| *** dviroel|afk is now known as dviroel | 00:00 | |
| *** dviroel is now known as dviroel|out | 00:24 | |
| *** dviroel|out is now known as dviroel | 00:59 | |
| *** rlandy|bbl is now known as rlandy|out | 01:09 | |
| *** ysandeep|rover|out is now known as ysandeep|rover | 01:19 | |
| *** dviroel is now known as dviroel|out | 01:24 | |
| *** ysandeep|rover is now known as ysandeep|afk | 02:26 | |
| *** diablo_rojo_phone is now known as Guest458 | 02:44 | |
| *** ysandeep|afk is now known as ysandeep|rover | 04:44 | |
| *** soniya is now known as soniya|ruck | 05:04 | |
| opendevreview | Ian Wienand proposed openstack/project-config master: Set context for unbound.log on selinux systems https://review.opendev.org/c/openstack/project-config/+/841546 | 05:17 |
|---|---|---|
| *** ysandeep|rover is now known as ysandeep|rover|brb | 05:57 | |
| *** ysandeep|rover|brb is now known as ysandeep|rover | 06:15 | |
| opendevreview | Pranali Deore proposed openstack/openstack-zuul-jobs master: Update python testing as per zed cycle testing runtime https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/841368 | 06:53 |
| *** ysandeep|rover is now known as ysandeep|rover|brb | 07:50 | |
| *** ysandeep|rover|brb is now known as ysandeep|rover | 08:03 | |
| *** Guest458 is now known as diablo_rojo_phone | 08:03 | |
| *** jpena|off is now known as jpena | 09:44 | |
| *** ysandeep|rover is now known as ysandeep|rover|lunch | 10:03 | |
| *** rlandy|out is now known as rlandy | 10:20 | |
| *** ysandeep|rover|lunch is now known as ysandeep|rover | 10:34 | |
| *** soniya29 is now known as soniya29|ruck | 11:08 | |
| *** soniya29|ruck is now known as soniya29|ruck|brb | 11:10 | |
| opendevreview | Kendall Nelson proposed openstack/ptgbot master: Update Bot to Show Room Descriptions https://review.opendev.org/c/openstack/ptgbot/+/841575 | 11:15 |
| *** dviroel_ is now known as dviroel | 11:33 | |
| opendevreview | Kendall Nelson proposed openstack/ptgbot master: Update Bot to Show Room Descriptions https://review.opendev.org/c/openstack/ptgbot/+/841575 | 11:44 |
| opendevreview | Bar hochman proposed openstack/pbr master: fix: check for the installed version of importlib_metadata. use it only if pbr supports it. bug-report: https://bugs.launchpad.net/pbr/+bug/1972975 Change-Id: If67caac8d7ee7d5f22d0c6d262582b432d3370d1 https://review.opendev.org/c/openstack/pbr/+/841222 | 11:52 |
| *** ysandeep|rover is now known as ysandeep|rover|brb | 12:01 | |
| *** soniya is now known as soniya|ruck | 12:21 | |
| *** ysandeep|rover|brb is now known as ysandeep|rover | 12:28 | |
| *** dasm|off is now known as dasm | 13:15 | |
| opendevreview | Merged openstack/project-config master: Add SRIOV FEC Operator app to StarlingX https://review.opendev.org/c/openstack/project-config/+/840263 | 13:43 |
| dansmith | clarkb: fungi: so, uh, I just upgraded my dev machine and I seem unable to push/pull from gerrit over ssh | 13:51 |
| dansmith | I get an auth error like my key is not accepted, but ssh -v shows it trying it | 13:51 |
| fungi | dansmith: your openssh probably decided to stop accepting ssh-rsa host keys with sha-1 signatures, but doesn't fall back to trying to fetch sha-2 | 13:52 |
| dansmith | fungi: it seems to be accepting the host key | 13:52 |
| fungi | what error are you getting? | 13:52 |
| dansmith | debug1: Found key in /home/dan/.ssh/known_hosts:49 | 13:53 |
| dansmith | danms@review.opendev.org: Permission denied (publickey). | 13:53 |
| fungi | i'll check gerrit's ssh log | 13:53 |
| fungi | the debug info shows it connecting to port 29418 not 22, right? | 13:54 |
| dansmith | oh, my git is (still failing) but I was trying 22, let me debug with the right port :D | 13:55 |
| fungi | yeah, completely different sshd with different host key | 13:55 |
| dansmith | yeah same error, which is why I didn't notice the difference I guess | 13:55 |
| dansmith | debug1: Host '[review.opendev.org]:29418' is known and matches the RSA host key. | 13:55 |
| dansmith | same complaint | 13:56 |
| fungi | can you /msg me the ip address you're connecting from? it doesn't seem to be getting far enough to log an entry with your username in it | 13:57 |
| *** ysandeep|rover is now known as ysandeep|rover|mtg | 14:00 | |
| fungi | interesting, i can see the failed login attempts you made to the system sshd from that address, but not seeing a connection to the port 29418 sshd logged from there | 14:01 |
| dansmith | I'm trying to think if I submitted patches yesterday before or after the upgrade, but .. nothing else has changed, so seems like it has to be that | 14:02 |
| fungi | i do see that ip address in the logs from 2022-05-10 20:26:25 utc | 14:02 |
| dansmith | oh, yes, definitely pushed patches before the upgrade not after | 14:03 |
| dansmith | so yeah | 14:03 |
| fungi | that was the last connection it logged from there | 14:03 |
| dansmith | but, I'm clearly hitting it | 14:03 |
| fungi | yeah, nothing from your account or that ip address logged yesterday. i'll fire up a packet sniffer to make sure i see the connection inbound | 14:05 |
| dansmith | I wonder if I should force ipv4 | 14:06 |
| dansmith | same deal on ipv4 | 14:06 |
| fungi | can you try connecting with your ipv6 address again? | 14:07 |
| fungi | i've got tcpdump looking for it now | 14:07 |
| dansmith | done | 14:07 |
| fungi | yeah, it definitely showed up at the network interface, but gerrit's not logging it | 14:08 |
| dansmith | well that's a relief :) | 14:08 |
| dansmith | fungi: this did it: https://www.reddit.com/r/Fedora/comments/jhxbdh/no_ssh_public_key_auth_after_upgrade_to_fedora_33/ | 14:09 |
| fungi | i definitely see it logging successful logins from other clients | 14:09 |
| dansmith | weird that it says it's trying the key | 14:09 |
| fungi | yeah, the client side logging from that is definitely confusing | 14:10 |
| dansmith | just pushed with git-review and it worked | 14:10 |
| dansmith | wtf | 14:10 |
| fungi | we updated our manual to recommend ecdsa keys so that new users hopefully don't run into it | 14:10 |
| dansmith | sorry for the noise, I thought I ruled out that ssh key type thing by seeing it try it very plainly in debug | 14:11 |
| fungi | gerrit 3.15 (or is it 3.16?) should have host key signature negotiation support in its sshd, but it will be a while before we're on that version | 14:11 |
| dansmith | but this is a client-side setting about my key, not the host one right? | 14:12 |
| fungi | and we can't easily patch it in because it's entangled with a bunch of other changes to their sshd apparently | 14:12 |
| dansmith | that r/fedora post says the guy spend "a couple days" so I don't feel so bad :) | 14:12 |
| fungi | it's a client-side setting telling your sshd to be willing to accept ssh-rsa (sha-1) key signatures | 14:13 |
| dansmith | my ssh, not sshd right? | 14:13 |
| fungi | yes | 14:14 |
| fungi | it's about the server's key signatures your client is evaluating in order to decide whether to connect to it | 14:14 |
| fungi | which have been deprecated for a while in favor of sha-2 based key signatures, but even after dropping ssh-rsa support openssh continues to assume rsa keys use ssh-rsa unless the negotiation extension to the protocol is supported by the server | 14:14 |
| dansmith | yeah, but the confusing bit is the "trying this key..." log when it clearly isn't | 14:15 |
| fungi | rather than just trying sha-2 (which would work with gerrit) | 14:15 |
| fungi | sad that openssh falls back to something it knows it doesn't support | 14:15 |
| dansmith | what's sad is that it says "offering $key" even though it apparently isn't | 14:16 |
| dansmith | this is the "key" I guess: debug1: send_pubkey_test: no mutual signature algorithm | 14:17 |
| dansmith | I glazed right over that | 14:17 |
| fungi | yeah, that's the one | 14:19 |
| dansmith | I first had this problem during macos upgrades, which surely seemed to behave differently, | 14:20 |
| dansmith | so I thought from the ssh -v that it was not the same issue | 14:20 |
| fungi | understandable | 14:25 |
| dpawlik | fungi, clarkb: Hey, about parsing performance.json and pushing the data to separate index - instead of create new tool that is pulling performance.json results from Opensearch, parse and push it into separate index, I add new fields into the same doc - opensearch will display only performance.json fields for those documents that are related to it. | 15:11 |
| dpawlik | don't want to make offtop on tc meeting | 15:11 |
| clarkb | fungi: dansmith yes the real issue tehre is that openssh and fedora won't update their broken clients to fallback to sha2 when they know sha1 (their current fallback) will never work for them | 15:17 |
| clarkb | any ya gerrit 3.6 (not 3.16) should fix this by updating the smarts on the server side to explicitly negotiate sha2 | 15:18 |
| fungi | d'oh, yes i've been down a python version rabbit hole all morning with 3.11 deprecations for removals in 3.13 | 15:18 |
| fungi | so my brain just inserted a 1 for no good reason | 15:19 |
| clarkb | dpawlik: there were a couple of reasons I was suggesting a separate index. The first is you can store small performance data for long periods of time if stored separately from the logs which are rotated quickly. The other is you potentailly get better performance since the performance data has a stable schema when the lgos do not. Neither are the end of the world and startin | 15:19 |
| clarkb | somewhere and switching later is probably fine | 15:19 |
| dpawlik | clarkb: ah, that makes sense | 15:20 |
| dpawlik | let's talk on that after tc/tomorrow | 15:21 |
| dpawlik | clarkb: need to go. Let's talk tomorrow | 15:45 |
| clarkb | ok | 15:46 |
| opendevreview | Merged openstack/project-config master: Set context for unbound.log on selinux systems https://review.opendev.org/c/openstack/project-config/+/841546 | 15:51 |
| *** ysandeep|rover|mtg is now known as ysandeep|rover | 15:56 | |
| *** soniya|ruck is now known as soniya|out | 16:11 | |
| *** ysandeep|rover is now known as ysandeep|rover|out | 16:28 | |
| fungi | gagehugo: can you abandon project:openstack/openstack-helm-docs is:open before i approve 839427? | 16:33 |
| fungi | https://review.opendev.org/q/project:openstack/openstack-helm-docs+is:open | 16:33 |
| *** jpena is now known as jpena|off | 17:21 | |
| opendevreview | Michael Johnson proposed openstack/project-config master: Fix selinux context for unbound.log https://review.opendev.org/c/openstack/project-config/+/841629 | 19:25 |
| opendevreview | Merged openstack/project-config master: Retire openstack-helm-docs repo, step 3.3 https://review.opendev.org/c/openstack/project-config/+/839427 | 20:05 |
| *** dviroel is now known as dviroel|afk | 21:09 | |
| *** dasm is now known as dasm|off | 21:11 | |
| opendevreview | Merged openstack/project-config master: Fix selinux context for unbound.log https://review.opendev.org/c/openstack/project-config/+/841629 | 21:56 |
| *** prometheanfire is now known as Guest0 | 22:26 | |
| *** rlandy is now known as rlandy|bbl | 23:02 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!