<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div style="font-family: verdana, geneva;">Hi all,</div><div style="font-family: verdana, geneva;"><br></div><div style="font-family: verdana, geneva;">I've found the "ltsp-update-sshkeys" script failing on CentOS 6.4.</div><div style="font-family: verdana, geneva;">Reason is, script attempts to create keys for rsa, dsa and ecdsa while the last one (ecdsa) is not available in this distro.</div><div style="font-family: verdana, geneva;">One may install ecdsa, however I've failed to find it. Disregarding that I would suggest to fix the script making it a bit smarter about what is possible <span style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;" mce_style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;">in the system where it is running.</span></div><div style="font-family: verdana, geneva;"><span style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;" mce_style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;"><br></span></div><div style="font-family: verdana, geneva;"><span style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;" mce_style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;">Assuming, that list of the private key files stored in /etc/ssh resembles what is possible in the system (each file is created using different algorithm), one may derive names from /etc/ssh/ssh_host_*_key files.</span></div><div style="font-family: verdana, geneva;"><span style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;" mce_style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 9pt;">Simple "diff" of old and new files presents the change I do suggest:</span></div><div><span style="font-size: 9pt;" mce_style="font-size: 9pt;"><span style="font-family: 'courier new', courier;" mce_style="font-family: 'courier new', courier;">84a85,87<br>> # Use ciphers known to the local system<br>> KNOWN_ALGO=$(for fn in /etc/ssh/ssh_host_*_key; do echo `basename $fn`; done | awk -F_ '{if(FNR>1)printf ",";printf $3}')<br>> <br>93c96<br>< ssh-keyscan -t dsa,rsa,ecdsa ${PORT:+-p $PORT} "$@" 2>&1 >"$EXPORT" |<br>---<br>> ssh-keyscan -t "${KNOWN_ALGO}" ${PORT:+-p $PORT} "$@" 2>&1 >"$EXPORT" |</span><br> </span></div><div style="font-family: verdana, geneva;">With above fix applied, script is using what is available and creates keys. It will use ecdsa (or any other algorithm) if it might ever been installed later and appropriate private key file will get created, without need to fix it again.</div><div style="font-family: verdana, geneva;"><br></div><div style="font-family: verdana, geneva;">For your convenience, both - diff file and modified script are attached.</div><div style="font-family: verdana, geneva;"><br></div><div style="font-family: verdana, geneva;">Kind regards</div><div style="font-family: verdana, geneva;">Emil Krotki</div><div style="font-family: verdana, geneva;">EkroTech</div><div style="font-family: verdana, geneva;">PL: +48 693 463 115</div><div style="font-family: verdana, geneva;"><br><br></div> <blockquote id="replyBlockquote" webmail="1" style="font-family: verdana; border-left-width: 2px; border-left-style: solid; border-left-color: blue; margin-left: 8px; padding-left: 8px; font-size: 10pt; color: black;"> <div id="wmQuoteWrapper"> -------- Original Message --------<br> Subject: Re: [K12OSN] I can't log in into LDM | SL 6.1 thin client image<br> From: Radek Bursztynowski <<a href="mailto:radek@bursztynowski.waw.pl">radek@bursztynowski.waw.pl</a>><br> Date: Fri, July 12, 2013 1:14 pm<br> To: "Support list for open source software in schools."<br> <<a href="mailto:k12osn@redhat.com">k12osn@redhat.com</a>><br> <br> Baryy,<br> <br> It could be that I don't understand you exactly, so let me present my steps:<br> <br> 1. I log into my server as a root and I deleted all files from /tmp directory.<br> 2. I rebooted my thin client. <br> 3. I switched SCREEN on my thin client to xtermm.<br> 4. Then: ssh -X user@my_server<br> 5. I logged into my server (I accepted certificate). Next I exited.<br> 6. From my thin client (still xterm SCREEN)I made:<br> # su -<br> # ssh -X root@my_server (I accepted certificate), and I logged into, next I exited.<br> 7. I switched SCREEN to LDM.<br> 8. Now I can log into as a regular user and root.<br> <br> But it is temporary success because after rebooting thin client I lose certificate and still I couldn't log into.<br> <br> How to save proper set-up?<br> <br> Radek<br> <br> ---<br> Radek,<br> <br> On your server browse to the /tmp folder.<br> Delete all files ( as root) within the /tmp folder.<br> After deleting these files try and log into a thin client as a regular<br> user.<br> Also as a backup..try logging into a thin client as root and see if root<br> can do a log in to a thin client to your SL(older) image.<br> <br> Barry<br> <br> <br> <br> _______________________________________________<br> K12OSN mailing list<br> <a href="mailto:K12OSN@redhat.com">K12OSN@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/k12osn">https://www.redhat.com/mailman/listinfo/k12osn</a><br> For more info see <<a href="http://www.k12os.org">http://www.k12os.org</a>>;<br> <br> _______________________________________________<br> K12OSN mailing list<br> <a href="mailto:K12OSN@redhat.com">K12OSN@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/k12osn">https://www.redhat.com/mailman/listinfo/k12osn</a><br> For more info see <<a href="http://www.k12os.org">http://www.k12os.org</a>><br> </div> </blockquote></span></body></html>