Issue Report

Bug

Container Linux Version

1897.0.0 Alpha

Environment

GCE

Expected Behavior

OS Login to work, but only when it's actually enabled for the VM/project.

Actual Behavior

First off, OS Login should only be allowed when it is enabled for the project and/or VM. See here for reference. As far as I can see this is not checked anywhere, it will attempt to enable OS Login unconditionally.

Second, the mechanism to enable it on first boot does not work. On a freshly booted CL Alpha GCE VM I see:

core@instance-1 ~ $ systemctl status oem-gce-enable-oslogin.service
● oem-gce-enable-oslogin.service - Enable GCE OS Login
   Loaded: loaded (/etc/systemd/system/oem-gce-enable-oslogin.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Tue 2018-09-18 14:20:22 UTC; 3min 52s ago
  Process: 703 ExecStart=/usr/share/oem/bin/enable-oslogin (code=exited, status=0/SUCCESS)
 Main PID: 703 (code=exited, status=0/SUCCESS)

Sep 18 14:20:22 localhost systemd[1]: Starting Enable GCE OS Login...
Sep 18 14:20:22 localhost enable-oslogin[703]: /etc/ssh/sshd_config is not a symlink to /usr/share/ssh/sshd_config. Not enabling OS Login
Sep 18 14:20:22 localhost systemd[1]: Started Enable GCE OS Login.

It is a symlink though:

core@instance-1 ~ $ readlink -f /etc/ssh/sshd_config
/usr/share/ssh/sshd_config

As dm0 suggested on IRC the oem-gce-enable-oslogin.service unit is probably racing with whatever is creating /usr/share/ssh/sshd_config, though that's just a guess.

Running sudo /usr/share/oem/bin/enable-oslogin manually enables OS Login correctly. After logging in with an OS Login user there's a minor cosmetic hiccup because /etc/profile.d/coreos-profile.sh will try to display the number of failed units resulting in Failed to list units: Access denied. Maybe modify the profile so that this is only ran if the user has sudo access, and run systemctl list-units with sudo?

Reproduction Steps

1. Create project or VM metadata item enable-oslogin=TRUE (CL doesn't actually care whether it's on at the moment, but this is what gcloud checks to see if it should attempt OS Login-style login)
2. Start GCE VM with CL image 1897.0.0 Alpha
3. Attempt to log in with OS Login: gcloud compute ssh <instance-name>
4. End up with a password prompt