1291619 - Restore hg access for Zibi Braniecki

Status: RESOLVED WORKSFORME

(Infrastructure & Operations :: MOC: Service Requests, task)

Description

[Zibi Braniecki [:zbraniecki][:gandalf]]

I would like to be able to push to try.  My LDAP is [e-mail]

Comment 1

[Vinh Hua [:vinh]]

Your hg bit shows enabled.  Can you give it a try?

Comment 2

[Zibi Braniecki [:zbraniecki][:gandalf]]

zbraniecki@cintra:~/projects/mozilla/mozilla-central$ ssh hg.mozilla.org
Permission denied (publickey).

I have two keys - ID_DSA and ED_25519.

Last time I checked the ED25519 was not supported by Mozilla so on login.mozilla.com I have my ID_DSA key uploaded. I authenticated the key and yet ssh to hg.mozilla.org rejects it.

That's the chunk of my ~/.ssh/config:

Host hg.mozilla.org
	User [e-mail]
	Compression yes
	IdentityFile ~/.ssh/id_dsa
	ServerAliveInterval 300
	TCPKeepAlive yes
	IdentitiesOnly yes

Not sure what else can I do.

Comment 3

[Vinh Hua [:vinh]]

I only see your ssh-dss keys attached.  Can you reattach your DSA/RSA keys?

Comment 4

[Zibi Braniecki [:zbraniecki][:gandalf]]

I do not have a dss key. In my original bug with account request I attached DSA. Is it worth investigating by security?

Also, is there an option to go for ed25591? Trying to get rid of DSA.

Comment 5

[Vinh Hua [:vinh]]

I don't think ed25591 is supported at the moment.  Best is to generate RSA key.

Comment 6

[Zibi Braniecki [:zbraniecki][:gandalf]]

Attachment: id_dsa.pub

Comment 7

[Vinh Hua [:vinh]]

The keys in c#6 is what's already in LDAP.  

:pir - can I get your feedback on what's missing here?

Comment 8

[Peter Radcliffe [:pir]]

DSA keys are no longer supported, they are not secure. Should remove all DSA keys, generate an *RSA* key as was suggested in comment 5 and upload it via login.mozilla.com.

Comment 9

[Vinh Hua [:vinh]]

zibi - any luck?

Comment 10

[Vinh Hua [:vinh]]

Haven't heard back, please re-open bug for further assistance.

Comment 11

[Zibi Braniecki [:zbraniecki][:gandalf]]

Hi Vinh, sorry for the delay, I was not able to test the suggested solution over last week.

I managed to do this today and it seems to work, thank you!

One question - based on my very naive reading, it seems that ECDSA is recommended over RSA by most sources I could find. What is the reason Mozilla decided not to support it?

Comment 12

[Peter Radcliffe [:pir]]

Not all Mozilla infrastructure is running new enough versions of openssh to allow ECDSA to work everywhere. Until all parts are upgraded the situation of ECDSA keys working in some places and not others would produce a significant support issue.