On 08/06/19 at 12:25pm, lijiang wrote:
在 2019年08月06日 12:01, Dave Young 写道:
> On 08/06/19 at 11:37am, lijiang wrote:
>> 在 2019年08月06日 11:01, Dave Young 写道:
>>> On 08/05/19 at 08:56pm, Lianbo Jiang wrote:
>>>> When using the ssh kdump, the ssh client will use the '-o
StrictHostKeyChecking=yes'
>>>> option to connect the kdump server. To ensure the dump file is going to
be sent to
>>>> a true kdump server as opposed to any fake one, the ssh client needs to
authenticate
>>>> the server as well. A known_hosts file with server hostkey can be
provisioned on the
>>>> client side in advance to facilitate the authentication(which is added
by ssh-client
>>>> module in mkdumprd).
>>>>
>>>> Add a configuration in '/etc/kdump.conf' to specify the location
of the known_hosts
>>>> file to be used in the 'ssh -o UserKnownHostsFile' option.
>>>
>>> When add a new option, we need carefully check if this is really
>>> necessary. In this case, this is only useful for the case one want to
>>> use ssh -o UserKnownHostsFile, but why this is necessiry, why we can
>>> not use the global Knownhosts?
>>>
>>
>> In general, the root user will make a kdump operation, so i used the
/root/.ssh/known_hosts
>> as default, but, if need, the user can still specify this option in
/etc/kdump.conf.
>
> I'm not objecting to allow UserKnownHostsFile, but I want to double
> check if we should use another new kdump config option.
>
> You can check the dracut ssh-client module, if one setup ssh_config
> correctly I assume ssh will use the knownhost file automatically, if not
> maybe we should fix the dracut module.
>
The knowhost file will be installed by the 95ssh-client module and also copy the
ssh_config
to the kdump initramfs, which is implemented in dracut tool.
The mkdumprd will use the option sshkey to achieve this purpose.
You mean ssh option only enable to use user knownhosts or not, but
suppose it can be added in ssh_config then we do not need add the
filename in kdump.conf to duplicate the functionality. Or if one add a
separate file in kdump.conf which is not added in ssh_config then kdump
need to install the file in initramfs.
I assume if one add it in ssh_config then ssh can use it automatically
without other changes, can you check if this is true?
I would expect it can be solved in 99ssh-client without touching kdump
code..
>
> >>
> >> Thanks.
> >>
> >>>>
> >>>> Suggested-by: Jun Wang <junw99(a)yahoo.com>
> >>>> Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com>
> >>>> ---
> >>>> dracut-kdump.sh | 4 ++--
> >>>> kdump-lib-initramfs.sh | 6 ++++++
> >>>> kdump.conf | 4 ++++
> >>>> kdumpctl | 12 ++++++++++--
> >>>> mkdumprd | 11 +++++++++--
> >>>> 5 files changed, 31 insertions(+), 6 deletions(-)
> >>>>
> >>>> diff --git a/dracut-kdump.sh b/dracut-kdump.sh
> >>>> index ce56459ed088..0eafe6458530 100755
> >>>> --- a/dracut-kdump.sh
> >>>> +++ b/dracut-kdump.sh
> >>>> @@ -71,7 +71,7 @@ dump_raw()
> >>>>
> >>>> dump_ssh()
> >>>> {
> >>>> - local _opt="-i $1 -o BatchMode=yes -o
StrictHostKeyChecking=yes"
> >>>> + local _opt="-i $1 -o BatchMode=yes -o
StrictHostKeyChecking=yes -i $3 -o UserKnownHostsFile"
> >>>> local _dir="$KDUMP_PATH/$HOST_IP-$DATEDIR"
> >>>> local _host=$2
> >>>>
> >>>> @@ -156,7 +156,7 @@ read_kdump_conf()
> >>>> add_dump_code "dump_raw $config_val"
> >>>> ;;
> >>>> ssh)
> >>>> - add_dump_code "dump_ssh $SSH_KEY_LOCATION
$config_val"
> >>>> + add_dump_code "dump_ssh $SSH_KEY_LOCATION
$config_val $SSH_KNOWN_HOSTS"
> >>>> ;;
> >>>> esac
> >>>> done <<< "$(read_strip_comments
$KDUMP_CONF)"
> >>>> diff --git a/kdump-lib-initramfs.sh b/kdump-lib-initramfs.sh
> >>>> index 608dc6efc07e..7d595d5b7d06 100755
> >>>> --- a/kdump-lib-initramfs.sh
> >>>> +++ b/kdump-lib-initramfs.sh
> >>>> @@ -11,6 +11,7 @@ DATEDIR=`date +%Y-%m-%d-%T`
> >>>> HOST_IP='127.0.0.1'
> >>>> DUMP_INSTRUCTION=""
> >>>> SSH_KEY_LOCATION="/root/.ssh/kdump_id_rsa"
> >>>> +SSH_KNOWN_HOSTS="/root/.ssh/known_hosts"
> >>>> KDUMP_SCRIPT_DIR="/kdumpscripts"
> >>>> DD_BLKSIZE=512
> >>>> FINAL_ACTION="systemctl reboot -f"
> >>>> @@ -38,6 +39,11 @@ get_kdump_confs()
> >>>> SSH_KEY_LOCATION=$config_val
> >>>> fi
> >>>> ;;
> >>>> + known_hosts)
> >>>> + if [ -f "$config_val" ];then
> >>>> + SSH_KNOWN_HOSTS="$config_val"
> >>>> + fi
> >>>> + ;;
> >>>> kdump_pre)
> >>>> KDUMP_PRE="$config_val"
> >>>> ;;
> >>>> diff --git a/kdump.conf b/kdump.conf
> >>>> index 1f0fc2ddc40b..2b10d57ac561 100644
> >>>> --- a/kdump.conf
> >>>> +++ b/kdump.conf
> >>>> @@ -152,6 +152,9 @@
> >>>> # to send fence_kdump notifications to.
> >>>> # (this option is mandatory to enable fence_kdump).
> >>>> #
> >>>> +# known_hosts <path>
> >>>> +# - The "path" represents the path of
know_hosts, the default value
> >>>> +# is /root/.ssh/known_hosts.
> >>>>
> >>>> #raw /dev/vg/lv_kdump
> >>>> #ext4 /dev/vg/lv_kdump
> >>>> @@ -173,3 +176,4 @@ core_collector makedumpfile -l --message-level 1
-d 31
> >>>> #dracut_args --omit-drivers "cfg80211 snd" --add-drivers
"ext2 ext3"
> >>>> #fence_kdump_args -p 7410 -f auto -c 0 -i 10
> >>>> #fence_kdump_nodes node1 node2
> >>>> +#known_hosts /root/.ssh/known_hosts
> >>>> diff --git a/kdumpctl b/kdumpctl
> >>>> index a1a6ee24b768..7ba7e8cf2685 100755
> >>>> --- a/kdumpctl
> >>>> +++ b/kdumpctl
> >>>> @@ -9,6 +9,7 @@ MKDUMPRD="/sbin/mkdumprd -f"
> >>>> DRACUT_MODULES_FILE="/usr/lib/dracut/modules.txt"
> >>>> SAVE_PATH=/var/crash
> >>>> SSH_KEY_LOCATION="/root/.ssh/kdump_id_rsa"
> >>>> +SSH_KNOWN_HOSTS="/root/.ssh/known_hosts"
> >>>> INITRD_CHECKSUM_LOCATION="/boot/.fadump_initrd_checksum"
> >>>> DUMP_TARGET=""
> >>>> DEFAULT_INITRD=""
> >>>> @@ -243,7 +244,7 @@ check_config()
> >>>> case "$config_opt" in
> >>>> \#* | "")
> >>>> ;;
> >>>>
- raw|ext2|ext3|ext4|minix|btrfs|xfs|nfs|ssh|sshkey|path|core_collector|kdump_post|kdump_pre|extra_bins|extra_modules|failure_action|default|final_action|force_rebuild|force_no_rebuild|dracut_args|fence_kdump_args|fence_kdump_nodes)
> >>>>
+ raw|ext2|ext3|ext4|minix|btrfs|xfs|nfs|ssh|sshkey|known_hosts|path|core_collector|kdump_post|kdump_pre|extra_bins|extra_modules|failure_action|default|final_action|force_rebuild|force_no_rebuild|dracut_args|fence_kdump_args|fence_kdump_nodes)
> >>>> # remove inline comments after the end of a directive.
> >>>> [ -z "$config_val" ] && {
> >>>> echo "Invalid kdump config value for option
$config_opt."
> >>>> @@ -711,6 +712,13 @@ check_ssh_config()
> >>>> echo "WARNING: '$config_val' doesn't exist,
using default value '$SSH_KEY_LOCATION'"
> >>>> fi
> >>>> ;;
> >>>> + known_hosts)
> >>>> + if [ -f "$config_val" ];then
> >>>> + SSH_KNOWN_HOSTS=$(/usr/bin/readlink -m $config_val)
> >>>> + else
> >>>> + echo "WARNING: '$config_val' doesn't exist,
using default value '$SSH_KNOWN_HOSTS'"
> >>>> + fi
> >>>> + ;;
> >>>> path)
> >>>> SAVE_PATH=$config_val
> >>>> ;;
> >>>> @@ -733,7 +741,7 @@ check_ssh_config()
> >>>> check_ssh_target()
> >>>> {
> >>>> local _ret
> >>>> - ssh -q -i $SSH_KEY_LOCATION -o BatchMode=yes $DUMP_TARGET mkdir -p
$SAVE_PATH
> >>>> + ssh -q -i $SSH_KEY_LOCATION -i $SSH_KNOWN_HOSTS -o BatchMode=yes
$DUMP_TARGET mkdir -p $SAVE_PATH
> >>>> _ret=$?
> >>>> if [ $_ret -ne 0 ]; then
> >>>> echo "Could not create $DUMP_TARGET:$SAVE_PATH, you probably
need to run \"kdumpctl propagate\"" >&2
> >>>> diff --git a/mkdumprd b/mkdumprd
> >>>> index cf3533fe2be9..c4e2f8ba4c31 100644
> >>>> --- a/mkdumprd
> >>>> +++ b/mkdumprd
> >>>> @@ -13,6 +13,7 @@ export IN_KDUMP=1
> >>>>
> >>>> conf_file="/etc/kdump.conf"
> >>>> SSH_KEY_LOCATION="/root/.ssh/kdump_id_rsa"
> >>>> +SSH_KNOWN_HOSTS="/root/.ssh/known_hosts"
> >>>> SAVE_PATH=$(awk '/^path/ {print $2}' $conf_file)
> >>>> [ -z "$SAVE_PATH" ] && SAVE_PATH=$DEFAULT_PATH
> >>>> # strip the duplicated "/"
> >>>> @@ -144,7 +145,7 @@ is_readonly_mount() {
> >>>> #called from while loop and shouldn't read from stdin, so
we're using "ssh -n"
> >>>> get_ssh_size() {
> >>>> local _opt _out _size
> >>>> - _opt="-i $SSH_KEY_LOCATION -o BatchMode=yes -o
StrictHostKeyChecking=yes"
> >>>> + _opt="-i $SSH_KEY_LOCATION -o BatchMode=yes -o
StrictHostKeyChecking=yes -i $SSH_KNOWN_HOSTS -o UserKnownHostsFile"
> >>>> _out=$(ssh -q -n $_opt $1 "df -P $SAVE_PATH")
> >>>> [ $? -ne 0 ] && {
> >>>> perror_exit "checking remote ssh server available size
failed."
> >>>> @@ -162,7 +163,7 @@ get_ssh_size() {
> >>>> mkdir_save_path_ssh()
> >>>> {
> >>>> local _opt _dir
> >>>> - _opt="-i $SSH_KEY_LOCATION -o BatchMode=yes -o
StrictHostKeyChecking=yes"
> >>>> + _opt="-i $SSH_KEY_LOCATION -o BatchMode=yes -o
StrictHostKeyChecking=yes -i $SSH_KNOWN_HOSTS -o UserKnownHostsFile"
> >>>> ssh -qn $_opt $1 mkdir -p $SAVE_PATH 2>&1 >
/dev/null
> >>>> _ret=$?
> >>>> if [ $_ret -ne 0 ]; then
> >>>> @@ -385,6 +386,12 @@ if [ -f "$keyfile" ]; then
> >>>> SSH_KEY_LOCATION=$(/usr/bin/readlink -m $keyfile)
> >>>> fi
> >>>>
> >>>> +# if specified, get the known_hosts
> >>>> +known_hosts=$(awk '/^known_hosts/ {print $2}' $conf_file)
> >>>> +if [ -f "$known_hosts" ];then
> >>>> + SSH_KNOWN_HOSTS=$(/usr/bin/readlink -m $known_hosts)
> >>>> +fi
> >>>> +
> >>>> if [ "$(uname -m)" = "s390x" ]; then
> >>>> add_dracut_module "znet"
> >>>> fi
> >>>> --
> >>>> 2.17.1
> >>>>