Bug 1479306 - [RFE] engine should use other SSH key types besides SSH RSA key
[RFE] engine should use other SSH key types besides SSH RSA key
Status: CLOSED WONTFIX
Product: ovirt-engine
Classification: oVirt
Component: BLL.Infra (Show other bugs)
4.1.5.1
Unspecified Unspecified
unspecified Severity low (vote)
: ---
: ---
Assigned To: Martin Perina
Pavel Stehlik
: FutureFeature
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-08-08 06:47 EDT by Jiri Belka
Modified: 2017-08-10 08:11 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-10 08:11:45 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: Infra
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
rule-engine: planning_ack?
rule-engine: devel_ack?
rule-engine: testing_ack?


Attachments (Terms of Use)

  None (edit)
Description Jiri Belka 2017-08-08 06:47:38 EDT
Description of problem:

engine uses SSH RSA key only

# ls -l /etc/pki/ovirt-engine/keys/engine_id*
-rw-------. 1 root root 1832 May 15 17:16 /etc/pki/ovirt-engine/keys/engine_id_rsa
# rpm -q ovirt-engine
ovirt-engine-4.1.5.1-0.1.el7.noarch

but at least el7.4 uses multiple SSH keys

# ls -l /etc/ssh/*key
-rw-r-----. 1 root ssh_keys  227 Jun 16 08:17 /etc/ssh/ssh_host_ecdsa_key
-rw-r-----. 1 root ssh_keys  387 Jun 16 08:17 /etc/ssh/ssh_host_ed25519_key
-rw-r-----. 1 root ssh_keys 1679 Jun 16 08:17 /etc/ssh/ssh_host_rsa_key
# rpm -q redhat-release-server
redhat-release-server-7.4-18.el7.x86_64

also host xml doesn't mention to which SSH key host's SSHd fingerprint relates (it stuck to RSA internally).

<ssh>
<fingerprint>SHA256:t0BmApH+6lOys0q+C/HfLyXKFA4b1rP4PV6JjHC+3Ns</fingerprint>
<port>22</port>
</ssh>

imo to improve functionality engine should detect all host's SSHd fingerprints and save them with key type. this way, if anybody would decide to use only a specific ssh key type, engine could still communicate. currently, engine seems to work only with RSA keys.

an example of ssh key scan:

# ssh-keyscan slot-1.example.com 2>/dev/null | while read host pubkey ; do echo "${pubkey}" | ssh-keygen -l -f - ; done
2048 SHA256:t0BmApH+6lOys0q+C/HfLyXKFA4b1rP4PV6JjHC+3Ns no comment (RSA)
256 SHA256:7EdAfGitKB7JVOV3vSQAtRq+t8K9cXCTKz+Kwvtii+8 no comment (ECDSA)
256 SHA256:kZ/k7l2J5g1kOckhLgU2k+qQFQS0Cc3nyPDsGLZJC6I no comment (ED25519)

Version-Release number of selected component (if applicable):
ovirt-engine-4.1.5.1-0.1.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1. delete SSH RSA key from host, comment out RSA key from sshd_config on host
   restart sshd
2. try to add to engine
3.

Actual results:
Cannot add Host. Connecting to host via SSH has failed, verify that the host is reachable (IP address, routable address etc.) You may refer to the engine.log file for further details.

Expected results:
should work, engine should detect available host ssh key type and use appropriate ssh key

Additional info:
Comment 1 Jiri Belka 2017-08-08 06:49:07 EDT
and...

Error in fetching fingerprint

when trying to fetch not RSA SSH key fingerprint from host.
Comment 2 Oved Ourfali 2017-08-10 08:11:45 EDT
Thanks for posting this RFE, however I don't see this getting prioritized.
Closing as wontfix.

Note You need to log in before you can comment on or make changes to this bug.