Bug 1886343
| Summary: | ssh ignores VerifyHostKeyDNS yes when built without ldns support | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Petr Menšík <pemensik> | ||||
| Component: | openssh | Assignee: | Dmitry Belyavskiy <dbelyavs> | ||||
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 34 | CC: | crypto-team, dwalsh, jjelen, lkundrak, mattias.ellert, pemensik, plautrba, pwouters, tmraz | ||||
| Target Milestone: | --- | Keywords: | Triaged | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2022-04-12 13:59:17 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Petr Menšík
2020-10-08 08:59:17 UTC
I have even filled instrastructure ticket[1] first, because I thought these records were invalid. 1. https://pagure.io/fedora-infrastructure/issue/9380 Thank you for the bug report and pull request. I am no DNS expert so please bear in mind my understanding might not be right. We had a recently a bug #1878166, which I believe is an issue of configuration as openssh requires ends0 enabled in /etc/resolv.conf (which is not default in fedora) to work with the FPs from DNS (unless the ldns is linked in). Please, share also debug log of your connection, which might provide more details. On a side note, we have a test that worked fine with Fedora 32 and fails with Fedora 33 for some reason, but looks like related to local dns resolver rather than openssh (can share more information offline). Checking the last builds for Fedora 32 and 33 does not list any differences in dependencies (that we would drop ldns unintentionally). Can you submit the (configure) patch upstream, as it looks like you understand the problem better than me. Created attachment 1721044 [details]
Report warning patch
Made patch warning in build without ldns, when edns0 is missing from options and VerifyHostKeyDNS yes is configured. If ask is configured, no new message is shown. Should help those running local validating resolver. (In reply to Jakub Jelen from comment #2) > On a side note, we have a test that worked fine with Fedora 32 and fails > with Fedora 33 for some reason, but looks like related to local dns resolver > rather than openssh (can share more information offline). Checking the last > builds for Fedora 32 and 33 does not list any differences in dependencies > (that we would drop ldns unintentionally). Reason for the failure in f33 would be two things. First, it has missing edns0 in resolv.conf it manages. Second, it turned off dnssec by default to work around some problems. Try: resolvectl dnssec eth0 yes Replace eth0 to whatever is actually used. Or use at least DNSSEC=allow-downgrade in /etc/systemd/resolved.conf and restart systemd-resolved. And fill a bug. :) > > Can you submit the (configure) patch upstream, as it looks like you > understand the problem better than me. Done There are various bugs with systemd-resolved on fedora 33 with respect to DNSSEC - specifically getting/setting the DO/AD bits. Since sshfp records need the AD bit for the client to want to trust them, this causes problems. But also worse, systemd-resolved might set the AD bit on SSHFP records it has NOT validate. This bug appears to have been reported against 'rawhide' during the Fedora 34 development cycle. Changing version to 34. Is this issue still relevant? No response since November. Closing. |