tests(e2e): Base VM image generation improvements (#833)

e2e/cmd/build_base_image/01_prepare_base_vm/main.go

@@ -156,18 +156,30 @@ sudo rm -f /etc/dpkg/dpkg.cfg.d/force-unsafe-io
 		return fmt.Errorf("failed to install required packages: %w", err)
 	}
 
-	// Upload first run script
-	log.Infof("Staging first run script to VM...")
 	scriptsDir, err := scripts.Dir()
 	if err != nil {
 		return fmt.Errorf("failed to get scripts directory: %w", err)
 	}
-	provisionScriptPath := filepath.Join(scriptsDir, "provision.sh")
-	if err := client.Upload(provisionScriptPath, "/home/azureuser/provision.sh"); err != nil {
+	// Upload and execute provision script. This sets up networking and SSH
+	// configuration.
+	log.Infof("Staging provision script to VM...")
+	if err := client.Upload(filepath.Join(scriptsDir, "provision.sh"), "/home/azureuser"); err != nil {
 		return fmt.Errorf("failed to upload provisioning script: %w", err)
 	}
+	log.Infof("Running provision script on VM...")
+	if _, err := client.Run(ctx, "sudo bash /home/azureuser/provision.sh"); err != nil {
+		return fmt.Errorf("failed to run provisioning script: %w", err)
+	}
+	if _, err := client.Run(ctx, "rm /home/azureuser/provision.sh"); err != nil {
+		return fmt.Errorf("failed to delete provisioning script after execution: %w", err)
+	}
 
-	// Prepare script to run on first boot
+	// Upload first run script and prepare it to run on first boot. This sets up
+	// a unique hostname for the VM.
+	log.Infof("Staging first run script to VM...")
+	if err := client.Upload(filepath.Join(scriptsDir, "first-run.sh"), "/home/azureuser"); err != nil {
+		return fmt.Errorf("failed to upload first run script: %w", err)
+	}
 	log.Infof("Preparing cloud-init script...")
 	_, err = client.Run(ctx, "sudo cloud-init clean")
 	if err != nil {
@@ -177,11 +189,11 @@ sudo rm -f /etc/dpkg/dpkg.cfg.d/force-unsafe-io
 	if err != nil {
 		return fmt.Errorf("failed to create cloud-init script directory: %w", err)
 	}
-	_, err = client.Run(ctx, "sudo mv /home/azureuser/provision.sh /var/lib/cloud/scripts/per-once/provision.sh")
+	_, err = client.Run(ctx, "sudo mv /home/azureuser/first-run.sh /var/lib/cloud/scripts/per-once/first-run.sh")
 	if err != nil {
 		return fmt.Errorf("failed to copy cloud-init script: %w", err)
 	}
-	_, err = client.Run(ctx, "sudo chmod +x /var/lib/cloud/scripts/per-once/provision.sh")
+	_, err = client.Run(ctx, "sudo chmod +x /var/lib/cloud/scripts/per-once/first-run.sh")
 	if err != nil {
 		return fmt.Errorf("failed to make cloud-init script executable: %w", err)
 	}

e2e/scripts/first-run.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -eu
+
+# This script runs on the first boot of the VM.
+echo "Setting hostname..."
+hostname="$(lsb_release -cs)-$(openssl rand -hex 4)"
+hostnamectl set-hostname "$hostname"
+
+echo "Adding hostname to hosts file..."
+echo "127.0.0.1 $hostname" >> /etc/hosts

e2e/scripts/provision.sh

@@ -2,24 +2,13 @@
 
 set -eu
 
-# This script runs on the first boot of the VM.
-echo "Setting hostname..."
-hostname="$(lsb_release -cs)-$(openssl rand -hex 4)"
-hostnamectl set-hostname "$hostname"
+echo "Create global authorized_keys file..."
+cp /home/azureuser/.ssh/authorized_keys /etc/ssh/authorized_keys
+chmod 644 /etc/ssh/authorized_keys # needs to be world-readable
+echo "AuthorizedKeysFile /etc/ssh/authorized_keys" >> /etc/ssh/sshd_config
 
-echo "Adding hostname to hosts file..."
-echo "127.0.0.1 $hostname" >> /etc/hosts
-
-echo "Updating authorized_keys for root..."
-mkdir -p /root/.ssh
-chmod 700 /root/.ssh
-cp /home/azureuser/.ssh/authorized_keys /root/.ssh/authorized_keys
-chmod 600 /root/.ssh/authorized_keys
-
-echo "Allowing password authentication via SSH..."
-sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
-sed -i 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' /etc/ssh/sshd_config
-sed -i 's/KbdInteractiveAuthentication no/KbdInteractiveAuthentication yes/g' /etc/ssh/sshd_config
+echo "Configure PAM to create home directories on first login..."
+pam-auth-update --enable mkhomedir
 
 echo "Updating DNS resolver to use AD DNS..."
 echo "DNS=10.1.0.4" >> /etc/systemd/resolved.conf