cant login with ltsp after update of openssh/openssl

[Lance Russell]

The recent update to correct the OpenSSL/OpenSSH/OpenVPN vulnerability rebuilds the server keys. However, if EdUbuntu is installed, the keys should be copied over to the chroot. The chroot image must then be updated.

See https://wiki.edubuntu.org/DebugThinClientLogin for the steps that must be taken.

This occurs with 8.04 but most likely affects all versions. 7.10 and up require the image update.

[Stéphane Graber (stgraber)]

It's the normal behavior after the openssh update, I don't think there was an easy way to trigger an ltsp-update-sshkeys + ltsp-update-image from the openssh upgrade process.

Instructions on how to update the ssh keys in the chroot have been posted to the edubuntu-users mailing-list : https://lists.ubuntu.com/archives/edubuntu-users/2008-May/004052.html

[Oliver Grawert (ogra)]

this is expected beahvior and not a bug, i agree that the info in here is essential though and the bug should be converted to a question

[Florian Hars (hars)]

There is at least a wishlist bug hiding in there, in so far as ldm should give a meaningful error message if there are host key problems, instead of hanging indefinitely and lying to the user about what it does.

[Oliver Grawert (ogra)]

ldm usually says "This workstation is not authorized to connect to server" on key problems, if that was not the case for you it is indeed a bug, can you confirm the message was not shown ?

[Florian Hars (hars)]

It was definitely hanging in "Trying to verify password..."

[Daniel Barlow (dan-telent)]

It would be a help if the message on openssh upgrade warned, for example, that "some clients (e.g. openssh and LTSP) will warn or fail to connect after this upgrade, until their cached host keys are updated or removed"

This would be a whole lot more useful as a heads-up than the "if you don't understand this message you can ignore it" line presently used.

[Scott Balneaves (sbalneav)]

I think this one can simply be handled with a documentation update. I'll see about adding it to the docs package.

[Stéphane Graber (stgraber)]

ltsp-update-sshkeys is now in the documentation.