Bug 2129275

Summary:	SSH lost after upgrading from RHEL 8 to 9 due unprotected private key files
Product:	Red Hat Enterprise Linux 9	Reporter:	Luis Arizmendi <larizmen>
Component:	openssh	Assignee:	Dmitry Belyavskiy <dbelyavs>
Status:	CLOSED WORKSFORME	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	low	Docs Contact:
Priority:	medium
Version:	9.0	CC:	abustosp, jjelen
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-09 13:48:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Luis Arizmendi 2022-09-23 07:42:34 UTC

Description of problem:
--------------------------------------------

I installed a RHEL 8.6 (RHEL for Edge) and I followed the procedure shown in [1] to perform the upgrade to RHEL 9.

The upgrade was ok, but probably due to the different hardening policies in RHEL 9, I was not able to connect to the server anymore using SSH. 

Connecting using the console I found this message:

"WARNING: UNPROTECTED PRIVATE KEY FILE!"

I checked that by changing permissions to the key files (chmod 600 /etc/ssh/*key) and restarting the sshd service I recovered the access.

The problem is that is not documented and losing SSH during an upgrade is something that shouldn't happen so either we document it, change that ssh policy in RHEL 9 to just warning (instead of enforcing, which probably is not a good idea), or make these changes in the permissions automatically during the upgrade process.

It happened with RHEL for Edge but probably it's something that will face in any RHEL 8 to 9 upgrade.


[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/composing_installing_and_managing_rhel_for_edge_images/index#proc_upgrading-your-rhel-8-system-to-rhel-9_managing-rhel-for-edge-images


Version-Release number of selected component (if applicable):
----------------------------------------------------------------------

RHEL 8.6 -> RHEL 9


How reproducible:
----------------------------------------------------------------------

Reproducible


Steps to Reproduce:
----------------------------------------------------------------------

1. Deploy a RHEL for Edge 8.6 (maybe also just RHEL 8.6)
2. Perform the upgrade
3. Try to connect to the upgraded server using SSH


Actual results:
----------------------------------------------------------------------
It's not possible to connect to the upgraded server using SSH


Expected results:
----------------------------------------------------------------------
You should be able to access the server using SSH, even more when you didn't change any default configuration/permission in RHEL 8.6



Additional info:

Comment 1 Jakub Jelen 2022-09-23 17:00:58 UTC

What were the permissions of the hostkeys before the upgrade. What steps did you use to upgrade the server? I am not aware of anything during upgrade that should change the permissions of the ssh hostkeys and this check for the hostkeys permissions is in openssh for ages.