There're offending keys for IP with both root and nova user

Bug #1877495 reported by Celia Wang
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Nova Compute Charm
Triaged
Medium
Unassigned

Bug Description

If a host is redeployed, the host IP maybe changed. We're currently using %s in the live_migration_uri, which means the hostname. That will lead to offending keys exists.
This happens on both root user (/root/.ssh/known_hosts) and nova user (/var/lib/nova/.ssh/known_hosts).

e.g.:
nova@vcd41026:~$ ssh nova@vcd41028
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for vcd41028 has changed,
and the key for the corresponding IP address 10.246.65.107
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /var/lib/nova/.ssh/known_hosts:61
  remove with:
  ssh-keygen -f "/var/lib/nova/.ssh/known_hosts" -R "10.246.65.107"
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:1TJgmZGGgL3cqaeOA/RSqNGI1gGD4u2hl5b8Y3flhuU.
Please contact your system administrator.
Add correct host key in /var/lib/nova/.ssh/known_hosts to get rid of this message.
Offending RSA key in /var/lib/nova/.ssh/known_hosts:57
  remove with:
  ssh-keygen -f "/var/lib/nova/.ssh/known_hosts" -R "vcd41028"
RSA host key for vcd41028 has changed and you have requested strict checking.
Host key verification failed.

Changed in charm-nova-compute:
importance: Undecided → Medium
status: New → Triaged
Revision history for this message
Xav Paice (xavpaice) wrote :

Managed to workaround this by removing the offending host keys manually, then running the clear-unit-knownhost-cache action in nova-cloud-controller.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.