381721 – add support for ecdsa ssh keys to access dev machines

Bug 381721 - add support for ecdsa ssh keys to access dev machines

Summary: add support for ecdsa ssh keys to access dev machines

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Infrastructure
Classification:	Unclassified
Component:	Dev box issues (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Infrastructure

URL:
Whiteboard:
Keywords:

Depends on:	396075
Blocks:
	Show dependency tree

Reported:	2011-09-03 23:23 UTC by Tim Harder
Modified:	2012-02-09 21:56 UTC (History)
CC List:	0 users

See Also:	https://bugzilla.mindrot.org/show_bug.cgi?id=1858 https://bugzilla.mindrot.org/show_bug.cgi?id=1912
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Tim Harder gentoo-dev

2011-09-03 23:23:03 UTC

It would be great if devs could use ecdsa keys to access the various machines already available via rsa/dsa keys.

Comment 1 Robin Johnson archtester

2011-09-04 01:07:29 UTC

After this upstream bug is resolved by the release of OpenSSH 5.9, then yes:
https://bugzilla.mindrot.org/show_bug.cgi?id=1912
https://bugzilla.mindrot.org/show_bug.cgi?id=1858

Comment 2 Jeremy Olexa (darkside) (RETIRED) archtester

2012-01-30 17:14:08 UTC

-LDAP accepts ecdsa, ssh works with ecdsa on LDAP hosts.
-Non infra folk have successfully used ecdsa for cvs (just cvs up, cvs ci not tested yet).
-Infra folk have successfully used ecdsa for cvs (just cvs up, cvs ci not tested yet).
-ecdsa does not work for gitolite on flycatcher or pelican (ssh darkside@ works, ssh git@ fails)

11:12 <@idl0r> darkside_: hm, ok.. the module we use for gitolite-gentoo does 
               *not* support ecdsa atm

* All infra machines need to enable the ecdsa host key
* Need to figure out the gitolite issue

Comment 3 Jeremy Olexa (darkside) (RETIRED) archtester

2012-02-01 21:32:58 UTC

(In reply to comment #2)
> -LDAP accepts ecdsa, ssh works with ecdsa on LDAP hosts.
> -Non infra folk have successfully used ecdsa for cvs (just cvs up, cvs ci not
> tested yet).
> -Infra folk have successfully used ecdsa for cvs (just cvs up, cvs ci not
> tested yet).
> -ecdsa does not work for gitolite on flycatcher or pelican (ssh darkside@
> works, ssh git@ fails)
> 
> 11:12 <@idl0r> darkside_: hm, ok.. the module we use for gitolite-gentoo does 
>                *not* support ecdsa atm
> 
> * All infra machines need to enable the ecdsa host key
> * Need to figure out the gitolite issue

Everything works now. Christian fixed gitlite and I enabled ECDSA on infra machines since the issues in Comment #1 don't apply to *us*
1912 is a ssh client issue (ssh-keysign)
1858 is a HostKeyAuth issue (default off, we don't use)

I guess this bug can be closed, if no one else disagrees?

Comment 4 Jeremy Olexa (darkside) (RETIRED) archtester

2012-02-09 21:56:12 UTC

(In reply to comment #3)

> I guess this bug can be closed, if no one else disagrees?

No additional comments