bug4811: made a copy of crontab for ec2-user; authorized_keys management now accepts user's home directory as third argument

configuration/crontab

@@ -1 +1 @@
-* * * * *	export PATH=/bin:/usr/bin:/usr/local/bin; sleep $(( $RANDOM * 60 / 32768 )); update_authorized_keys_for_landscape_managers_if_changed $( cat /root/ssh-key-reader.token ) https://security-service.sapsailing.com 2>&1 >>/var/log/sailing.err
+* * * * *	export PATH=/bin:/usr/bin:/usr/local/bin; sleep $(( $RANDOM * 60 / 32768 )); update_authorized_keys_for_landscape_managers_if_changed $( cat /root/ssh-key-reader.token ) https://security-service.sapsailing.com /root 2>&1 >>/var/log/sailing.err

configuration/mongo_instance_setup/README

@@ -4,7 +4,7 @@ furthermore the ../imageupgrade_functions.sh has to go to /usr/local/bin.
 Deploy mongod.conf to /etc and make sure that /root has a+r and a+x permissions because
 otherwise the mongod user won't be able to read through the symbolic link
 Link mongodb to /etc/logrotate.d
-Link ../crontab to /root/crontab and run "crontab crontab" as root.
+Link crontab to /home/ec2-user/crontab and run "crontab crontab" as ec2-user.
 
 Run with optional EC2 user detail, e.g., as follows:
 

configuration/mongo_instance_setup/crontab

@@ -0,0 +1 @@
+* * * * *	export PATH=/bin:/usr/bin:/usr/local/bin; sleep $(( $RANDOM * 60 / 32768 )); update_authorized_keys_for_landscape_managers_if_changed $( cat /root/ssh-key-reader.token ) https://security-service.sapsailing.com /home/ec2-user 2>&1 >>/var/log/sailing.err

configuration/update_authorized_keys_for_landscape_managers

@@ -1,7 +1,8 @@
 #!/bin/bash
 BEARER_TOKEN="$1"
 BASE_URL="$2"
-SSH_DIR=~root/.ssh
+LOGON_USER_HOME="$3"
+SSH_DIR="$3/.ssh"
 #
 users=$( curl -H 'X-SAPSSE-Forward-Request-To: master' -H 'Authorization: Bearer '${BEARER_TOKEN} "${BASE_URL}/security/api/restsecurity/users_with_permission?permission=LANDSCAPE:MANAGE:AWS" 2>/dev/null | jq -r '.[]' )
 logger -t sailing "Users with LANDSCAPE:MANAGE:AWS permission: ${users}"
@@ -9,9 +10,9 @@ public_keys=$( for user in ${users}; do
   curl -H 'X-SAPSSE-Forward-Request-To: master' -H 'Authorization: Bearer '${BEARER_TOKEN} "${BASE_URL}/landscape/api/landscape/get_ssh_keys_owned_by_user?username[]=${user}" 2>/dev/null | jq -r '.[].publicKey'
 done | sort -u )
 logger -t sailing "Obtained public keys: ${public_keys}"
-if [ ! -f /root/.ssh/authorized_keys.org ]; then
+if [ ! -f ${SSH_DIR}/authorized_keys.org ]; then
   # Create a copy of the original authorized_keys file as generated by AWS from the start-up key:
-  logger -t sailing "Saving root user's original authorized_keys file"
+  logger -t sailing "Saving original authorized_keys file from ${SSH_DIR}"
   cp ${SSH_DIR}/authorized_keys ${SSH_DIR}/authorized_keys.org
 fi
 # Start out with the original AWS-generated authorized_keys file

configuration/update_authorized_keys_for_landscape_managers_if_changed

@@ -1,6 +1,7 @@
 #!/bin/bash
 BEARER_TOKEN="$1"
 BASE_URL="$2"
+LOGON_USER_HOME="$3"
 LAST_CHANGE_FILE=/var/run/last_change_aws_landscape_managers_ssh_keys
 # Uncomment the following for production use, with no error output
 last_change_millis=$( curl -H 'X-SAPSSE-Forward-Request-To: master' -H 'Authorization: Bearer '${BEARER_TOKEN} "${BASE_URL}/landscape/api/landscape/get_time_point_of_last_change_in_ssh_keys_of_aws_landscape_managers" 2>/dev/null | jq -r '."timePointOfLastChangeOfSetOfLandscapeManagers-millis"' )
@@ -15,6 +16,6 @@ else
 fi
 if [ ${PREVIOUS_CHANGE} -lt ${last_change_millis} ]; then
   logger -t sailing "New SSH key changes for landscape managers (${last_change_millis} newer than ${PREVIOUS_CHANGE})"
-  update_authorized_keys_for_landscape_managers "${BEARER_TOKEN}" "${BASE_URL}"
+  update_authorized_keys_for_landscape_managers "${BEARER_TOKEN}" "${BASE_URL}" "${LOGON_USER_HOME}"
 fi
 echo ${last_change_millis} >${LAST_CHANGE_FILE}