Knowledge Base

Preserving for the future: Shell scripts, AoC, and more

Rocky Linux 9 and sss ssh knownhosts proxy

bgstack15

Comments

Enterprise Linux, even while providing /usr/bin/sss_ssh_knownhostsproxy, still suffers from the same problem I discovered in Devuan GNU+Linux.

The problem lies with how ssh client wants the public keys of the knownhosts available to it, but sssd does not seem to cache it in the way ssh client wants. While /usr/bin/sss_ssh_knownhostsproxy exists, apparently the future intended way to do things is to run sss_ssh_knownhosts. You can cajole sss_ssh_knowhostsproxy to display the right info, in this small script.

# File: /usr/local/bin/sss_stackrpms_knownhosts
for word in ${@} ;
do
   /usr/bin/sss_ssh_knownhostsproxy -k "${word}" | awk -v"w=${word}" '{print w,$0}'
done

I should have used sed for that because it would have been simpler, but I already deployed it so whatever.

sed -r -e "s:^:${word} :"

So the output resembles

$ sss_stackrpms_knownhosts server2
server2 ssh-ed25519 AAAAC3NzaC1lZDI1NEXAMPLEIAO0bzgyjqGKvQKEXAMPLEZhvjWmGE1QTpGa1gt6EB7Y root@server2
server2 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjCggwwfNNCmXIpdz/yQPMEXAMPLEv8t/NJ3hi37WmET1d/Sr/VOJI7EXAMPLE3Hvq9KugRmzyOEXAMPLE1cG5MvLGIpu7EXAMPLE1vREf9foa3WzDdo5rv4EHGtunaQnj5BvyQHViQ18IjG4f0C5GbcTEX+2ubDYU1tomAGEXAMPLEYoh7ChhBH+/dSF8TRS3uaZUjmsyyv/ojN4mJtpFZABKfUpBPOIijIApNAC4ENRzlrbj+qpb9eMQO8xJAhsyYvqWFZYudodhybpijEXAMPLEENw0y/xvKv6tXrGPjPS4ZiSUoy9vtcg99Tnjru6NqHCWVrOham6zZhm8Qp8W4DCAAhZOd0pcJ0gcf7i9l4cVX6BywlPb6NGTmLf27JY58XIlJii7x7JA+G7ioEXAMPLEGlbHrPkaiKk4n0ej7zh8xJ+3bjAtgixIZMpVd4dTgPZ8TLUr0ShcPEXAMPLEo5grAPpwdQQJkTtkWDUw/MngXQrc+gNHgHTDmEBcFTs= root@server2
server2 ecdsa-sha2-nistp256 AAAAE2VjEXAMPLEoYTItbmlzdHAyNTYAAAEXAMPLEHAyNTYAAABBBKrIRGEXAMPLEFWNdQIva/usB6zCEXAMPLEOOWDQQEW4oT94REXAMPLEZ5qfsqZ+8VN5ivhEXAMPLEQ14JYRTGM= root@server2

And then you configure ssh client to use it, by completely replacing /etc/ssh/ssh_config.d/04-ipa.conf with the following.

# IPA-related configuration changes to ssh_config
#
PubkeyAuthentication yes
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
#VerifyHostKeyDNS yes

# assumes that if a user does not have shell (/sbin/nologin),
# this will return nonzero exit code and proxy command will be ignored
Match exec true   
    #ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
    KnownHostsCommand /usr/local/bin/sss_stackrpms_knownhosts %H

I deploy using the equivalent of this in my config management (haha).

sudo install -m 0644 -o root -g root /mnt/public/Support/Platforms/Rocky/04-ipa.conf /etc/ssh/ssh_config.d/04-ipa.conf
sudo install -m 0755 -o root -g root /mnt/public/Support/Platforms/Rocky/sss_stackrpms_knownhosts /usr/local/bin/sss_stackrpms_knownhosts

Because it affects ssh client, it gets interpreted fresh for every use, so you don't need to restart any daemons or agents.

If and when EL gets binary /usr/bin/sss_ssh_knownohsts, then this script will be obsolete.

References

  1. FreeIPA on Devuan and sss ssh knownhosts proxy | Knowledge Base
  2. Issue #9536: Client configuration of ssh: Replace sss_ssh_knownhostsproxy with sss_ssh_knownhosts - freeipa - Pagure.io
  3. openssh 8.5 will support KnownHostsCommand · Issue #5518 · SSSD/sssd
  4. Not this problem: sss_ssh_knownhostsproxy prevents connection to machine without reverse address - Red Hat Customer Portal

Comments