rpms/kexec-tools
7
0
Fork 0
Code Issues Pull Requests Releases Activity

kdumpctl: forbid aliases from ssh config

Browse Source 
For ssh targets kdumpctl only verifies that the config value has the
correct <user>@<host> format itself. For all other tests, e.g. if the
destination can be reached, it relies on ssh. This allows users to
provide a <host> that isn't the proper hostname but an alias defined in
the ssh_config without failing the tests. If this is done
dracut-module-setup.sh:kdump_get_remote_ip will fail to obtain the
targets ip address. This failure is not detected and thus will not fail
the initramfs creation. The resulting initramfs however doesn't have the
necessary information for setting up the network and thus will fail to
boot.

Prevent the use of alias hostnames by verifying that the given hostname
is the same one ssh would use after parsing the ssh_config.

Note: Don't use getent ahosts to verify that the given host can be
resolved as this requires the network to be up which cannot be
guaranteed when the kdump.conf is parsed.

Signed-off-by: Philipp Rudo <prudo@redhat.com>
Reviewed-by: Tao Liu <ltao@redhat.com>
Reviewed-by: Coiby Xu <coxu@redhat.com>
This commit is contained in:
Philipp Rudo 2022-03-25 15:47:03 +01:00 committed by Coiby Xu
parent 247b3dd297
commit b802dbff9f
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
kdumpctl
View File

@ -663,7 +663,7 @@ load_kdump()
check_ssh_config()
{
local SSH_TARGET
local target
while read -r config_opt config_val; do
case "$config_opt" in
@ -687,11 +687,14 @@ check_ssh_config()
esac
done <<< "$(kdump_read_conf)"
#make sure they've configured kdump.conf for ssh dumps
SSH_TARGET=$(echo -n "$DUMP_TARGET" | sed -n '/.*@/p')
if [[ -z $SSH_TARGET ]]; then
[[ -n $DUMP_TARGET ]] || return 1
[[ $DUMP_TARGET =~ .*@.* ]] || return 1
target=$(ssh -G "$DUMP_TARGET" | sed -n -e "s/^hostname[[:space:]]\+\([^[:space:]]*\).*$/\1/p")
if [[ ${DUMP_TARGET#*@} != "$target" ]]; then
derror "Invalid ssh destination $DUMP_TARGET provided."
return 1
fi
return 0
}