Skip to content

Fix SSH host key generation on CentOS 7

Stan Hu requested to merge sh-fix-issue-7671 into master

What does this MR do?

The version of ssh-keygen shipped with CentOS 7 does not support the ability to save SSH host keys to an alternate path using the -f option with the -A option. Keys will always save to /etc/ssh.

To fix this, manually call ssh-keygen for each key that we want to generate. On FIPS systems, it's not guaranteed that ed25519 or other keys can be generated, so we skip over any failures in ssh-keygen and only check at the end to see if any keys were successfully generated.

Note that the host key generation is only performed if no host keys were detected in the directory in the first place.

Related issues

Closes #7671 (closed)

Testing

On a FIPS system, gitlab-ctl reconfigure succeeded even though ed25519 could not be created:

  * bash[generate gitlab-sshd host keys] action run
    [execute] Generating /var/opt/gitlab/gitlab-sshd/ssh_host_rsa_key...
              Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ecdsa_key...
              Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ed25519_key...
              ED25519 keys are not allowed in FIPS mode

If ssh-keygen is not available, gitlab-ctl reconfigure will fail:

STDOUT: Generating /var/opt/gitlab/gitlab-sshd/ssh_host_rsa_key...
Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ecdsa_key...
Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ed25519_key...
Failed to generate any keys, aborting.
STDERR: bash: line 9: ssh-keygen: command not found
bash: line 9: ssh-keygen: command not found
bash: line 9: ssh-keygen: command not found
---- End output of "bash"  ----

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion

Required

  • Merge Request Title, and Description are up to date, accurate, and descriptive
  • MR targeting the appropriate branch
  • MR has a green pipeline on GitLab.com
  • Pipeline is green on dev.gitlab.org if the change is touching anything besides documentation or internal cookbooks
  • trigger-package has a green pipeline running against latest commit

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes
  • Documentation created/updated
  • Tests added
  • Integration tests added to GitLab QA
  • Equivalent MR/issue for the GitLab Chart opened
Edited by Stan Hu

Merge request reports