On Fri, Jan 08, 2021 at 03:29:01PM +0100, Petr Pisar wrote:
On Fri, Jan 08, 2021 at 05:03:34AM -0700, Brad Bell wrote:
> 1. Does this mean that 38.145.60.17 is the correct host address and I do not
> have to worry adding it to ~/.ssh/known_hosts ?
>
Yes.
Yep. Thats the correct ip.
> 2. If I add the contents of
>
https://admin.fedoraproject.org/ssh_known_hosts
> starting with a new line and at the end of my ~/.ssh/known_hosts and try 'fedpkg
push` I get:
>
> cppad>fedpkg push
> check_host_cert: certificate signature algorithm ssh-rsa: signature algorithm not
supported
> The authenticity of host 'pkgs.fedoraproject.org (38.145.60.17)' can't
be established.
> RSA key fingerprint is SHA256:Q12OTyTeOHWlS54dTzy2BNu7wB8UKNf18+7WHIDsORc.
> Are you sure you want to continue connecting (yes/no/[fingerprint])?
>
It seems the certificate is signed with ssh-rsa SSH alghoritm which uses SHA-1
underneath and
> 3. If I execute `dnf info openssh' I get
>
> Name : openssh
> Version : 8.4p1
> Release : 4.fc33
>
which is not supported by openssh-8.4p1 and Fedora 33 system-wide
cryptopolicy.
I believe Fedora infrastrucure maintainers should create a new certificate
with SHA-2 instead of SHA-1.
Well, it's sadly a bit more complex, but yes, I can resign the existing
rsa host key with sha-2.
We want to at some point:
* move the last few hosts using rsa host keys to ed25519 (all but pkgs
and bastion host are already moved), but we are waiting for openssh to
implement a host key migration step so it will be transparent to users.
* drop ssh commits entirely sometime and move to https / token.
pkgs didn't get signed with the new sha-2 key because we didn't move it
to the new ed25519 host key. I'll try and fix it later today.
kevin