From 18a70ef843df688b3adaafc4cd23369c6c3c01b7 Mon Sep 17 00:00:00 2001 From: Lars Erik Wik Date: Mon, 29 Jun 2026 13:31:04 +0200 Subject: [PATCH] Don't advertise federation host with empty SSH fingerprint If ssh-keyscan returns no host key, the setup status was still written with an empty transport_ssh_server_fingerprint. Superhubs then rendered an empty known_hosts entry for the host and the rsync pull later failed with "Host key verification failed". Gate the status update on a non-empty fingerprint and retry on subsequent runs. Changelog: Don't advertise federation host with empty SSH fingerprint Signed-off-by: Lars Erik Wik --- cfe_internal/enterprise/federation/federation.cf | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/cfe_internal/enterprise/federation/federation.cf b/cfe_internal/enterprise/federation/federation.cf index 4616caceae..36d4ce7cff 100644 --- a/cfe_internal/enterprise/federation/federation.cf +++ b/cfe_internal/enterprise/federation/federation.cf @@ -1208,6 +1208,9 @@ bundle agent setup_status ); classes: + "ssh_server_fingerprint_collected" + expression => not(strcmp("$(ssh_server_fingerprint)", "")); + "superhub_setup_status_complete" expression => "any", depends_on => { @@ -1219,7 +1222,12 @@ bundle agent setup_status }; files: - superhub_setup_status_complete:: + # An empty fingerprint (ssh-keyscan returned nothing, e.g. sshd not yet + # reachable on localhost) must not be advertised: a superhub would render + # an empty known_hosts entry for this host and its rsync pull would later + # fail with "Host key verification failed". Skip the status update until + # the fingerprint is collected; the next agent run will retry. + superhub_setup_status_complete.ssh_server_fingerprint_collected:: "$(cfengine_enterprise_federation:config.path_setup_status)" create => "true", perms => default:mog("600", "cfapache", "root"), @@ -1233,6 +1241,10 @@ bundle agent setup_status "transport_ssh_server_fingerprint": "$(ssh_server_fingerprint)", }', if => isvariable(ssh_pub_key); + + reports: + superhub_setup_status_complete.!ssh_server_fingerprint_collected:: + "warning: 'ssh-keyscan localhost' returned no SSH host key; federation setup status not written yet. Will retry next run."; } bundle agent distributed_cleanup_setup