Merge branch 'develop' into wip/nfs-510

CHANGELOG.md

@@ -39,6 +39,7 @@ This file is used to list changes made in each version of the AWS ParallelCluste
 
 **BUG FIXES**
 - Fix inconsistent scaling configuration after cluster update rollback when modifying the list of instance types declared in the Compute Resources.
+- Fix users SSH keys generation when switching users without root privilege in clusters integrated with an external LDAP server through cluster configuration files.
 
 3.7.2
 ------

cookbooks/aws-parallelcluster-environment/recipes/config/configure_pam_ssh_keygen.rb

@@ -18,7 +18,7 @@
 pam_services = %w(sudo su sshd)
 pam_config_dir = "/etc/pam.d"
 generate_ssh_key_path = "#{node['cluster']['scripts_dir']}/generate_ssh_key.sh"
-ssh_key_generator_pam_config_line = "session    optional     pam_exec.so log=/var/log/parallelcluster/pam_ssh_key_generator.log #{generate_ssh_key_path}"
+ssh_key_generator_pam_config_line = "session    optional     pam_exec.so seteuid log=/var/log/parallelcluster/pam_ssh_key_generator.log #{generate_ssh_key_path}"
 if node['cluster']["directory_service"]["generate_ssh_keys_for_users"] == 'true'
   template generate_ssh_key_path do
     source 'directory_service/generate_ssh_key.sh.erb'
@@ -44,7 +44,7 @@
     pam_config_file = "#{pam_config_dir}/#{pam_service}"
     delete_lines "Ensure PAM service #{pam_service} is not configured to call SSH key generation script" do
       path pam_config_file
-      pattern %r{session\s+optional\s+pam_exec\.so\s+log=/var/log/parallelcluster/pam_ssh_key_generator\.log}
+      pattern %r{session\s+optional\s+pam_exec\.so\s+seteuid\s+log=/var/log/parallelcluster/pam_ssh_key_generator\.log}
       ignore_missing true
     end
   end

cookbooks/aws-parallelcluster-environment/test/controls/directory_service_spec.rb

@@ -78,7 +78,7 @@
   pam_services.each do |pam_service|
     describe file("/etc/pam.d/#{pam_service}") do
       it { should exist }
-      its('content') { should match %r{session\s+optional\s+pam_exec\.so\s+log=/var/log/parallelcluster/pam_ssh_key_generator\.log} }
+      its('content') { should match %r{session\s+optional\s+pam_exec\.so\s+seteuid\s+log=/var/log/parallelcluster/pam_ssh_key_generator\.log} }
     end
   end