runtime-cleanup.tmpl removes sshd-keygen, breaks sshd about lorax HOT 6 CLOSED

I can't see any reason to remove /usr/libexec/* at all from openssh, openssh-clients, and openssh-server.... we should nuke all of those.

Also, why do we remove /usr/bin/ssh-* - that's a terrible idea as well.

from lorax.

I think this is the same as https://bugzilla.redhat.com/show_bug.cgi?id=1331753

from lorax.

@bcl that bug seems backwards. Why should anaconda be stripping stuff out of the openssh package?

from lorax.

(I'm not asking to be sarcastic... I was gonna send a PR to nuke those lines, but clearly there's a goal/motivation here I don't understand, so I'm trying to understand it).

from lorax.

At the moment, I see that you are removing a lot of files files using this file (probably to save some space):

$ rpm -ql openssh | grep /etc/ssh
/etc/ssh
/etc/ssh/moduli
$ rpm -ql openssh | grep libexec
/usr/libexec/openssh
/usr/libexec/openssh/ssh-keysign
$ rpm -ql openssh-client | grep /usr/bin/ssh-
/usr/bin/ssh-add
/usr/bin/ssh-agent
/usr/bin/ssh-copy-id
/usr/bin/ssh-keyscan
$ rpm -ql openssh-client | grep /usr/bin/slogin
/usr/bin/slogin
$ rpm -ql openssh-clients | grep libexec
/usr/libexec/openssh/ssh-pkcs11-helper
$ rpm -ql openssh-clients | grep /etc/ssh
/etc/ssh/ssh_config
/etc/ssh/ssh_config.d
/etc/ssh/ssh_config.d/05-redhat.conf
$ rpm -ql openssh-server | grep libexec
/usr/libexec/openssh/sftp-server
/usr/libexec/openssh/sshd-keygen
$ rpm -ql openssh-server | grep /etc/ssh
/etc/ssh/sshd_config

Basically only sshd-keygen and sshd_config are crucial to start sshd with default configuration. Removing moduli is also not a good idea (falling back to the default list of hardcoded primes).

slogin is also gone in F25 so there is no need to remove it now.

I am also not satisfied with overwriting the default configuration files with your own. You enable ChallengeResponseAuthentication which is disabled in our shipped configuration. Also we plan to use the configuration files for System-wide Crypto Policy, which would get overwritten by your scripts.

As a minimal solution, I would recommend not to remove /usr/libexec/openssh/sshd-keygen (remove /usr/libexec/openssh/sftp-server if you wish) to resolve this issue. Further, we could see what would be other useful files and why wouldn't you need them.

from lorax.

See the pull request #160

from lorax.