Do you have an example of how to generate the key other than ssh-keygen so we can confirm this works?

In order to provide a simple example, I did a small research and found out my initial assumption about why update_ssh_keys removes the last character of each line was wrong.

The intent of line[:-1] is not to remove a trailing whitespace, but to remove the line return. In my case, there is no whitespace at the end of the ssh key, and no line return either, which is why
the removal of the last character is problematic.

A public SSH host key without a line return is still valid. A call to strip would remove the line return and trailing whitespaces only if they are there.

Context

In my use-case, I initialize the SSH hostkeys with cloud-init. cloud-init creates the public ssh host key without a trailing whitespace or new line at the end.

There is an example in cloud-init documentation - rsa_public:
https://cloudinit.readthedocs.io/en/latest/topics/examples.html#configure-instances-ssh-keys

Example

To replicate the production of a public ssh key that would fail to be added by FreeIPA, generate a public ssh host key associated with an existing private key and remove the line return.

ssh-keygen -f /etc/ssh/ssh_host_ed25519_key -y | tr -d '\n' > key.pub

Test Case

Here is a simplified test case that replicates the logic of update_ssh_keys without going through the whole installation process. It uses the key.pub file generated by the example.

from ipapython.ssh import SSHPublicKey

with open('key.pub') as f:
    for line in f:
        # update_ssh_keys logic
        line = line[:-1].lstrip()
        try:
            pubkey = SSHPublicKey(line)
        except ValueError as e:
            print("Error: %s, %s" % (e, line))

If we use strip instead, the key is read correctly.

from ipapython.ssh import SSHPublicKey

with open('key.pub') as f:
    for line in f:
        # update_ssh_keys logic
        line = line.strip()
        try:
            pubkey = SSHPublicKey(line)
        except ValueError as e:
            print("Error: %s, %s" % (e, line))

Looks good, thanks. I'd be happy to give you credit for the fix but I need a name and/or e-mail address.

Glad I could help.

Félix-Antoine Fortin - felix-antoine.fortin at calculquebec.ca

master:

• 21777e4 When reading SSH pub key don't assume last character is newline

ipa-4-7:

• beb5206 When reading SSH pub key don't assume last character is newline

ipa-4-6:

• f9e974c When reading SSH pub key don't assume last character is newline