Red Hat Bugzilla – Bug 801719
"Error looking up public keys" while ssh to replica using IP address.
Last modified: 2015-02-04 17:49:35 EST
Upstream ticket: https://fedorahosted.org/sssd/ticket/1245
Just a small clarification, this is a full output of ssh connection with hostname and host ip: # ssh fbar@vm-138.idm.lab.bos.redhat.com fbar@vm-138.idm.lab.bos.redhat.com's password: Last login: Fri Mar 9 09:19:11 2012 from vm-068.idm.lab.bos.redhat.com # ssh fbar@10.16.78.138 Error looking up public keys The authenticity of host '10.16.78.138 (<no hostip for proxy command>)' can't be established. RSA key fingerprint is f4:f6:c8:45:23:7a:44:65:20:01:51:79:27:34:ad:33. No matching host key fingerprint found in DNS. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.16.78.138' (RSA) to the list of known hosts. fbar@10.16.78.138's password: Last login: Fri Mar 9 09:20:13 2012 from vm-068.idm.lab.bos.redhat.com
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: Reverse DNS lookup was not done to get the FQDN of a host specified by IP address. Consequence: SSH host public key lookup was incorrectly attempted with the textual IP address as FQDN. Fix: Do reverse DNS lookup to get the FQDN of the host before the SSH host public key lookup. Result: SSH host public key lookup is done correctly with FQDN of the host.
Deleted Technical Notes Contents. Old Contents: Cause: Reverse DNS lookup was not done to get the FQDN of a host specified by IP address. Consequence: SSH host public key lookup was incorrectly attempted with the textual IP address as FQDN. Fix: Do reverse DNS lookup to get the FQDN of the host before the SSH host public key lookup. Result: SSH host public key lookup is done correctly with FQDN of the host.
sssd-version: ============ [root@ipareplica ~]# rpm -q sssd sssd-1.8.0-25.el6.x86_64 [root@ipareplica ~]# Now i see error message "Error looking up public keys" when i do ssh to replica even with hostnames [root@ipa63server ~]# ipa dnsrecord-show testrelm.com ipa63server Record name: ipa63server A record: 10.65.201.141 SSHFP record: 2 1 56589F9B48400243165B37E43634E0F2DA4F4A8F, 1 1 798DCDB5A89F18007EF0ECEDF21FBD32F907178A [root@ipa63server ~]# [root@ipa63server ~]# ipa dnsrecord-show testrelm.com ipareplica Record name: ipareplica A record: 10.65.201.159 SSHFP record: 2 1 B1678B617E211E15F4D5473649BE8E796223E7F8, 1 1 87B8DDAD108C76E60553E6E8148F26F1423FE37B [root@ipa63server ~]# [root@ipa63server ~]# ssh tuser1@ipareplica.testrelm.com Error looking up public keys tuser1@ipareplica.testrelm.com's password:
*** Bug 817406 has been marked as a duplicate of this bug. ***
*** Bug 813884 has been marked as a duplicate of this bug. ***
xdong verifying
ipa version: ipa-server-3.0.0-8.el6.x86_64 how to verify: 1. Install ipa-server with dns 2. Install ipa-server replica 3. [root@qe-blade-06 ~]# ipa dnsrecord-find testrelm.com cloud-qe-15 Record name: @ NS record: qe-blade-06.testrelm.com., cloud-qe-15.testrelm.com. ... Record name: cloud-qe-15 A record: 10.16.96.100 SSHFP record: 1 1 CE10E5106B57DE6BB932A9ADA87506BF802D39C4, 2 1 327D54350858DA03F927009E97A394B81022EA49 ----------------------------- Number of entries returned 10 4. [root@qe-blade-06 ~]# ssh cloud-qe-15.testrelm.com [root@cloud-qe-15 ~]# 5. [root@qe-blade-06 ~]# ssh 10.16.96.100 [root@cloud-qe-15 ~]# no error "looking up public keys " showed up while ssh to replica using IP address
verified
I'm seeing the same "Error looking up public keys" issues when sshing from a rhel 6.3 host which has been configured with "ipa-client-install --mkhomedir --configure-ssh --configure-sshd" to a rhel 5 host which doesn't support the ssh configuration and hence when configuring a RHEL-5 ipa client it doesn't register the ssh keys in DNS as part of the ipa client configuration process.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0508.html