AB#2046 : Add option to create SSH users for the first coordinator upon initialization (#133)

* Move `file`, `ssh` and `user` packages to internal
* Rename `SSHKey` to `(ssh.)UserKey`
* Rename KeyValue / Publickey to PublicKey
* Rename SSH key file from "debugd" to "ssh-keys"
* Add CreateSSHUsers function to Core
* Call CreateSSHUsers users on first control-plane node, when defined in config

Tests:
* Make StubUserCreator add entries to /etc/passwd
* Add NewLinuxUserManagerFake for unit tests
* Add unit tests & adjust existing ones to changes

internal/deploy/user/create_user.go

@@ -0,0 +1,25 @@
+package user
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+)
+
+type Unix struct{}
+
+// reference: https://man7.org/linux/man-pages/man8/useradd.8.html#EXIT_VALUES
+const exitCodeUsernameAlreadyInUse = 9
+
+// CreateUser creates a new user with sudo access. Returns successfully if creation succeeds or user existed already.
+func (u Unix) CreateUser(ctx context.Context, username string) error {
+	cmd := exec.CommandContext(ctx, "useradd", "-m", "-G", "wheel,sudo", username)
+	if err := cmd.Run(); err != nil {
+		// do not fail if user already exists
+		if exitError, ok := err.(*exec.ExitError); ok && exitError.ExitCode() == exitCodeUsernameAlreadyInUse {
+			return nil
+		}
+		return fmt.Errorf("creating a new user failed: %w", err)
+	}
+	return nil
+}

internal/deploy/user/linux_user.go

@@ -0,0 +1,147 @@
+package user
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/spf13/afero"
+)
+
+// ErrUserDoesNotExist is returned by GetLinuxUser if a linux user does not exist yet.
+var ErrUserDoesNotExist = errors.New("user does not exist")
+
+type passwdParser interface {
+	Parse(fs afero.Fs) (Entries, error)
+}
+
+type userCreator interface {
+	CreateUser(ctx context.Context, username string) error
+}
+
+// LinuxUser holds relevant information about a linux user (subset of /etc/passwd).
+type LinuxUser struct {
+	Username string
+	Home     string
+	Uid      int
+	Gid      int
+}
+
+// LinuxUserManager can retrieve information on linux users and create new users.
+type LinuxUserManager struct {
+	Fs      afero.Fs
+	Passwd  passwdParser
+	Creator userCreator
+}
+
+// NewLinuxUserManager creates a new LinuxUserManager.
+func NewLinuxUserManager(fs afero.Fs) LinuxUserManager {
+	return LinuxUserManager{
+		Fs:      fs,
+		Passwd:  Passwd{},
+		Creator: Unix{},
+	}
+}
+
+// NewLinuxUserManagerFake creates a new LinuxUserManager that is used for unit tests.
+func NewLinuxUserManagerFake(fs afero.Fs) LinuxUserManager {
+	return LinuxUserManager{
+		Fs:      fs,
+		Passwd:  Passwd{},
+		Creator: &StubUserCreator{fs: fs},
+	}
+}
+
+// StubUserCreator is used for unit tests.
+type StubUserCreator struct {
+	fs            afero.Fs
+	usernames     []string
+	createUserErr error
+	currentUID    int
+}
+
+func (s *StubUserCreator) CreateUser(ctx context.Context, username string) error {
+	if stringInSlice(username, s.usernames) {
+		return errors.New("username already exists")
+	}
+
+	// We want created users to start at UID 1000
+	if s.currentUID == 0 {
+		s.currentUID = 1000
+	}
+
+	if s.createUserErr != nil {
+		return s.createUserErr
+	}
+
+	// If no predefined error is supposed to happen, increase the UID (unless the file system code fails)
+	if s.fs != nil {
+		lineToWrite := fmt.Sprintf("%s:x:%d:%d:%s:/home/%s:/bin/bash\n", username, s.currentUID, s.currentUID, username, username)
+		file, err := s.fs.OpenFile("/etc/passwd", os.O_WRONLY|os.O_APPEND|os.O_CREATE, 0o644)
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+
+		n, err := file.WriteString(lineToWrite)
+
+		if err != nil {
+			return err
+		} else if n != len(lineToWrite) {
+			return errors.New("written text too short")
+		}
+	}
+
+	s.currentUID += 1
+	s.usernames = append(s.usernames, username)
+
+	return nil
+}
+
+// getLinuxUser tries to find an existing linux user in /etc/passwd.
+func (l *LinuxUserManager) getLinuxUser(username string) (LinuxUser, error) {
+	entries, err := l.Passwd.Parse(l.Fs)
+	if err != nil {
+		return LinuxUser{}, err
+	}
+	if _, ok := entries[username]; !ok {
+		return LinuxUser{}, ErrUserDoesNotExist
+	}
+	entry := entries[username]
+	uid, err := strconv.Atoi(entry.Uid)
+	if err != nil {
+		return LinuxUser{}, fmt.Errorf("failed to parse users uid: %w", err)
+	}
+	gid, err := strconv.Atoi(entry.Gid)
+	if err != nil {
+		return LinuxUser{}, fmt.Errorf("failed to parse users gid: %w", err)
+	}
+	return LinuxUser{
+		Username: username,
+		Home:     entry.Home,
+		Uid:      uid,
+		Gid:      gid,
+	}, nil
+}
+
+// EnsureLinuxUserExists will try to create the user specified by username and call GetLinuxUser to retrieve user information.
+func (l *LinuxUserManager) EnsureLinuxUserExists(ctx context.Context, username string) (LinuxUser, error) {
+	// try to create user (even if it already exists)
+	if err := l.Creator.CreateUser(ctx, username); err != nil {
+		return LinuxUser{}, err
+	}
+
+	return l.getLinuxUser(username)
+}
+
+// stringInSlice checks if a given string exists in a slice of strings.
+func stringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}

internal/deploy/user/linux_user_test.go

@@ -0,0 +1,123 @@
+package user
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetLinuxUser(t *testing.T) {
+	username := "user"
+
+	testCases := map[string]struct {
+		passwdContents string
+		wantErr        bool
+		wantUser       LinuxUser
+	}{
+		"get works": {
+			passwdContents: "user:x:1000:1000:user:/home/user:/bin/bash\n",
+			wantErr:        false,
+			wantUser: LinuxUser{
+				Username: "user",
+				Home:     "/home/user",
+				Uid:      1000,
+				Gid:      1000,
+			},
+		},
+		"user does not exist": {
+			passwdContents: "",
+			wantErr:        true,
+		},
+		"parse fails": {
+			passwdContents: "invalid contents\n",
+			wantErr:        true,
+		},
+		"invalid uid": {
+			passwdContents: "user:x:invalid:1000:user:/home/user:/bin/bash\n",
+			wantErr:        true,
+		},
+		"invalid gid": {
+			passwdContents: "user:x:1000:invalid:user:/home/user:/bin/bash\n",
+			wantErr:        true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			assert := assert.New(t)
+			require := require.New(t)
+
+			fs := afero.NewMemMapFs()
+			assert.NoError(afero.WriteFile(fs, "/etc/passwd", []byte(tc.passwdContents), 0o755))
+			manager := NewLinuxUserManagerFake(fs)
+			user, err := manager.getLinuxUser(username)
+
+			if tc.wantErr {
+				assert.Error(err)
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tc.wantUser, user)
+		})
+	}
+}
+
+func TestEnsureLinuxUserExists(t *testing.T) {
+	username := "user"
+
+	testCases := map[string]struct {
+		userCreator *StubUserCreator
+		wantErr     bool
+		wantUser    LinuxUser
+	}{
+		"create works": {
+			userCreator: &StubUserCreator{},
+			wantErr:     false,
+			wantUser: LinuxUser{
+				Username: "user",
+				Home:     "/home/user",
+				Uid:      1000,
+				Gid:      1000,
+			},
+		},
+		"create fails": {
+			userCreator: &StubUserCreator{
+				createUserErr: errors.New("create fails"),
+			},
+			wantErr: true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			assert := assert.New(t)
+			require := require.New(t)
+
+			fs := afero.NewMemMapFs()
+			manager := NewLinuxUserManagerFake(fs)
+			tc.userCreator.fs = fs
+			manager.Creator = tc.userCreator
+			user, err := manager.EnsureLinuxUserExists(context.Background(), username)
+
+			if tc.wantErr {
+				assert.Error(err)
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tc.wantUser, user)
+			assert.ElementsMatch([]string{username}, tc.userCreator.usernames)
+		})
+	}
+}
+
+func TestStringInSlice(t *testing.T) {
+	assert := assert.New(t)
+	testSlice := []string{"abc", "efg", "xyz"}
+
+	assert.True(stringInSlice("efg", testSlice))
+	assert.False(stringInSlice("hij", testSlice))
+}

internal/deploy/user/passwd.go

@@ -0,0 +1,28 @@
+package user
+
+import (
+	"github.com/spf13/afero"
+	"github.com/willdonnelly/passwd"
+)
+
+// An Entry contains all the fields for a specific user. Re-exported to allow other module to only import this passwd module.
+type Entries map[string]passwd.Entry
+
+type Passwd struct{}
+
+// Parse opens the '/etc/passwd' file and parses it into a map from usernames to Entries.
+func (p Passwd) Parse(fs afero.Fs) (Entries, error) {
+	return p.parseFile(fs, "/etc/passwd")
+}
+
+// parseFile opens the file and parses it into a map from usernames to Entries.
+func (p Passwd) parseFile(fs afero.Fs, path string) (Entries, error) {
+	file, err := fs.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	entries, err := passwd.ParseReader(file)
+	return Entries(entries), err
+}

internal/deploy/user/passwd_test.go

@@ -0,0 +1,66 @@
+package user
+
+import (
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParse(t *testing.T) {
+	filename := "/etc/passwd"
+
+	testCases := map[string]struct {
+		passwdContents string
+		createFile     bool
+		wantEntries    Entries
+		wantErr        bool
+	}{
+		"parse works": {
+			passwdContents: "root:x:0:0:root:/root:/bin/bash\n",
+			createFile:     true,
+			wantEntries: Entries{
+				"root": {
+					Pass:  "x",
+					Uid:   "0",
+					Gid:   "0",
+					Gecos: "root",
+					Home:  "/root",
+					Shell: "/bin/bash",
+				},
+			},
+			wantErr: false,
+		},
+		"passwd is corrupt": {
+			passwdContents: "too:few:fields\n",
+			createFile:     true,
+			wantErr:        true,
+		},
+		"file does not exist": {
+			createFile: false,
+			wantErr:    true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			assert := assert.New(t)
+			require := require.New(t)
+
+			fs := afero.NewMemMapFs()
+			if tc.createFile {
+				assert.NoError(afero.WriteFile(fs, filename, []byte(tc.passwdContents), 0o644))
+			}
+			passwd := Passwd{}
+			entries, err := passwd.Parse(fs)
+
+			if tc.wantErr {
+				assert.Error(err)
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tc.wantEntries, entries)
+		})
+	}
+}