Bug 1910433

Summary:	REX is not possible on RHEL 8 when FUTURE crypto policy is set from Satellite 6.8
Product:	Red Hat Satellite	Reporter:	Sayan Das <saydas>
Component:	Remote Execution	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	CLOSED ERRATA	QA Contact:	Peter Ondrejka <pondrejk>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.8.0	CC:	aruzicka, lstejska, pcreech
Target Milestone:	6.11.0	Keywords:	Triaged
Target Release:	Unused
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:	tfm-rubygem-smart_proxy_remote_execution_ssh-0.5.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-07-05 14:28:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Sayan Das 2020-12-23 21:51:06 UTC

Description of problem:

Can't perform REX from Satellite 6.8 UI on RHEL 8.2 when FUTURE crypto policy is set.

But ssh as foreman-proxy user, from CLI, works just fine.


Version-Release number of selected component (if applicable):
Satellite 6.8
RHEL 8.2 [ Hopefully 8.3 as well ]
Crypto Policy: FUTURE  [ FIPS as well ]

How reproducible:
Always


Steps to Reproduce:
1. Ensure Satellite 6.8 is configured as per https://access.redhat.com/solutions/5393241 

2. Register a RHEL 8.2 host with Satellite and the RHEL 8.2 host must have the crypto-policy set as FUTURE.

3. Copy the foreman-proxy ssh keys to the RHEL 8 host and test ssh connectivity from command line.

4. Initiate a simple "uptime" command-based REX job from satellite UI for the same host.

Actual results:

3 is successful but at 4 i.e. REX from UI, the job will fail with the following error.
~~
Error initializing command: Net::SSH::AuthenticationFailed - Authentication failed for user root.com
~~


Expected results:


3 and 4 both should succeed.


Additional info:

As soon as we set back the crypto policy to LEGACY or DEFAULT, REX will work just fine.

Comment 8 Peter Ondrejka 2022-01-14 14:37:03 UTC

Verified on Satellite 7.0 snap 4, both ansible and ssh type rex job ran successfully against RHEL8 host with FUTURE crypto policy enabled

Comment 11 errata-xmlrpc 2022-07-05 14:28:38 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: Satellite 6.11 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:5498