mainSavannah Administration - Support: sr #109343, ssh known_hosts conflicts svn and...

 
 

sr #109343: ssh known_hosts conflicts svn and git

Submitter:  Gavin D. Smith <gavin>
Submitted:  Mon 26 Jun 2017 06:24:01 PM UTC
   
 
Category:  Source code repositories - developer access Priority:  5 - Normal
Severity:  3 - Normal Status:  Works For Me
Privacy:  Public Assigned to:  None
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 29 Jun 2017 07:11:20 AM UTC, comment #5: 

Linking to the mailing list thread for further discussion.

http://lists.gnu.org/archive/html/savannah-hackers/2017-06/msg00058.html

Bob Proulx <rwp>
Site Administrator
Wed 28 Jun 2017 03:00:30 PM UTC, comment #4: 

But CVS for web pages still uses the RSA key (?)

When I work with Git and CVS repositories, it issues warnings about different keys.

Ineiev <ineiev>
Site Administrator
Tue 27 Jun 2017 09:03:08 AM UTC, comment #3: 

Thank you, I removed all the ssh-rsa lines from my known_hosts file and it works fine now just using the ECDSA keys. The first time I ran "svn update" it added the key to the file and it runs silently each time since.

>It is fine to file tickets for these types of things but since this was more of a question and answer type of thing let me suggest emailing to the savannah-hackers-public AT gnu.org mailing list instead. It is much easier to deal with discussion like this on the mailing list rather than in a bug ticket. (I really hate editing email in a web browser. It is so much easier in a real editor.)


That is my preference too. I prefer to write a reply directly in my mail program instead of having to load a webpage and then edit the response in a text box on that webpage. (As an example of the difficulty, the first time I tried to submit this comment, I was not logged in.)

Gavin D. Smith <gavin>
Tue 27 Jun 2017 12:44:35 AM UTC, comment #2: 

Oh, and I forgot to say that each and every different name that you use has its own ssh known_hosts entry. There are dozens of potential names due to aliasing.

For example each version control service has its own name git, svn, cvs, hg, bzr, tla, and so forth.

And within each of those there are aliases.  For example git.savannah.gnu.org may be aliased to git.sv.gnu.org which is a different host name, has a unique known_hosts entry, but is the same host serving it since it is simply an alias for it.  This multiplication increases the number of potential names.

And there are both gnu.org and nongnu.org aliases.  All of the gnu.org names are aliased within nongnu.org.  And the reverse.  Therefore each of the above multiplies again and increases the number of potential names.

Lots of potential names, all for the same machine.  Which seems somewhat silly.  But in a perfect world we would have enough hardware resources to split these into dedicated hardware for each big service so that the combination of all of them at one time would not brown out the server.  Unfortunately it is an imperfect world and we are starved for resources and only have one system for everything.  Which means that even though the founders planned ahead we still have all of the eggs in one basket.

Bob Proulx <rwp>
Site Administrator
Tue 27 Jun 2017 12:36:52 AM UTC, comment #1: 

It appears your ssh client is configured to ignore an existing RSA type host key if a newer ECDSA type key is available.  That isn't the way my ssh client works.  On my system when I have an existing RSA host key in the known hosts file then that is the host key it checks against when connecting to a server with a matching key. In your case this does not appear to be happening.

In which case I suggest deleting ALL of your old host keys from your known_hosts file and fetching the new ECDSA keys.

If your ssh client is hashing the host names then this will be somewhat difficult since there isn't a way to know what keys are stored there.  You could then only delete either all of them, which loses the security of trust-on-first-use (TOFU) other previously seen hosts. Or you can remove them one at a time as they are seen. If your ssh client is not hashing host names in the known_hosts file then I suggest editing that file and deleting all of your savannah.gnu.org names including all of the possible aliases for those names.  Aliases include nongn.org and sv.gnu.org and sv.nongnu.org.

The host keys for verifying fingerprints are listed here: https://savannah.gnu.org/maintenance/SshAccess/

Background: Back in December 2016 we upgraded servers for the version control system and then started moving services one at a time from the old machine to the new machine.  The previous RSA host key was preserved verbatim.  This prevented people from seeing any host key changes across this migration.

However the new server did have a newer, stronger, ECDSA key.  If your ssh client is new enough it will prefer this key when it stores the host key in the known_hosts file in the TOFU (trust-on-first-use) policy.

However the old server key is a small 1024 bit key.  At some point we will want/need to generate a new, larger, stronger key.  Hopefully by that time most people won't care because they will have migrated naturally through to the newer, stronger ECDSA key. If we delay long enough then regenerating a longer, stronger, RSA key will not affect most people.

It is fine to file tickets for these types of things but since this was more of a question and answer type of thing let me suggest emailing to the savannah-hackers-public AT gnu.org mailing list instead.  It is much easier to deal with discussion like this on the mailing list rather than in a bug ticket.  (I really hate editing email in a web browser. It is so much easier in a real editor.)

Bob Proulx <rwp>
Site Administrator
Mon 26 Jun 2017 06:24:01 PM UTC, original submission:  

When running "git pull" on a git repository on Savannah, I got an error message

Warning: the ECDSA host key for 'git.sv.gnu.org' differs from the key for the IP address '208.118.235.201'
Offending key for IP in /home/g/.ssh/known_hosts:26
Matching host key in /home/g/.ssh/known_hosts:23

Line 26 is 208.118.235.201 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzFQovi+67xa+wymRz9u3plx0ntQnELBoNU4SCl3RkwSFZkrZsRTC0fTpOKatQNs1r/BLFoVt21oVFwIXVevGQwB+Lf0Z+5w9qwVAQNu/YUAFHBPTqBze4wYK/gSWqQOLoj7rOhZk0xtAS6USqcfKdzMdRWgeuZ550P6gSzEHfv0=

If I go and remove that key from the known_hosts file, "git pull" then prints

Warning: Permanently added the ECDSA host key for IP address '208.118.235.201' to the list of known hosts.

the first time. The line it adds to known_hosts is

208.118.235.201 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBP9c1Z2f4OHxymvLxqxQ/hY1g0ol0/iiXUrVFGZBBq4h5gD05c7Gw9rRrcrvF9XvumBvOghOQzDSZZLRWvFGocA=

On subsequent tries, it completes without error.

However, then when I try to update an SVN repository on Savannah with "svn update" I get an warning:

$ svn update
Updating '.':
Warning: the RSA host key for 'svn.savannah.gnu.org' differs from the key for the IP address '208.118.235.201'
Offending key for IP in /home/g/.ssh/known_hosts:26
Matching host key in /home/g/.ssh/known_hosts:4
Are you sure you want to continue connecting (yes/no)?

It's complaining about the line that was just added by "git pull". It does this every time svn runs.

How can I set it up so that both "svn update" and "git pull" work correctly, without printing a warning or prompting for confirmation?

Gavin D. Smith <gavin>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by gavin (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-10-16 ineiev StatusNone Works For Me
        Open/ClosedOpen Closed
    2017-06-28 ineiev Open/ClosedClosed Open
    2017-06-27 rwp Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code