581030 - sync ~/.ssh/config and ~/.ssh/known_hosts on build slaves

Status: RESOLVED FIXED

(Release Engineering :: General, defect, P5)

Description

[Lukas Blakk [:lsblakk] use ?needinfo]

Because of the shadow-central repo, we need:

Host hgpvt.mozilla.org
IdentityFile /home/cltbld/.ssh/ffxbld_dsa
User ffxbld

to be added (or created) in ~/.ssh/config for our build slave pool.

At the moment I have manually updated most of the linux moz2 slaves (some of them don't allow for the creation of ~/.ssh/config)

We'll need to make sure that all current and future build slaves have this.

Comment 1

[[e-mail] (:bhearsum)]

Let's find out what the correct contents of this file should be on each platform and sync the entire file with Puppet/OPSI. Appending to an existing file is asking for trouble. Ref platforms will be updated by this as well, we'll just need IT to take new images.

Comment 2

[[e-mail] (:bhearsum)]

(In reply to comment #0)
> At the moment I have manually updated most of the linux moz2 slaves (some of
> them don't allow for the creation of ~/.ssh/config)

Which slaves have been updated? Which haven't?

What do you mean by "some don't allow for the creation of ~/.ssh/config"?

Comment 3

[Lukas Blakk [:lsblakk] use ?needinfo]

Updated linux moz2 slaves (01-50) and ix (01-23) except:
    moz2-linux-slave18,19,41,42,44,45,46,47,48,49,50 had no ~/.ssh/config -- can't create one (won't write the file even though .ssh is cltbld owned)

Comment 4

[[e-mail] (:bhearsum)]

I don't think the directory is owned by cltbld:
[cltbld@moz2-linux-slave18 ~]$ ls -ld /home/cltbld/.ssh
drwxr-xr-x 2 root root 4096 Mar 27  2009 /home/cltbld/.ssh


Please update the rest of these slaves; consistency within the pool is important.

Comment 5

[Lukas Blakk [:lsblakk] use ?needinfo]

I updated the slaves mentioned in comment 3 with:

IdentityFile /home/cltbld/.ssh/id_dsa
Host cvs.mozilla.org
IdentityFile /home/cltbld/.ssh/cvs
User stgbld
Host hgpvt.mozilla.org
IdentityFile /home/cltbld/.ssh/ffxbld_dsa
User ffxbld

in /home/cltbld/.ssh/config to match the other linux slaves

Comment 6

[[e-mail] (:bhearsum)]

Attachment: sync ssh config and known_hosts for 32-bit linux

A few things of note:
* This patch will update try machines too, which currently have no ssh config and a different known_hosts. I've tested by hand on a try machine and it causes no ill effects.
* Staging will get an ~/.ssh/config that tries to use the stage-ffxbld key on hgpvt.mozilla.org. This will fail, but I suspect that we'll need to enable it. known_hosts here knows about hgpvt.mozilla.org as well.

Comment 7

[[e-mail] (:bhearsum)]

Comment on attachment 459829 [details] [diff] [review]
sync ssh config and known_hosts for 32-bit linux

changeset:   221:f08b27b060a1

production and staging puppet have been updated.

Comment 8

[[e-mail] (:bhearsum)]

Back to the pool

Comment 9

[Rail Aliiev [:rail]]

Looks like related to this bug. known_hosts file has gone from at least moz2-linux-slave03 (staging build slave). FYI.

Comment 10

[[e-mail] (:bhearsum)]

(In reply to comment #9)
> Looks like related to this bug. known_hosts file has gone from at least
> moz2-linux-slave03 (staging build slave). FYI.

Weird. When I logged on and ran "puppetd --test --server staging-puppet.build.mozilla.org --noop" it told me it was going to sync out a copy of known_hosts -- one which had staging-stage in it, so I presume it would be correct.

Puppet isn't set to run at boot right now, which I'm guessing is John's doing.

Comment 11

[John Ford [:jhford] CET/CEST Berlin Time]

(In reply to comment #10) 
> Puppet isn't set to run at boot right now, which I'm guessing is John's doing.

if that is me, I am almost certain that I didn't do that.

Comment 12

[Armen [:armenzg]]

What is left to be done in here?

Comment 13

[Chris Cooper [:coop] (he/him)]

(In reply to comment #12)
> What is left to be done in here?

Everything except 32bit linux, preferably via puppet/OPSI. That's the only platform that's been touched so far.

Probably want to audit existing configs and known_hosts to make sure we're not relying on anything unexpected anywhere.

Comment 14

[[e-mail] (:bhearsum)]

Mac (10.5 + 10.6), Windows, and Linux 64-bit machines all need similar changes done.

Comment 15

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

(In reply to comment #12)
> What is left to be done in here?

(In reply to comment #13)
> (In reply to comment #12)
> > What is left to be done in here?
> 
> Everything except 32bit linux, preferably via puppet/OPSI. That's the only
> platform that's been touched so far.
> 
> Probably want to audit existing configs and known_hosts to make sure we're not
> relying on anything unexpected anywhere.

(In reply to comment #14)
> Mac (10.5 + 10.6), Windows, and Linux 64-bit machines all need similar changes
> done.

Is this accurate summary of what is handled by puppet?

done: linux32
todo: linux64, mac32, mac64, win32, win64


Morphing summary to match.

Comment 16

[Chris AtLee [:catlee]]

I'm actually getting some of this work done in bug 463113

Comment 17

[John Ford [:jhford] CET/CEST Berlin Time]

just a heads up that the build.mozilla.org host should be in the try slave's known_hosts file.

Comment 18

[Lukas Blakk [:lsblakk] use ?needinfo]

afaict this is now fixed thanks to the work in bug 463113. closing.