On 08/06/19 at 05:15pm, lijiang wrote:
在 2019年08月06日 13:16, Dave Young 写道:
> On 08/06/19 at 12:25pm, lijiang wrote:
>> 在 2019年08月06日 12:01, Dave Young 写道:
>>> On 08/06/19 at 11:37am, lijiang wrote:
>>>> 在 2019年08月06日 11:01, Dave Young 写道:
>>>>> On 08/05/19 at 08:56pm, Lianbo Jiang wrote:
>>>>>> When using the ssh kdump, the ssh client will use the '-o
StrictHostKeyChecking=yes'
>>>>>> option to connect the kdump server. To ensure the dump file is
going to be sent to
>>>>>> a true kdump server as opposed to any fake one, the ssh client
needs to authenticate
>>>>>> the server as well. A known_hosts file with server hostkey can
be provisioned on the
>>>>>> client side in advance to facilitate the authentication(which is
added by ssh-client
>>>>>> module in mkdumprd).
>>>>>>
>>>>>> Add a configuration in '/etc/kdump.conf' to specify the
location of the known_hosts
>>>>>> file to be used in the 'ssh -o UserKnownHostsFile'
option.
>>>>>
>>>>> When add a new option, we need carefully check if this is really
>>>>> necessary. In this case, this is only useful for the case one want
to
>>>>> use ssh -o UserKnownHostsFile, but why this is necessiry, why we
can
>>>>> not use the global Knownhosts?
>>>>>
>>>>
>>>> In general, the root user will make a kdump operation, so i used the
/root/.ssh/known_hosts
>>>> as default, but, if need, the user can still specify this option in
/etc/kdump.conf.
>>>
>>> I'm not objecting to allow UserKnownHostsFile, but I want to double
>>> check if we should use another new kdump config option.
>>>
>>> You can check the dracut ssh-client module, if one setup ssh_config
>>> correctly I assume ssh will use the knownhost file automatically, if not
>>> maybe we should fix the dracut module.
>>>
>>
>> The knowhost file will be installed by the 95ssh-client module and also copy the
ssh_config
>> to the kdump initramfs, which is implemented in dracut tool.
>>
>> The mkdumprd will use the option sshkey to achieve this purpose.
>
> You mean ssh option only enable to use user knownhosts or not, but
> suppose it can be added in ssh_config then we do not need add the
> filename in kdump.conf to duplicate the functionality. Or if one add a
> separate file in kdump.conf which is not added in ssh_config then kdump
> need to install the file in initramfs.
>
The 95ssh-client module will install the ssh_config and known_hosts to the kdump
initramfs, please refer to it:
...
# Copy over ssh key and knowhosts if needed
[[ $sshkey ]] && {
inst_simple $sshkey
[[ -f /root/.ssh/known_hosts ]] && inst_simple /root/.ssh/known_hosts
[[ -f /etc/ssh/ssh_known_hosts ]] && inst_simple
/etc/ssh/ssh_known_hosts
}
# Copy over root and system-wide ssh configs.
[[ -f /root/.ssh/config ]] && inst_simple /root/.ssh/config
if [[ -f /etc/ssh/ssh_config ]]; then
inst_simple /etc/ssh/ssh_config
sed -i -e 's/\(^[[:space:]]*\)ProxyCommand/\1# ProxyCommand/'
${initdir}/etc/ssh/ssh_config
while read key val || [ -n "$key" ]; do
if [[ $key == "GlobalKnownHostsFile" ]]; then
inst_simple "$val"
# Copy customized UserKnowHostsFile
elif [[ $key == "UserKnownHostsFile" ]]; then
# Make sure that ~/foo will be copied as /root/foo in kdump's
initramfs
if str_starts "$val" "~/"; then
val="/root/${val#"~/"}"
fi
inst_simple "$val"
fi
done < /etc/ssh/ssh_config
fi
...
> I assume if one add it in ssh_config then ssh can use it automatically
> without other changes, can you check if this is true?
>
I just checked it. That's true.
# man 5 ssh_config
......
CheckHostIP
If set to yes (the default), ssh(1) will additionally check the host IP
address in the known_hosts file. This allows
it to detect if a host key changed due to DNS spoofing and will add
addresses of destination hosts to
~/.ssh/known_hosts in the process, regardless of the setting of
StrictHostKeyChecking. If the option is set to no, the
check will not be executed.
......
[root@ibm-p8-garrison-04 jlb]# grep "CheckHostIP" /etc/ssh/ssh_config
# CheckHostIP yes
# CheckHostIP no
It seems that the CheckHostIP is set by default, so it should automatically check the
known_hosts based on the above description.
I think that it does not need this changes. What's your opinion? Jun Wang, Dave and
other reviewer?
Probably i should close this bug.
Ok, then please close it as it can be done in ssh config.
Thanks!