SCM HTTPS, unknown CA

[LordMike]

Hi,

When trying to set up Git-SCM from #1465, I get the following error with HTTPS (was unable to do SSH for some reason):

So, basically my site uses a CACert.org certificate, which is probably what it's complaining about. This will however affect any site/organization using an internal CA or other untrusted CA.

How can I add the CA certificate to my trust chain?
Is it git's trust chain or Java's trust chain? (tool is git, exception is Java)

[LordMike]

Update, I also get the following errors:

Using git@scm.local:/Internal/Rundeck.git

Failed cloning the repository from git@scm.local:/Internal/Rundeck.git: git@scm.local:/Internal/Rundeck.git: UnknownHostKey: scm.local. RSA key fingerprint is c1:86:20:08:d7:b6:38:fe:36:fa:59:68:b3:03:08:fc

Using ssh://git@scm.local:/Internal/Rundeck.git

Failed cloning the repository from ssh://git@scm.local:/Internal/Rundeck.git: Exception caught during execution of fetch command

---

Sidenote, running the git@scm.local:/Internal/Rundeck.git remote-url a few times will suddenly present this error, instead of the original one (notice the fingerprint is printed three times now):

Failed fetch from the repository: git@scm.local:/Internal/Rundeck.git: UnknownHostKey: scm.local. RSA key fingerprint is c1:86:20:08:d7:b6:38:fe:36:fa:59:68:b3:03:08:fc: git@scm.local:/Internal/Rundeck.git: UnknownHostKey: scm.local. RSA key fingerprint is c1:86:20:08:d7:b6:38:fe:36:fa:59:68:b3:03:08:fc: UnknownHostKey: scm.local. RSA key fingerprint is c1:86:20:08:d7:b6:38:fe:36:fa:59:68:b3:03:08:fc

---

Looking at the SCM page (where you can configure Import/Export settings), I can now see that it has indeed been configured - just not enabled. Enabling it will render the previous error (with the fingerprint three times), and then saying it couldn't be enabled due to errors:

Plugin was not enabled for SCM export: git-export: An error occurred.

[gschueler]

the SSL trust chain would be the one used by java.

[gschueler]

workaround for UnknownHostKey is to add the ssh key to the ~/.ssh/known_hosts file for the Rundeck server user

[LordMike]

For future readers. I added the keys to known_hosts using the following procedure. Rundeck was then able to enable the SCM plugin.

• My rundeck users home was /var/lib/rundeck (not /home/rundeck).
• Ensure you have a .ssh folder in the home folder with permissions 700 or rwx------.
• Navigate to the .ssh folder
• Run the following command: ssh-keyscan -H [hostname] >> known_hosts.
• Ensure the known_hosts file has permissions 544 or rw-r--r--, and is owned by rundeck

[gschueler]

@LordMike I added a toggle to disable "strict" key checking, however it would probably be nice to allow strict mode without doing those manual steps. How could we improve that? A GUI configuration to paste the output of ssh-keyscan maybe?

[LordMike]

Would it be possible to have Rundeck itself fetch the equivalent of ssh-keyscan?

I imagine that in this config, there could be a button to fetch the host keys. Issue however is that this config page is cluttered already (all options are present, regardless if I want to use git://, https:// or other).

The host keys options should only be shown, however, if "Strict Mode" is disabled. I imagine a text box with a placeholder text saying "Paste the servers host keys here. If no host keys are pasted, then host key checking is disabled". Or, a tri-state option, where you chose "Strict", "Specify host key" or "No checking", where the text box appears on the "Specify host key" option.

This solution flows well with the current config page, but a better solution could probably be thought up altogether. It'd just take more time to develop (and design).

Sidenote. Kudos on covering merge conflicts. I just hit a merge conflict on my first commit, and thought to myself "oh shit, now I have to dig through.. " but nope. Covered already. Certainly explains the better part of the 250+ commits for the scm support :). 👍

[LordMike]

Added benefit of storing host keys (and SSL/TLS thumbprints) in the configuration is that in a distributed or recovered environment, a second host can quickly take over executions, and won't rely on local (cryptic and undocumented) configuration.

[gschueler]

thanks.

making the config properties fancier (dynamic) may be slightly out of scope right now, definitely a future enhancement.

I think adding a textbox is a good idea. the git plugin could run ssh-keyscan internally, but would then need a two-step confirmation to present the key sig to the user to verify, so perhaps that is the next phase of enhancement.

Good point about storing the host keys for secondary environment... one caveat: right now the SCM plugin config is scoped only to the unique UUID of current rundeck server node (if using clusterMode), so that multiple nodes don't all attempt to synch/import/export jobs to the same repo. There needs to be a way to migrate the config from one server UUID to another for failover.

I appreciate all of the feedback!