[rancid] SSH public-keys

Tyler J. Wagner tyler at tolaris.com
Tue Jan 10 13:29:57 UTC 2012


Reading /usr/lib/rancid/bin/clogin, I don't see any intelligence for using
SSH keys. Sorry, if you want that, you'll have to add it. Patches would no
doubt be welcome.

Tyler

On 2012-01-10 13:11, Michael Maymann wrote:
> Hi Tyler,
> 
> Thanks for your reply...:-) !
> 
> Same thing happens as for my network user...:
> 1. yes
> 2. no (clogin/hlogin requires a .cloginrc file with username/password to
> run) - and my best bet is that this is what it uses currently... so no
> ssh-keys using clogin/hlogin (from wither network user, root, rancid...).
> Furthermore prompt is also "hanging" and it doesn't parse the -c "sh ver"
> that works fine from normal ssh...
> 3. same as network user/root
> 
> So key-sharing is working fine... but don't know how to utilize it/bypass
> .cloginrc in rancid...
> Just hoping that there is a way... - would'nt like to manually edit scripts
> every time i update Rancid... and I don't know expect that well either...:-) !
> 
> Thanks in advance :-) !
> ~maymann
> 
> 2012/1/10 Tyler J. Wagner <tyler at tolaris.com <mailto:tyler at tolaris.com>>
> 
>     Michael,
> 
>     I've not tried using clogin/hlogin with SSH keys, but I know a great deal
>     about SSH. Assuming that clogin will use a key if present (a big if):
> 
>     1. Can you login with the SSH key using ssh as the root user?
>     2. Can you login with the SSH key using clogin as the root user?
>     3. What about as the rancid user?
> 
>     Regards,
>     Tyler
> 
>     On 2012-01-10 08 <tel:2012-01-10%2008>:17, Michael Maymann wrote:
>     > I'm running on rhel-5u7-x64.
>     > Anyone...?
>     >
>     >
>     > Thanks in advance :-)
>     > ~maymann
>     >
>     > 2012/1/9 Michael Maymann <michael at maymann.org
>     <mailto:michael at maymann.org> <mailto:michael at maymann.org
>     <mailto:michael at maymann.org>>>
>     >
>     >     hlogin -w <USR> -c "sh ver" <HOSTNAME>:
>     >     ---
>     >     <HOSTNAME>
>     >     spawn hpuifilter -- ssh -c 3des -x -l <USR> <HOSTNAME>
>     >     We'd like to keep you up to date about:
>     >       * Software feature updates
>     >       * New product announcements
>     >       * Special events
>     >
>     >     Please register your products now at:  www.ProCurve.com
>     <http://www.ProCurve.com>
>     >     <http://www.ProCurve.com>
>     >
>     >
>     >     ProCurve J8697A Switch 5406zl
>     >     Software revision K.15.02.0005
>     >
>     >     Copyright (C) 1991-2010 Hewlett-Packard Co.  All Rights Reserved.
>     >
>     >                                RESTRICTED RIGHTS LEGEND
>     >
>     >      Use, duplication, or disclosure by the Government is subject to
>     >     restrictions
>     >      as set forth in subdivision (b) (3) (ii) of the Rights in Technical
>     >     Data and
>     >      Computer Software clause at 52.227-7013.
>     >
>     >              HEWLETT-PACKARD COMPANY, 3000 Hanover St., Palo Alto, CA
>     94303
>     >
>     >     Press any key to continue<HOSTNAME>#
>     >     ---
>     >     Just "hangs" there...
>     >
>     >
>     >     ssh <USR>@<HOSTNAME>:
>     >     ---
>     >     We'd like to keep you up to date about:
>     >       * Software feature updates
>     >       * New product announcements
>     >       * Special events
>     >
>     >     Please register your products now at:  www.ProCurve.com
>     <http://www.ProCurve.com>
>     >     <http://www.ProCurve.com>
>     >               ProCurve J8697A Switch 5406zl
>     >     Software revision K.15.02.0005
>     >
>     >     Copyright (C) 1991-2010 Hewlett-Packard Co.  All Rights Reserved.
>     >
>     >                                RESTRICTED RIGHTS LEGEND
>     >
>     >      Use, duplication, or disclosure by the Government is subject to
>     >     restrictions
>     >      as set forth in subdivision (b) (3) (ii) of the Rights in Technical
>     >     Data and
>     >      Computer Software clause at 52.227-7013.
>     >
>     >              HEWLETT-PACKARD COMPANY, 3000 Hanover St., Palo Alto, CA
>     94303
>     >     Press any key to continue
>     >     <HOSTNAME># sh ver
>     >     Image stamp:    /sw/code/build/btm(K_15_02)
>     >                     Oct 20 2010 16:19:41
>     >                     K.15.02.0005
>     >                     121
>     >     Boot Image:     Primary
>     >     <HOSTNAME># logout
>     >     Do you want to log out [y/n]? y
>     >     Connection to <HOSTNAME> closed.
>     >     ---
>     >     So SSH is working fine...
>     >     I'm running Rancid 2.3.6... hlogin=$Id: hlogin.in
>     <http://hlogin.in> <http://hlogin.in>
>     >     2251 2010-10-01 19:26:36Z heas $
>     >     Could there be a problem with HP Procurve 5406zl hlogin script
>     >     somewhere... or can someone actually confirm this to be working on
>     >     their 5406zl ?
>     >
>     >     Furthermore, I would like to run hlogin+clogin wihout having to
>     >     configure anything inside .cloginrc... is this possible somehow ?
>     >
>     >
>     >     Thanks in advance... :-) !
>     >     ~maymann
>     >
>     >
>     >     2012/1/9 Michael Maymann <michael at maymann.org
>     <mailto:michael at maymann.org> <mailto:michael at maymann.org
>     <mailto:michael at maymann.org>>>
>     >
>     >         Hi List,
>     >
>     >         We have a setup where we have destributed 4096 bit RSA
>     public-keys
>     >         to all our equipment from a network-user for optimanl security.
>     >         Our equipment is already in a DB and we have a scripting
>     >         environment that figures out the vendor/model/type for us
>     already.
>     >         1. Can I use rancid without using .cloginrc (e.g. directly from
>     >         commandline) - how... ?
>     >         2. Alternatively, can I configure .cloginrc with ssh-keysharing -
>     >         how... ?
>     >
>     >         We will need to connect to HP ProCurve (hlogin) and Cisco
>     (clogin)...
>     >
>     >
>     >         Thanks in advance :-) !
>     >
>     >         ~maymann
>     >
>     >
>     >
>     >
>     >
>     > _______________________________________________
>     > Rancid-discuss mailing list
>     > Rancid-discuss at shrubbery.net <mailto:Rancid-discuss at shrubbery.net>
>     > http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss
> 
>     --
>     "[...] we are not attacking the corporations, but endeavoring to do
>     away with any evil in them. We are not hostile to them; we are merely
>     determined that they shall be so handled as to subserve the public
>     good. We draw the line against misconduct, not against wealth."
>       -- Theodore Roosevelt
> 
> 

-- 
"I respect you too much to respect your ridiculous ideas."
   -- Johann Hari


More information about the Rancid-discuss mailing list