Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1966897 - Cockpit connection fails with error "Inappropriate ioctl for device" when ssh key with passphrase is used
Summary: Cockpit connection fails with error "Inappropriate ioctl for device" when ssh...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Remote Execution
Version: 6.8.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: 6.10.0
Assignee: Adam Ruzicka
QA Contact: Peter Ondrejka
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-02 07:16 UTC by Stefan Meyer
Modified: 2021-11-16 14:11 UTC (History)
3 users (show)

Fixed In Version: tfm-rubygem-smart_proxy_remote_execution_ssh-0.3.2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-16 14:11:21 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 31516 0 Normal Ready For Testing Cockpit with ssh key passphrase does not work 2021-06-02 07:34:40 UTC
Red Hat Product Errata RHSA-2021:4702 0 None None None 2021-11-16 14:11:30 UTC

Description Stefan Meyer 2021-06-02 07:16:31 UTC 
Description of problem:
When Remote Execution is used with a ssh key that has a passphrase set
the cockpit session fails to open with error "Inappropriate ioctl for device".

Version-Release number of selected component (if applicable):
- Satellite 6.8.6
- tfm-rubygem-foreman_remote_execution-cockpit-3.3.7.2-2.el7sat.noarch

How reproducible:
- Whenever the ssh key has a passphrase set

Steps to Reproduce:
1. Create a new ssh key with passphrase
2. Add passphrase to parameter remote_execution_ssh_key_passphrase
3. 

Actual results:
- Standard Remote Execution works
- Opening the cockpit session fails with error "Inappropriate ioctl for device"

Expected results:
- Cockpit should be usable with ssh keys that have a passphrase set

Additional info:
Comment 3 Bryan Kearney 2021-06-14 12:01:30 UTC 
Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/31516 has been resolved.
Comment 4 Adam Ruzicka 2021-07-09 09:24:39 UTC 
Upstream release 0.3.2 containing the fix for this BZ was just released.
Comment 5 Peter Ondrejka 2021-07-23 14:25:51 UTC 
Attempting to check on Sat 6.10 snap 10, unfortunately hitting the same issue as in https://bugzilla.redhat.com/show_bug.cgi?id=1747751#c16 also with password protected ssh key, which blocks verification
Comment 6 Peter Ondrejka 2021-07-27 08:15:07 UTC 
As the issue in 1747751 is probably unrelated, I'm sharing the verification steps that led to rex job hanging:

on satellite:

- yum install tfm-rubygem-foreman_remote_execution-cockpit --disableplugin foreman-protector
- satellite-installer --enable-foreman-plugin-remote-execution-cockpit
- register host via global registration

- ssh-keygen -o -a 100 -t rsa -m pem -f ssh/id_passwd -C "foreman-proxy@<hostname>" (choose passwd)
- chown foreman-proxy:foreman-proxy ssh/id_passwd
- chown foreman-proxy:foreman-proxy ssh/id_passwd.pub
- in /etc/foreman-proxy/settings.d/remote_execution_ssh.yml set 
     :ssh_identity_key_file: /var/lib/foreman-proxy/ssh/id_passwd
- systemctl restart foreman-proxy

on client:
- yum install cockpit
- curl https://sat_hostname:9090/ssh/pubkey >> ~/.ssh/authorized_keys
- hammer host set-parameter --name remote_execution_ssh_key_passphrase --value <passwd> --host-id <host_id>

back on satellite:
- verify key's working: ssh root@<client> -i ssh/id_passwd

Now try to run rex job from satellite -- it hangs (even if supplying pk password in the ui).
Cockpit connection fails with "Internal error in login process" (though it worked with default key).

Reproducer machines availabe upon ping
Comment 7 Peter Ondrejka 2021-07-27 13:59:53 UTC 
The above issue was due to the ssh-keygen command used (the -o option cancelled the effects of  -m pem) so with:
 
  ssh-keygen  -a 100 -t rsa -m pem -f ssh/id_passwd -C "foreman-proxy@<hostname>"

The key works correctly both on remote execution and the cockpit connection. However the ansible-based rex jobs remain in hanging state, therefore I filed https://bugzilla.redhat.com/show_bug.cgi?id=1986422

As the original cockpit issue no longer occurs I'm moving this to verified for Satellite 6.10 snap 10
Comment 10 errata-xmlrpc 2021-11-16 14:11:21 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4702
Note You need to log in before you can comment on or make changes to this bug.