Bug 1479306 - [RFE] engine should use other SSH key types besides SSH RSA key
Summary: [RFE] engine should use other SSH key types besides SSH RSA key
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: BLL.Infra
Version: 4.1.5.1
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
: ---
Assignee: Martin Perina
QA Contact: Pavel Stehlik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-08-08 10:47 UTC by Jiri Belka
Modified: 2017-08-10 12:11 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-10 12:11:45 UTC
oVirt Team: Infra
Embargoed:
rule-engine: planning_ack?
rule-engine: devel_ack?
rule-engine: testing_ack?


Attachments (Terms of Use)

Description Jiri Belka 2017-08-08 10:47:38 UTC
Description of problem:

engine uses SSH RSA key only

# ls -l /etc/pki/ovirt-engine/keys/engine_id*
-rw-------. 1 root root 1832 May 15 17:16 /etc/pki/ovirt-engine/keys/engine_id_rsa
# rpm -q ovirt-engine
ovirt-engine-4.1.5.1-0.1.el7.noarch

but at least el7.4 uses multiple SSH keys

# ls -l /etc/ssh/*key
-rw-r-----. 1 root ssh_keys  227 Jun 16 08:17 /etc/ssh/ssh_host_ecdsa_key
-rw-r-----. 1 root ssh_keys  387 Jun 16 08:17 /etc/ssh/ssh_host_ed25519_key
-rw-r-----. 1 root ssh_keys 1679 Jun 16 08:17 /etc/ssh/ssh_host_rsa_key
# rpm -q redhat-release-server
redhat-release-server-7.4-18.el7.x86_64

also host xml doesn't mention to which SSH key host's SSHd fingerprint relates (it stuck to RSA internally).

<ssh>
<fingerprint>SHA256:t0BmApH+6lOys0q+C/HfLyXKFA4b1rP4PV6JjHC+3Ns</fingerprint>
<port>22</port>
</ssh>

imo to improve functionality engine should detect all host's SSHd fingerprints and save them with key type. this way, if anybody would decide to use only a specific ssh key type, engine could still communicate. currently, engine seems to work only with RSA keys.

an example of ssh key scan:

# ssh-keyscan slot-1.example.com 2>/dev/null | while read host pubkey ; do echo "${pubkey}" | ssh-keygen -l -f - ; done
2048 SHA256:t0BmApH+6lOys0q+C/HfLyXKFA4b1rP4PV6JjHC+3Ns no comment (RSA)
256 SHA256:7EdAfGitKB7JVOV3vSQAtRq+t8K9cXCTKz+Kwvtii+8 no comment (ECDSA)
256 SHA256:kZ/k7l2J5g1kOckhLgU2k+qQFQS0Cc3nyPDsGLZJC6I no comment (ED25519)

Version-Release number of selected component (if applicable):
ovirt-engine-4.1.5.1-0.1.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1. delete SSH RSA key from host, comment out RSA key from sshd_config on host
   restart sshd
2. try to add to engine
3.

Actual results:
Cannot add Host. Connecting to host via SSH has failed, verify that the host is reachable (IP address, routable address etc.) You may refer to the engine.log file for further details.

Expected results:
should work, engine should detect available host ssh key type and use appropriate ssh key

Additional info:

Comment 1 Jiri Belka 2017-08-08 10:49:07 UTC
and...

Error in fetching fingerprint

when trying to fetch not RSA SSH key fingerprint from host.

Comment 2 Oved Ourfali 2017-08-10 12:11:45 UTC
Thanks for posting this RFE, however I don't see this getting prioritized.
Closing as wontfix.


Note You need to log in before you can comment on or make changes to this bug.