Fix SSH host key generation on CentOS 7
What does this MR do?
The version of ssh-keygen shipped with CentOS 7 does not support
the ability to save SSH host keys to an alternate path using the -f
option with the -A
option. Keys will always save to /etc/ssh
.
To fix this, manually call ssh-keygen for each key that we want to
generate. On FIPS systems, it's not guaranteed that ed25519 or other
keys can be generated, so we skip over any failures in ssh-keygen
and only check at the end to see if any keys were successfully
generated.
Note that the host key generation is only performed if no host keys were detected in the directory in the first place.
Related issues
Closes #7671 (closed)
Testing
On a FIPS system, gitlab-ctl reconfigure
succeeded even though ed25519
could not be created:
* bash[generate gitlab-sshd host keys] action run
[execute] Generating /var/opt/gitlab/gitlab-sshd/ssh_host_rsa_key...
Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ecdsa_key...
Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ed25519_key...
ED25519 keys are not allowed in FIPS mode
If ssh-keygen
is not available, gitlab-ctl reconfigure
will fail:
STDOUT: Generating /var/opt/gitlab/gitlab-sshd/ssh_host_rsa_key...
Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ecdsa_key...
Generating /var/opt/gitlab/gitlab-sshd/ssh_host_ed25519_key...
Failed to generate any keys, aborting.
STDERR: bash: line 9: ssh-keygen: command not found
bash: line 9: ssh-keygen: command not found
bash: line 9: ssh-keygen: command not found
---- End output of "bash" ----
Checklist
See Definition of done.
For anything in this list which will not be completed, please provide a reason in the MR discussion
Required
-
Merge Request Title, and Description are up to date, accurate, and descriptive -
MR targeting the appropriate branch -
MR has a green pipeline on GitLab.com -
Pipeline is green on dev.gitlab.org if the change is touching anything besides documentation or internal cookbooks -
trigger-package
has a green pipeline running against latest commit
Expected (please provide an explanation if not completing)
-
Test plan indicating conditions for success has been posted and passes -
Documentation created/updated -
Tests added -
Integration tests added to GitLab QA -
Equivalent MR/issue for the GitLab Chart opened