Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1111568 - AUTOCREATE_SERVER_KEYS=RSAONLY is not supported by init script
AUTOCREATE_SERVER_KEYS=RSAONLY is not supported by init script
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openssh (Show other bugs)
6.5
Unspecified Unspecified
medium Severity high
: rc
: ---
Assigned To: Petr Lautrbach
Patrik Kis
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2014-06-20 07:45 EDT by Patrik Kis
Modified: 2018-04-17 13:13 EDT (History)
1 user (show)

See Also:
Fixed In Version: openssh-5.3p1-98.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-14 03:40:00 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1552 normal SHIPPED_LIVE Moderate: openssh security, bug fix, and enhancement update 2014-10-13 21:21:23 EDT

  None (edit)
Description Patrik Kis 2014-06-20 07:45:35 EDT
Description of problem:
openssh configuration file /etc/sysconfig/sshd says that it supports the f

# AUTOCREATE_SERVER_KEYS=RSAONLY
# AUTOCREATE_SERVER_KEYS=NO
AUTOCREATE_SERVER_KEYS=YES

But the init script /etc/init.d/sshd seems supports only YES and NO options, e.g. create all or none.

Please note that this may cause troubles in FIPS, where DSA should be disallowed.

Version-Release number of selected component (if applicable):
openssh-5.3p1-94.el6

How reproducible:
always

Steps to Reproduce:
# rm -f /etc/ssh/*key
# grep ^AUTOCREATE_SERVER_KEYS /etc/sysconfig/sshd
AUTOCREATE_SERVER_KEYS=YES
# service sshd restart
Stopping sshd:                                             [  OK  ]
Generating SSH1 RSA host key:                              [  OK  ]
Generating SSH2 RSA host key:                              [  OK  ]
Generating SSH2 DSA host key:                              [  OK  ]
Starting sshd:                                             [  OK  ]
# ll /etc/ssh/*key
-rw-------. 1 root root  668 Jun 20 13:42 /etc/ssh/ssh_host_dsa_key
-rw-------. 1 root root  963 Jun 20 13:42 /etc/ssh/ssh_host_key
-rw-------. 1 root root 1675 Jun 20 13:42 /etc/ssh/ssh_host_rsa_key
#
#
#
# rm -f /etc/ssh/*key
# vim /etc/sysconfig/sshd 
# grep ^AUTOCREATE_SERVER_KEYS /etc/sysconfig/sshd
AUTOCREATE_SERVER_KEYS=RSAONLY
# service sshd restart
Stopping sshd:                                             [  OK  ]
Generating SSH1 RSA host key:                              [  OK  ]
Generating SSH2 RSA host key:                              [  OK  ]
Generating SSH2 DSA host key:                              [  OK  ]
Starting sshd:                                             [  OK  ]
# ll /etc/ssh/*key
-rw-------. 1 root root  668 Jun 20 13:42 /etc/ssh/ssh_host_dsa_key
-rw-------. 1 root root  963 Jun 20 13:42 /etc/ssh/ssh_host_key
-rw-------. 1 root root 1675 Jun 20 13:42 /etc/ssh/ssh_host_rsa_key
Comment 1 Petr Lautrbach 2014-06-20 07:47:57 EDT
A fix is quite simple and can be simply added to the update.
Comment 4 errata-xmlrpc 2014-10-14 03:40:00 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-1552.html

Note You need to log in before you can comment on or make changes to this bug.