Fixes #38361 - Use the system's SSH instead of net/ssh for provisioning

[stejskalleos]

Ruby's net/ssh implementation fails to connect RHEL8 and RHEL8 with enabled FIPS.

To avoid problems in the future, use the system's SSH instead of Ruby's.

Notes

• Foreman::Provision::Ssh is used only in core and deprecated plugins; changes should not affect outsiders.
• If password and key are present in options, key takes precedence over the password.

Related PRs

• https://github.com/theforeman/foreman-packaging/pull/11946

[stejskalleos]

Sample rake task for testing:

namespace :ssh do
  task :play => :environment do
    options = {
      template: '/path/to/ssh_template.sh',
      password: 'vagrant',
      key_data: File.read('path/to/.ssh/id_rsa'),
    }

    client = Foreman::Provision::Ssh.new('vm-ip-or-hostname', 'root', options)

    if client.deploy!
      puts "SSH command executed successfully"
    else
      puts "SSH command failed"
    end
  end
end

[stejskalleos]

Added

• Cleanup of the script after the execution
• Check for authentication methods. If both are available, the key takes precedence over the password.

[stejskalleos]

Have you considered these?

I didn't. So if we cannot use scp, does it mean we have to stick with net-scp, therefore scratching this effort?

[adamruzicka]

So if we cannot use scp, does it mean we have to stick with net-scp, therefore scratching this effort?

Not really. Iirc scp was deprecated in favor of sftp, so you could either use that or roll your own. In rex we essentially do echo 'contents' | ssh user@host tee /path/on/the/remote

[ekohl]

Not really. Iirc scp was deprecated in favor of sftp, so you could either use that or roll your own. In rex we essentially do echo 'contents' | ssh user@host tee /path/on/the/remote

I think it is confusing. My interpretation is that the scp protocol is deprecated but in EL9 the scp utility now uses the sftp protocol under the hood.

https://devcoops.com/sftp-transfer-files-through-cli-non-interactive/ has some examples of non-interactive sftp utility usage which can also be considered.

[stejskalleos]

@ekohl If the scp utility uses the sftp protocol, this PR will work as intended, right?

With the stfp, I couldn't find a way to upload a local file to a specific remote file, which is problematic with the whole remote_script naming. So, can we keep it as it is?

[stejskalleos]

@ekohl @adamruzicka rebased and updated, replaced scp with sftp.

[stejskalleos]

@adamruzicka @ekohl CI is green and all the comments have been addressed. IMO the PR is ready for QE, WDYT?

[stejskalleos]

@ShimShtein can you take a look please?

[ShimShtein]

@adamruzicka I think it's OK. If you're also OK with it, please push the green button :)

[adamruzicka]

Thank you @stejskalleos !

[ekohl]

Late to the party, but should this have dropped the gem dependencies: https://github.com/theforeman/foreman/blob/f4246cdaca1d0039d93de65cda9e52862c02f81b/Gemfile#L30-L31

[stejskalleos]

Created a PR for it https://github.com/theforeman/foreman/pull/10588; Once it's green I'll update foreman-packaging as well