Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 437480 - install-amd64-minimal-20120917 sshd fails to start: ssh-keygen: undefined symbol: EC_KEY_new_by_curve_name
Summary: install-amd64-minimal-20120917 sshd fails to start: ssh-keygen: undefined sym...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Release Media
Classification: Unclassified
Component: InstallCD (show other bugs)
Hardware: All Linux
: Normal normal with 3 votes (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
: 444454 (view as bug list)
Depends on:
Blocks:
 
Reported: 2012-10-07 04:08 UTC by Ben Kohler
Modified: 2012-12-27 21:22 UTC (History)
10 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ben Kohler gentoo-dev 2012-10-07 04:08:54 UTC
Upon trying to start the sshd service on the newest amd64 installcd, it throws this error: 

 * Generating ecdsa host key ...
Generating public/private key pair.
ssh-keygen: symbol lookup error: ssh-keygen: undefined symbol: EC_KEY_new_curve_by_name
 * ERROR: sshd failed to start

It seems that the installcd's net-misc/openssh was built against dev-libs/openssl[-bindist], so ecdsa support was left enabled in the sshd init script.  But the final installcd ships with dev-libs/openssl[bindist] which strips out ecdsa support, causing the sshd init script to fail.
Comment 1 Jorge Manuel B. S. Vicetto Gentoo Infrastructure gentoo-dev 2012-10-07 04:21:17 UTC
@base-system:

Perhaps the best way to fix this is to add a bindist use flag to openssh and make sure we have a dev-libs/openssl[bindist?] dependency.
Comment 2 Diego Elio Pettenò (RETIRED) gentoo-dev 2012-10-07 04:57:51 UTC
Given that there isn't a decent way to turn off ECC in OpenSSH when building against an ECC capable OpenSSL, I'd vote for [bindist=] instead.
Comment 3 Ben Kohler gentoo-dev 2012-10-15 00:12:55 UTC
In case someone's stuck and MUST install via one of these livecd's & sshd, these commands can work around the issue:

# sed -i -e "s/ && gen_key ecdsa//" /etc/init.d/sshd
# sed -i -e "/_rsa/s/^#//" -e "/_dsa/s/^#//" /etc/ssh/sshd_config
# /etc/init.d/ssh restart


Works here, anyway.
Comment 4 Bartosz M. Kojak 2012-10-18 10:48:43 UTC
(In reply to comment #3)
> In case someone's stuck and MUST install via one of these livecd's & sshd,
> these commands can work around the issue:
> 
> # sed -i -e "s/ && gen_key ecdsa//" /etc/init.d/sshd
> # sed -i -e "/_rsa/s/^#//" -e "/_dsa/s/^#//" /etc/ssh/sshd_config
> # /etc/init.d/ssh restart
> 
> 
> Works here, anyway.

SSHD starts but without possibility to handle incoming connections.
Comment 5 gentoo.bugs.all.over 2012-10-24 12:46:04 UTC
This is still a problem with the current amd64 minimal install iso.
Comment 6 Rick Farina (Zero_Chaos) gentoo-dev 2012-11-05 04:41:26 UTC
(In reply to comment #2)
> Given that there isn't a decent way to turn off ECC in OpenSSH when building
> against an ECC capable OpenSSL, I'd vote for [bindist=] instead.

I am going to implement this change in time for the 20111105 snapshot unless I get a huge complaint. This has been open with a known simple solution for far too long.
Comment 7 Rick Farina (Zero_Chaos) gentoo-dev 2012-11-05 04:46:54 UTC
(In reply to comment #6)
> (In reply to comment #2)
> > Given that there isn't a decent way to turn off ECC in OpenSSH when building
> > against an ECC capable OpenSSL, I'd vote for [bindist=] instead.
> 
> I am going to implement this change in time for the 20111105 snapshot unless
> I get a huge complaint. This has been open with a known simple solution for
> far too long.

Sorry, I obviously mean 20121105
Comment 8 Rick Farina (Zero_Chaos) gentoo-dev 2012-11-06 01:39:34 UTC
as promised, I changed all of the openssh ebuilds in the manner suggested by Diego:

-IUSE="${HPN_PATCH:++}hpn kerberos ldap libedit pam selinux skey static tcpd X X509"
+IUSE="bindist ${HPN_PATCH:++}hpn kerberos ldap libedit pam selinux skey static tcpd X X509"

-	>=dev-libs/openssl-0.9.6d
+	>=dev-libs/openssl-0.9.6d[bindist=]

I tested this method and found it to be reasonably solid for this bug fix, and safe enough to not harm the tree, however, floppym had to go and point out this isn't a perfect solution.

If, in some insane world, the user has openssl:0.9.8[bindist] and openssl:0[-bindist], and tries to install openssh[bindist], portage will have it's dependancy satisfied by openssl:0.9.8[bindist] but will be linked against openssl:0.

What we need to do is edit the openssh ebuilds to use best_version openssl[bindist=] when linking to openssl.

I'll leave this bug open until that is done.  I currently lack the skill but if no one steps up I'll try to figure it out.
Comment 9 Mike Gilbert gentoo-dev 2012-11-06 02:46:44 UTC
I tweaked that last change with a slot dep since openssl:0.9.8 does not provide headers or .so symlinks.
Comment 10 Rick Farina (Zero_Chaos) gentoo-dev 2012-11-06 02:49:45 UTC
This fixes the issues generating livecd's and stages for the long term I hope.  In addition the logic should prevent the users from breaking themselves.  Closing this bug as fixed. Thanks all.
Comment 11 Ben Kohler gentoo-dev 2012-11-08 21:06:04 UTC
This is not fixed yet, install-amd64-minimal-20121107.iso is still shipping an old openssh ebuild revision:

# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-5.9_p1-r4.ebuild,v 1.10 2012/06/02 18:07:02 vapier Exp $
Comment 12 SpanKY gentoo-dev 2012-11-09 03:54:17 UTC
the fixes will make their way out
Comment 13 Jorge Manuel B. S. Vicetto Gentoo Infrastructure gentoo-dev 2012-11-09 12:10:08 UTC
(In reply to comment #11)
> This is not fixed yet, install-amd64-minimal-20121107.iso is still shipping
> an old openssh ebuild revision:
> 
> # $Header:
> /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-5.9_p1-r4.ebuild,v 1.10
> 2012/06/02 18:07:02 vapier Exp $

This was a releng (mine) issue and not a base-system issue.
I'm running a new build that should have this fixed. I hope to have it in the mirrors later today.
Comment 14 Massimo Burcheri 2012-11-27 13:25:43 UTC
*** Bug 444454 has been marked as a duplicate of this bug. ***