This is really something that should be improved at the libvirt level. Reassigning.

We can't really do any good handling of failures like this when we're forking & exec'ing ssh. To do a good job, we'd need to re-write the remote driver to use libssh2 instead. Such a change is not really material for a stable RHEL update, so I'd recommend this be pushed to RHEL-6 or upstream.

As suggested in comment #4 we won't change to use libssh2 in libvirt, even
after the rebase for 5.6

Daniel

I don't think that this is a bug. Lessening the importance of the fact that a host key of a machine has changed might result in serious security vulnerabilities. Reinstalls of machines are a common operation, but admins should notify about the host key change, or copy the old ones. This is in my opinion an administrative "bug" and not something we shoud fix or lessen importance of.

I'd bet on that if we lessen/change the meaning of this error message, someone will report, what a security vulnerability we've created.

On the other hand, I agree that rewriting ssh connection support using library functions instead of spawning the ssh client process would be a better solution, but in that case I'd also prefer to leave the message complaining about changed host keys to stay as-is.

I'd like to hear your opinions on this case.

Peter

Oh, I shoud've read the bug report more closely. I missed the fact, that virt-manager and others don't report the error correctly. Sorry for the confusion. :/

Libvirt now supports a native ssh transport driver that reports errors to the management applications gracefuly. The new transport driver was added upstream with commits:

commit dfbb2d31208deeb68570a8242a3fae08b1bd27c7
Author: Peter Krempa <pkrempa>
Date:   Tue Jul 17 15:48:04 2012 +0200

    libssh2_transport: Use libssh2 driver code in remote driver
    
commit 25f2c8b4b04807f5c24fa87dc54d929ba1331421
Author: Peter Krempa <pkrempa>
Date:   Mon Nov 14 16:12:53 2011 +0100

    libssh2_transport: Add libssh2 session support to net client code
    
commit 637ea5427442d76c9499fb3922da3d81f9f0ad89
Author: Peter Krempa <pkrempa>
Date:   Mon Nov 14 15:50:02 2011 +0100

    libssh2_transport: add ssh context support to virNetSocket
    
commit 1193fc5f4465a622b22c10b16ab8081e98c2e622
Author: Peter Krempa <pkrempa>
Date:   Mon Nov 14 15:30:23 2011 +0100

    libssh2_transport: add main libssh2 transport implementation

Moving to POST.

Hi,

I try to verify this bug , but can not get expected result  
2 hosts pkg version : 
libvirt-0.10.0-0rc1.el6.x86_64
qemu-kvm-rhev-0.12.1.2-2.303.el6.x86_64
virt-manager-0.9.0-14.el6.x86_64


1) 
When I test it via virt-manager I get error message : 


Unable to open a connection to the libvirt management daemon.

Libvirt URI is: qemu+ssh://root.5.12/system

Verify that:
 - The 'libvirtd' daemon has been started

Cannot recv data: Value too large for defined data type

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/connection.py", line 1154, in _open_thread
    self.vmm = self._try_open()
  File "/usr/share/virt-manager/virtManager/connection.py", line 1138, in _try_open
    flags)
  File "/usr/lib64/python2.6/site-packages/libvirt.py", line 102, in openAuth
    if ret is None:raise libvirtError('virConnectOpenAuth() failed')
libvirtError: Cannot recv data: Value too large for defined data type


2) 
when I test it via virsh  I get error:
virsh -c qemu+ssh://10.66.5.12/system list
error: Cannot recv data: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
56:eb:86:62:26:5e:11:40:c6:88:83:3a:7f:8b:84:e1.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:2
RSA host key for 10.66.5.12 has changed and you have requested strict checking.
Host key verification failed.: Connection reset by peer
error: failed to connect to the hypervisor

You should test this with the new transport scheme as the old can't be fixed. Your URIs should look like: qemu+libssh2://10.66.5.12/system . Please note that this approach uses a different known_hosts file that should be located in ~/.config/libvirt/known_hosts. 

Also it might be possible that the libssh2 transport is not available if the libssh2 package wasn't updated to a compatible version yet (1.3 and later)

Hi, Peter Krempa
host env : 
libssh2-1.2.2-7.el6_2.3.x86_64 


I test it via libssh2 but get error :

#virsh -c qemu+libssh2://10.66.5.12/system list
error: libssh2 transport support was not enabled: Function not implemented
error: failed to connect to the hypervisor

I think maybe it did not add libssh2 support when build this version of libvirt.

As I stated in the second paragraph in my comment libssh2 1.3 and later is required for the libssh2 transport to work. Unfortunately the new version is not available yet. The library should be updated in time for the next release. You'll be able to verify this bug after libvirt is built against the newer version.

(In reply to comment #24)
> As I stated in the second paragraph in my comment libssh2 1.3 and later is
> required for the libssh2 transport to work. Unfortunately the new version is
> not available yet. The library should be updated in time for the next
> release. You'll be able to verify this bug after libvirt is built against
> the newer version.

Thanks very much

Hi,Peter Krempa 

Is there a valid libvirt pkg to test libssh2 ? 
my env : 

libvirt-0.10.2-2.el6.x86_64
libssh2-1.4.2-1.el6.x86_64

it still can not verify this bug 


Wenlong

Moving back to ASSIGNED as the spec file needs to be fixed to actually build libvirt with libssh2 support in Red Hat environments.

Fixed upstream:

commit 1e25c54f66b46223e8e31843cec9a825fd02c735
Author: Peter Krempa <pkrempa>
Date:   Fri Oct 12 16:50:42 2012 +0200

    spec: Add support for libssh2 transport
    
    Libssh2 transport support was enabled lately but the spec file wasn't
    updated to take this into account. This caused libvirt to be built
    without libssh2 support in Red Hat based OSes.

Hi, Peter 

I have the new libvirt rebuild with new libssh2 , but 
there is an error when I test libssh2 , I do not know what I missed 
please help me ,thanks very much .


libvirt-0.10.2-3.el6.x86_64
libssh2-1.4.2-1.el6.x86_64


# virsh -c qemu+libssh2://127.0.0.1/system list 
Accept SSH host key with hash 'D5:0F:B6:94:55:74:1D:BE:7E:BB:D2:D9:89:B7:26:CD' for host '127.0.0.1:22' (y/n)?: y
error: authentication failed: All provided authentication methods with credentials were rejected by the server
error: failed to connect to the hypervisor



ssh still works

# virsh -c qemu+ssh://127.0.0.1/system list 
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
RSA key fingerprint is d5:0f:b6:94:55:74:1d:be:7e:bb:d2:d9:89:b7:26:cd.
Are you sure you want to continue connecting (yes/no)? yes
root.0.1's password: 
 Id    Name                           State
----------------------------------------------------
 14    ga                             running
 16    q64                            running

sshd in RHEL-6.4 does not support keyboard-interactive authentication in the default configuration.

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password

The libssh2 driver uses this authentication method to to the password authentication. A workaround is to use publickey authentication until either sshd or libvirt get fixed to support passwords.

Fix proposed upstream: http://www.redhat.com/archives/libvir-list/2012-November/msg01152.html

As there is a workaround, I filed bug https://bugzilla.redhat.com/show_bug.cgi?id=881663 to track the issue of password authentication not working when the "keyboard-interactive" method is disabled on the ssh server.

The workaround is to enable option "ChallengeResponseAuthentication" in /etc/ssh/sshd_config and restart the sshd service.

(In reply to comment #35)
> As there is a workaround, I filed bug
> https://bugzilla.redhat.com/show_bug.cgi?id=881663 to track the issue of
> password authentication not working when the "keyboard-interactive" method
> is disabled on the ssh server.
> 
> The workaround is to enable option "ChallengeResponseAuthentication" in
> /etc/ssh/sshd_config and restart the sshd service.


Thanks very much Peter 

Verify this bug :
libvirt-0.10.2-10.el6.x86_64

enable ChallengeResponseAuthentication in sshd config 
#cat /etc/ssh/sshd_config |grep ChallengeResponseAuthentication
ChallengeResponseAuthentication yes

then restart sshd 
service sshd restart

#  virsh -c qemu+libssh2://127.0.0.1/system list 
Accept SSH host key with hash '9E:3F:64:96:C7:47:E5:28:3B:6C:72:2C:76:D9:18:CB' for host '127.0.0.1:22' (y/n)?: y
Password: 
 Id    Name                           State
----------------------------------------------------

Unfortunately libssh2 turned out to be insufficiently stable and I must close this BZ as WONTFIX.