lib/rubber/recipes/rubber/setup.rb
def enable_root_ssh(ip, initial_ssh_user)
    # Capistrano uses the :password variable for sudo commands.  Since this setting is generally used for the deploy user,
    # but we need it this one time for the initial SSH user, we need to swap out and restore the password.
    #
    # We special-case the 'ubuntu' user since the Canonical AMIs on EC2 don't set the password for
    # this account, making any password prompt potentially confusing.
    orig_password = fetch(:password)
    initial_ssh_password = fetch(:initial_ssh_password, nil)

    if initial_ssh_user == 'ubuntu' || ENV.has_key?('RUN_FROM_VAGRANT')
      set(:password, nil)
    elsif initial_ssh_password
      set(:password, initial_ssh_password)
    else
      set(:password, Capistrano::CLI.password_prompt("Password for #{initial_ssh_user} @ #{ip}: "))
    end

    task :_ensure_key_file_present, :hosts => "#{initial_ssh_user}@#{ip}" do
      public_key_filename = "#{cloud.env.key_file}.pub"

      if File.exist?(public_key_filename)
        public_key = File.read(public_key_filename).chomp

        rubber.sudo_script 'ensure_key_file_present', <<-ENDSCRIPT
          mkdir -p ~/.ssh
          touch ~/.ssh/authorized_keys
          chmod 600 ~/.ssh/authorized_keys

          if ! grep -q '#{public_key}' .ssh/authorized_keys; then
            echo '#{public_key}' >> .ssh/authorized_keys
          fi
        ENDSCRIPT
      end
    end

    task :_allow_root_ssh, :hosts => "#{initial_ssh_user}@#{ip}" do
      rsudo "mkdir -p /root/.ssh && cp /home/#{initial_ssh_user}/.ssh/authorized_keys /root/.ssh/"
    end

    task :_disable_password_based_ssh_login, :hosts => "#{initial_ssh_user}@#{ip}" do
      rubber.sudo_script 'disable_password_based_ssh_login', <<-ENDSCRIPT
        if ! grep -q 'PasswordAuthentication no' /etc/ssh/sshd_config; then
          echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config
          service ssh restart
        fi
      ENDSCRIPT
    end

    begin
      _ensure_key_file_present
      _allow_root_ssh
      _disable_password_based_ssh_login if cloud.should_disable_password_based_ssh_login?

      # If the initial_ssh_user is different than the deploy user, we can terminate the SSH connection
      # because from here on out we'll be connecting as the deploy user.
      if initial_ssh_user != fetch(:user, nil)
        teardown_connections_to(sessions.keys)
      end
    rescue ConnectionError, IOError => e
      if e.message =~ /Net::SSH::AuthenticationFailed/
        logger.info "Can't connect as user #{initial_ssh_user} to #{ip}, assuming root allowed"
      else
        sleep 2
        logger.info "Failed to connect to #{ip}, retrying"
        teardown_connections_to(sessions.keys) if e.message =~ /closed stream/
        retry
      end
    end

    # Restore the original deploy password.
    set(:password, orig_password)
  end
# Sets up instance to allow root access (e.g. recent canonical AMIs)
Sets up instance to allow root access
Sets up instance to allow root access
def enable_root_ssh(ip, initial_ssh_user)
     We special-case the 'ubuntu' user since the Canonical AMIs on EC2 don't set the password for
     this account, making any password prompt potentially confusing.
    orig_password = fetch(:password)
    initial_ssh_password = fetch(:initial_ssh_password, nil)
    if initial_ssh_user == 'ubuntu' || ENV.has_key?('RUN_FROM_VAGRANT')
      set(:password, nil)
    elsif initial_ssh_password
      set(:password, initial_ssh_password)
    else
      set(:password, Capistrano::CLI.password_prompt("Password for {initial_ssh_user} @ {ip}: "))
    end
    task :_ensure_key_file_present, :hosts => "{initial_ssh_user}@{ip}" do
      public_key_filename = "{cloud.env.key_file}.pub"
      if File.exist?(public_key_filename)
        public_key = File.read(public_key_filename).chomp
        rubber.sudo_script 'ensure_key_file_present', <<-ENDSCRIPT
          mkdir -p ~/.ssh
          touch ~/.ssh/authorized_keys
          chmod 600 ~/.ssh/authorized_keys
          if ! grep -q '{public_key}' .ssh/authorized_keys; then
            echo '{public_key}' >> .ssh/authorized_keys
          fi
        ENDSCRIPT
      end
    end
    task :_allow_root_ssh, :hosts => "{initial_ssh_user}@{ip}" do
      rsudo "mkdir -p /root/.ssh && cp /home/{initial_ssh_user}/.ssh/authorized_keys /root/.ssh/"
    end
    task :_disable_password_based_ssh_login, :hosts => "{initial_ssh_user}@{ip}" do
      rubber.sudo_script 'disable_password_based_ssh_login', <<-ENDSCRIPT
        if ! grep -q 'PasswordAuthentication no' /etc/ssh/sshd_config; then
          echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config
          service ssh restart
        fi
      ENDSCRIPT
    end
    begin
      _ensure_key_file_present
      _allow_root_ssh
      _disable_password_based_ssh_login if cloud.should_disable_password_based_ssh_login?
       If the initial_ssh_user is different than the deploy user, we can terminate the SSH connection
       because from here on out we'll be connecting as the deploy user.
      if initial_ssh_user != fetch(:user, nil)
        teardown_connections_to(sessions.keys)
      end
    rescue ConnectionError, IOError => e
      if e.message =~ /Net::SSH::AuthenticationFailed/
        logger.info "Can't connect as user {initial_ssh_user} to {ip}, assuming root allowed"
      else
        sleep 2
        logger.info "Failed to connect to {ip}, retrying"
        teardown_connections_to(sessions.keys) if e.message =~ /closed stream/
        retry
      end
    end
     Restore the original deploy password.
    set(:password, orig_password)
  end
def enable_root_ssh ( ip , initial_ssh_user ) orig_password = fetch ( :password ) initial_ssh_password = fetch ( :initial_ssh_password , nil ) if initial_ssh_user == 'ubuntu' || ENV . has_key? ( 'RUN_FROM_VAGRANT' ) set ( :password , nil ) elsif initial_ssh_password set ( :password , initial_ssh_password ) else set ( :password , Capistrano :: CLI . password_prompt ( "Password for #{initial_ssh_user} @ #{ip}: " ) ) end task :_ensure_key_file_present , :hosts => "#{initial_ssh_user}@#{ip}" do public_key_filename = "#{cloud.env.key_file}.pub" if File . exist? ( public_key_filename ) public_key = File . read ( public_key_filename ) . chomp rubber . sudo_script 'ensure_key_file_present' , <<-ENDSCRIPT 
          mkdir -p ~/.ssh
          touch ~/.ssh/authorized_keys
          chmod 600 ~/.ssh/authorized_keys

          if ! grep -q ' #{ public_key } ' .ssh/authorized_keys; then
            echo ' #{ public_key } ' >> .ssh/authorized_keys
          fi
         ENDSCRIPT end end task :_allow_root_ssh , :hosts => "#{initial_ssh_user}@#{ip}" do rsudo "mkdir -p /root/.ssh && cp /home/#{initial_ssh_user}/.ssh/authorized_keys /root/.ssh/" end task :_disable_password_based_ssh_login , :hosts => "#{initial_ssh_user}@#{ip}" do rubber . sudo_script 'disable_password_based_ssh_login' , <<-ENDSCRIPT 
        if ! grep -q 'PasswordAuthentication no' /etc/ssh/sshd_config; then
          echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config
          service ssh restart
        fi
       ENDSCRIPT end begin _ensure_key_file_present _allow_root_ssh _disable_password_based_ssh_login if cloud . should_disable_password_based_ssh_login? if initial_ssh_user != fetch ( :user , nil ) teardown_connections_to ( sessions . keys ) end rescue ConnectionError , IOError => e if e . message =~ / Net::SSH::AuthenticationFailed / logger . info "Can't connect as user #{initial_ssh_user} to #{ip}, assuming root allowed" else sleep 2 logger . info "Failed to connect to #{ip}, retrying" teardown_connections_to ( sessions . keys ) if e . message =~ / closed stream / retry end end set ( :password , orig_password ) end
Sets up instance to allow root access (e.g.
Sets up instance to allow root access ( e . g .
# Capistrano uses the :password variable for sudo commands.  Since this setting is generally used for the deploy user, # but we need it this one time for the initial SSH user, we need to swap out and restore the password. # # We special-case the 'ubuntu' user since the Canonical AMIs on EC2 don't set the password for # this account, making any password prompt potentially confusing. # If the initial_ssh_user is different than the deploy user, we can terminate the SSH connection # because from here on out we'll be connecting as the deploy user. # Restore the original deploy password.
ip
initial_ssh_user