Provide snap plug of ssh-keys

[alexsander-souza]

Use Case Description

When building test/dev environment by installing maas and enlisting nodes with kvm instances, maas (vm) needs to access the virsh host (os of my laptop) to performan virsh power control.

Currently we could access the virsh host by inputting password. If we can provide snap plug of ssh-keys (and manually connect maas snap with the snap slot of ssh-keys), we can setup the corresponding power control without password. This setup will increase the security of the host (os of my laptop).

More information regarding snap interface of ssh-keys https://snapcraft.io/docs/ssh-keys-interface

Additional Information

My current setup (shows no plug of ssh-keys):

ubuntu@vm-host:~$ snap connections maas
Interface Plug Slot Notes
avahi-observe maas:avahi-observe :avahi-observe -
content[maas-cli] maas:maas-cli maas-cli:maas-cli -
content[db-socket] maas:test-db-socket maas-test-db:db-socket -
hardware-observe maas:hardware-observe :hardware-observe -
home maas:home :home -
kernel-module-observe maas:kernel-module-observe :kernel-module-observe -
mount-observe maas:mount-observe :mount-observe -
network maas:network :network -
network-bind maas:network-bind :network-bind -
network-control maas:network-control :network-control -
network-observe maas:network-observe :network-observe -
system-observe maas:system-observe :system-observe -
time-control maas:time-control :time-control -
ubuntu@vm-host:~$ snap list
Name Version Rev Tracking Publisher Notes
core18 20210722 2128 latest/stable canonical✓ base
core20 20210702 1081 latest/stable canonical✓ base
lxd 4.0.7 21029 4.0/stable/… canonical✓ -
maas 3.0.0-10029-g.986ea3e45 15003 3.0/stable canonical✓ -
maas-cli 0.6.5 13 latest/stable canonical✓ -
maas-test-db 12.4-17-g.9e70484 54 3.0/stable canonical✓ -
snapd 2.51.4 12883 latest/stable canonical✓ snapd
ubuntu@vm-host:~$ snap interface ssh-keys
name: ssh-keys
summary: allows reading ssh user configuration and keys
slots:
- snapd

[ack]

It’s already possible to use ssh keys with virsh, as described in SSH setup fix.

The ssh-keys interface is not really desirable in this case, as it allows access to ssh keys for the user running the command/service in the snap (which would be root this case). This would allow MAAS to access all ssh keys configured for the root user, which might be a security issue.

By putting keys in /var/snap/maas/current/root/.ssh, only desider keys can be provided to MAAS.

[tai271828]

Thank you @ack for your tips. I tried var/snap/maas/current/root/.ssh and it works like a charm!