

=== modified file 'lib/devscripts/ec2test/builtins.py'
--- lib/devscripts/ec2test/builtins.py	2010-11-22 16:23:02 +0000
+++ lib/devscripts/ec2test/builtins.py	2010-11-24 10:12:02 +0000
@@ -564,6 +564,13 @@
         if extra_update_image_command is None:
             extra_update_image_command = []
 
+        # These environment variables are passed through ssh connections to
+        # fresh Ubuntu images and cause havoc if the locales they refer to are
+        # not available. We kill them here to ease bootstrapping, then we
+        # later modify the image to prevent sshd from accepting them.
+        os.environ.pop("LANG")
+        os.environ.pop("LC_ALL")
+
         credentials = EC2Credentials.load_from_file()
 
         session_name = EC2SessionName.make(EC2TestRunner.name)
@@ -596,8 +603,15 @@
         :param public: If true, remove proprietary code from the sourcecode
             directory before bundling.
         """
+        # Do NOT accept environment variables via ssh connections.
         user_connection = instance.connect()
         user_connection.perform(
+            'sudo sed -i "s/^AcceptEnv/#AcceptEnv/" /etc/ssh/sshd_config')
+        user_connection.perform(
+            'sudo kill -HUP $(< /var/run/sshd.pid)')
+        # Reconnect to ensure that the environment is clean.
+        user_connection.reconnect()
+        user_connection.perform(
             'bzr launchpad-login %s' % (instance._launchpad_login,))
         for cmd in extra_update_image_command:
             user_connection.run_with_ssh_agent(cmd)