Description of problem: When Remote Execution is used with a ssh key that has a passphrase set the cockpit session fails to open with error "Inappropriate ioctl for device". Version-Release number of selected component (if applicable): - Satellite 6.8.6 - tfm-rubygem-foreman_remote_execution-cockpit-3.3.7.2-2.el7sat.noarch How reproducible: - Whenever the ssh key has a passphrase set Steps to Reproduce: 1. Create a new ssh key with passphrase 2. Add passphrase to parameter remote_execution_ssh_key_passphrase 3. Actual results: - Standard Remote Execution works - Opening the cockpit session fails with error "Inappropriate ioctl for device" Expected results: - Cockpit should be usable with ssh keys that have a passphrase set Additional info:
Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/31516 has been resolved.
Upstream release 0.3.2 containing the fix for this BZ was just released.
Attempting to check on Sat 6.10 snap 10, unfortunately hitting the same issue as in https://bugzilla.redhat.com/show_bug.cgi?id=1747751#c16 also with password protected ssh key, which blocks verification
As the issue in 1747751 is probably unrelated, I'm sharing the verification steps that led to rex job hanging: on satellite: - yum install tfm-rubygem-foreman_remote_execution-cockpit --disableplugin foreman-protector - satellite-installer --enable-foreman-plugin-remote-execution-cockpit - register host via global registration - ssh-keygen -o -a 100 -t rsa -m pem -f ssh/id_passwd -C "foreman-proxy@<hostname>" (choose passwd) - chown foreman-proxy:foreman-proxy ssh/id_passwd - chown foreman-proxy:foreman-proxy ssh/id_passwd.pub - in /etc/foreman-proxy/settings.d/remote_execution_ssh.yml set :ssh_identity_key_file: /var/lib/foreman-proxy/ssh/id_passwd - systemctl restart foreman-proxy on client: - yum install cockpit - curl https://sat_hostname:9090/ssh/pubkey >> ~/.ssh/authorized_keys - hammer host set-parameter --name remote_execution_ssh_key_passphrase --value <passwd> --host-id <host_id> back on satellite: - verify key's working: ssh root@<client> -i ssh/id_passwd Now try to run rex job from satellite -- it hangs (even if supplying pk password in the ui). Cockpit connection fails with "Internal error in login process" (though it worked with default key). Reproducer machines availabe upon ping
The above issue was due to the ssh-keygen command used (the -o option cancelled the effects of -m pem) so with: ssh-keygen -a 100 -t rsa -m pem -f ssh/id_passwd -C "foreman-proxy@<hostname>" The key works correctly both on remote execution and the cockpit connection. However the ansible-based rex jobs remain in hanging state, therefore I filed https://bugzilla.redhat.com/show_bug.cgi?id=1986422 As the original cockpit issue no longer occurs I'm moving this to verified for Satellite 6.10 snap 10
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4702