Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1591801

Summary:	uutils.ssh.OpenSSHUtils - the key algorithm 'EC' is not supported on Fedora 28
Product:	[oVirt] ovirt-engine	Reporter:	Sandro Bonazzola <sbonazzo>
Component:	uutils	Assignee:	Martin Perina <mperina>
Status:	CLOSED UPSTREAM	QA Contact:	Lukas Svaty <lsvaty>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	4.3.0	CC:	bugs, gzaidman, lsvaty, pkliczew
Target Milestone:	ovirt-4.3.0	Flags:	rule-engine: ovirt-4.3+
Target Release:	4.3.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ovirt-engine-4.3.0_alpha	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-12-06 09:45:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Infra	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1460625

Description Sandro Bonazzola 2018-06-15 15:17:11 UTC

Adding an host with engine running on Fedora 28 server fails with:

2018-06-15 17:08:23,478+02 ERROR [org.ovirt.engine.core.uutils.ssh.OpenSSHUtils] (default task-2) [b9fdcbba-a577-4923-a718-c45f56aa0830] The key algorithm 'EC' is not supported, will return null.
2018-06-15 17:08:23,485+02 ERROR [org.ovirt.engine.core.bll.hostdeploy.AddVdsCommand] (default task-2) [b9fdcbba-a577-4923-a718-c45f56aa0830] Failed to establish session with host 'host': null

Involved packages:
ovirt-engine-4.3.0-0.0.master.20180613124113.git0abf28f2d59.fc28.noarch

# rpm -qav |grep ssh|sort
apache-sshd-0.14.0-7.fc28.noarch
fence-agents-ilo-ssh-4.2.1-1.fc28.x86_64
libssh-0.7.5-7.fc28.x86_64
libssh2-1.8.0-7.fc28.x86_64
openssh-7.7p1-3.fc28.x86_64
openssh-clients-7.7p1-3.fc28.x86_64
openssh-server-7.7p1-3.fc28.x86_64
sshpass-1.06-5.fc28.x86_64

Not sure if related to bug #1441528

Comment 1 Sandro Bonazzola 2018-06-15 15:22:00 UTC

If it may help:

rpm -qf /etc/crypto-policies/back-ends/openssh.config
crypto-policies-20180425-5.git6ad4018.fc28.noarch

cat /etc/crypto-policies/back-ends/openssh.config
Ciphers aes256-gcm,chacha20-poly1305,aes256-ctr,aes256-cbc,aes128-gcm,aes128-ctr,aes128-cbc
MACs hmac-sha2-256-etm,hmac-sha1-etm,umac-128-etm,hmac-sha2-512-etm,hmac-sha2-256,hmac-sha1,umac-128,hmac-sha2-512
GSSAPIKexAlgorithms gss-gex-sha1-,gss-group14-sha1-
KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

Comment 2 Sandro Bonazzola 2018-06-15 15:31:29 UTC

Also note workaround mentioned in https://www.ovirt.org/release/3.6.1/#fedora-22 is not working:

"
Fedora 22
on hosts you need to add following line to /etc/ssh/sshd_config

KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

and then execute

  # systemctl restart sshd
before adding the host to the engine.
"

Comment 3 Piotr Kliczewski 2018-06-28 09:02:22 UTC

This issue could be related to this [1] jdk bug.


[1] https://bugs.openjdk.java.net/browse/JDK-8182580

Comment 4 Martin Perina 2018-07-09 10:22:04 UTC

There is no progress on JDK-8182580 for year, but the issue seems to be working on JDK9, so we will most probably need to upgrade to JDK9/10 on Fedora to resolve the issue.

Comment 5 Gal Zaidman 2018-10-07 06:22:04 UTC

for knowledge preserving, the current workaround is to comment out the line:
"HostKey /etc/ssh/ssh_host_ecdsa_key" from /etc/ssh/sshd_config on the host