Bug 1966897
| Summary: | Cockpit connection fails with error "Inappropriate ioctl for device" when ssh key with passphrase is used | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Stefan Meyer <smeyer> |
| Component: | Remote Execution | Assignee: | Adam Ruzicka <aruzicka> |
| Status: | CLOSED ERRATA | QA Contact: | Peter Ondrejka <pondrejk> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.8.0 | CC: | aruzicka, lstejska, osousa |
| Target Milestone: | 6.10.0 | Keywords: | Triaged |
| Target Release: | Unused | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | tfm-rubygem-smart_proxy_remote_execution_ssh-0.3.2 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-16 14:11:21 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Stefan Meyer
2021-06-02 07:16:31 UTC
Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/31516 has been resolved. Upstream release 0.3.2 containing the fix for this BZ was just released. Attempting to check on Sat 6.10 snap 10, unfortunately hitting the same issue as in https://bugzilla.redhat.com/show_bug.cgi?id=1747751#c16 also with password protected ssh key, which blocks verification As the issue in 1747751 is probably unrelated, I'm sharing the verification steps that led to rex job hanging:
on satellite:
- yum install tfm-rubygem-foreman_remote_execution-cockpit --disableplugin foreman-protector
- satellite-installer --enable-foreman-plugin-remote-execution-cockpit
- register host via global registration
- ssh-keygen -o -a 100 -t rsa -m pem -f ssh/id_passwd -C "foreman-proxy@<hostname>" (choose passwd)
- chown foreman-proxy:foreman-proxy ssh/id_passwd
- chown foreman-proxy:foreman-proxy ssh/id_passwd.pub
- in /etc/foreman-proxy/settings.d/remote_execution_ssh.yml set
:ssh_identity_key_file: /var/lib/foreman-proxy/ssh/id_passwd
- systemctl restart foreman-proxy
on client:
- yum install cockpit
- curl https://sat_hostname:9090/ssh/pubkey >> ~/.ssh/authorized_keys
- hammer host set-parameter --name remote_execution_ssh_key_passphrase --value <passwd> --host-id <host_id>
back on satellite:
- verify key's working: ssh root@<client> -i ssh/id_passwd
Now try to run rex job from satellite -- it hangs (even if supplying pk password in the ui).
Cockpit connection fails with "Internal error in login process" (though it worked with default key).
Reproducer machines availabe upon ping
The above issue was due to the ssh-keygen command used (the -o option cancelled the effects of -m pem) so with: ssh-keygen -a 100 -t rsa -m pem -f ssh/id_passwd -C "foreman-proxy@<hostname>" The key works correctly both on remote execution and the cockpit connection. However the ansible-based rex jobs remain in hanging state, therefore I filed https://bugzilla.redhat.com/show_bug.cgi?id=1986422 As the original cockpit issue no longer occurs I'm moving this to verified for Satellite 6.10 snap 10 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4702 |