- clo-devel - mailman3.common-lisp.net

Broadcast message regarding supported SSH key types - older rsa keys may no longer work
by David Cooper 28 Dec '24

28 Dec '24

Hi Jon, I think our new host is more picky about what kind of keys it accepts. For one thing, the sshd on the new host is probably configured by default to accept only newer types of keys (this is recently updated Debian bookworm). And for another thing I believe a recent Gitlab update tightened up the requirements for keys, rendering e.g. older rsa keys invalid (I don't know that for a fact but I feel it's true). If you could research a bit what types of keys are officially accepted by our setup, then perhaps that info could be included in a second Broadcast message for folks. Dave

1 0

Problem with project link
by Robert Goldman 28 Dec '24

28 Dec '24

I was trying to follow a link from the projects hub, https://common-lisp.net/phub for usocket, and got a 404. I've tried clicking some other links and they all 404 also, so maybe there's some rewrite or redirect logic that's busted? Happy Holidays, R

6 40

fixed the ssh port 4022/22 issue
by David Cooper 27 Dec '24

27 Dec '24

The new gitlab host is now reachable both through default ssh port 22 and the other port 4022 we were using for setup. I had to use nft commands to add it to the inputRules chain, where apparently it had to be. Using iptables commands did not work (i guess it put on wrong chain). So I think the iptables front-end is there for the benefit of docker, and we can (and probably should) still use nft commands for doing manual admin. Dave Cooper ---- On Thu, 26 Dec 2024 22:28:20 -0500 Jon Boone <ipmonger(a)delamancha.org> wrote --- I seem to have been blocked due to too many failed authentication attempts. I have access to legacy ssh key (I verified I can use it to log in to the legacy host), so please re-enable my ability to ssh in and I think that will be a good place to pick up again tomorrow. —jon On Thu, Dec 26, 2024 at 9:33 PM David Cooper <mailto:david.cooper@genworks.com> wrote: Hi Jon, Your `jboone` account is created on http://gitlab.common-lisp.net, accessible through port 4022. I put two public keys in your authorized_keys, the one you sent below, plus one which was in your .ssh/authorized_keys on the legacy host. The task at hand is to switch sshd to 22, make sure that is allowed thru the firewall for ipv4 and ipv6, and most of all, not get us locked out of the machine! The firewall is nftables with a iptables frontend, and fail2ban is installed but stopped at the moment. I'm going to be offline for an hour or two and I'll check in once before bed (i'm in eastern time zone) Dave Cooper ---- On Thu, 26 Dec 2024 21:15:38 -0500 David Cooper <mailto:david.cooper@genworks.com> wrote --- Hi Jon, Ok, i'll make you an account on the new host with sudo. Give me a few minutes. Dave Cooper ---- On Thu, 26 Dec 2024 21:12:40 -0500 Jon Boone <mailto:ipmonger@delamancha.org> wrote --- David, I can try to assist you if you want to continue working on this tonight or tomorrow. Here's my public key for user mailto:jboone@gitlab.common-lisp.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqwjwchMCU4S9OrgbkbJuZh7i6ObH31LO0poUaCd4h6 but I don't think I have an ssh login setup. —jon On Thu, Dec 26, 2024 at 8:25 PM David Cooper <mailto:david.cooper@genworks.com> wrote: Dear Raymond (and all concerned), I'm having trouble switching the sshd service back to port 22, and I have to give up on it for a little while. If anyone is available to help with this let me know. In the meantime the sshd is on port 4022 and your .ssh/config will need to be configured accordingly. Here is mind for example: ``` Host future http://future.common-lisp.net http://gitlab.common-lisp.net http://git.common-lisp.net gi\ http://tlab-future.common-lisp.net Hostname http://gitlab.common-lisp.net AddKeysToAgent yes IdentityFile ~/.ssh/id_ed_github User dcooper Port 4022 PubkeyAcceptedKeyTypes=ssh-ed25519 ``` What I tried on the server: 1. Added ACCEPT rule to the firewall (nftables with iptables frontend) for port 22. 2. Edited /etc/ssh/sshd_config.d/local.conf and changed Port to 22 3. Confirmed with `sudo netstat -tulpn | grep 22` that sshd was listening on port 22 4. Updated my home .ssh/config to comment out the Port 4022 5. Tried ssh from home - did not work (timed out). For fear of locking myself out of the server, I set it back to 4022 for now, confirmed I could log in, then rebooted the machine to make sure the firewall and fail2ban are active again. Dave Cooper ---- On Thu, 26 Dec 2024 19:48:45 -0500 David Cooper <mailto:david.cooper@genworks.com> wrote --- Hi again Raymond, Sorry for your frustrations, and this next one is on us for sure: as a security measure, we had updated the ssh port from the standard port 22 to the arbitrary 4022. I'm changing it back to standard 22 now. And as you have both a shell login account and Gitlab account, you probably have to add your ed25519 public key both in the .ssh/ directory and .ssh/authorized_keys file, as we ll as pasting into your Gitlab profile through the gitlab web ui (after you can access that), to enable both shell login and git push/pull. Presumably you already have your ed25519 public key pasted into gitlab, but you can confirm that as soon as you can access the website. As an example, here is my .ssh/config for the new host: ``` Host future http://future.common-lisp.net http://gitlab.common-lisp.net http://git.common-lisp.net gi\ http://tlab-future.common-lisp.net Hostname http://gitlab.common-lisp.net AddKeysToAgent yes IdentityFile ~/.ssh/id_ed_github User dcooper PubkeyAcceptedKeyTypes=ssh-ed25519 ``` Please wait a few minutes while I change the port back to the standard 22. Dave Cooper ---- On Thu, 26 Dec 2024 18:34:32 -0500 Raymond Toy <mailto:toy.raymond@gmail.com> wrote --- On Thu, Dec 26, 2024 at 3:19 PM David Cooper <mailto:david.cooper@genworks.com> wrote: Dave Cooper ---- On Thu, 26 Dec 2024 17:41:05 -0500 mailto:toy.raymond@gmail.com wrote ---- Can you ssh to http://gitlab.common-lisp.net ? It might not accept older rsa keys, i.e.you might need to generate new stronger e.g. ed25519 keys (I'm not gonna go snooping around your .ssh directory unless I need to). If so, send me your new public key and I'll add it to your .ssh/authorized_keys on the new host. Hmm. I can't ssh to http://gitlab.common-lisp.net. I don't think I've ever tried that before. I still have my old rsa key, but I also switched to ed25519 keys quite a while ago and that's what I use for ssh now. On Thu, Dec 26, 2024 at 12:53 PM David Cooper <mailto:david.cooper@genworks.com> wrote: Note that the DNS for http://gitlab.common-lisp.net switched over to a new IP address (a new Hetzner host) Christmas eve. What is the correct IP address? Clearing the OS and browser DNS cache didn't seem to make a difference. I can ping http://gitlab.common-lisp.net just fine: ``` 64 bytes from http://future.common-lisp.net (65.108.13.229) ``` So you may need to clear your DNS caches (browsers and OS). The toplevel http://common-lisp.net still resolves to the old host for now, so ssh'ing there will get you to the legacy host. But the plan is to move that to the new host in due course as well. I assume you'll need a shell login for the new host? The new host is reachable via http://future.common-lisp.net or http://gitlab.common-lisp.net, and i believe your shell login account has been replicated on the new host Yes, I'd like a shell login. I still need to access it to upload cmucl release tarballs and such. Thanks for your help. I think I should reboot my modem and wifi once again. I think that's the only way to clear the DNS cache on my wifi router connected to my cable modem. already. Dave Cooper P.S. these mailing lists are still going through the legacy host. ---- On Thu, 26 Dec 2024 13:45:50 -0500 mailto:toy.raymond@gmail.com wrote ---- On Thu, Dec 26, 2024 at 8:54 AM Jon Boone <mailto:ipmonger@delamancha.org> wrote: I have no problems reaching it via Safari (Version 18.2 (20620.1.16.11.8)) or Chrome (Version 131.0.6778.205 (Official Build) (arm64)) on macOS 15.2 (24C101) as of 2024-12-26 11:55 EST. Ok, it must be me. I can't reach it on any of my computers, even after rebooting my modem and wifi point. But I can over cellular with my phone. But every other site I try works fine over my home wifi. I can even ssh into http://common-lisp.net. Not sure what's going on. I didn't update anything or add a proxy or anything like that. —jon On Thu, Dec 26, 2024 at 11:26 AM Raymond Toy <mailto:toy.raymond@gmail.com> wrote: On 12/25/24 12:28 PM, Georgiy Tugai wrote: I believe that the links should be working again now. FWIW, I can’t reachhttp://gitlab.common-lisp.net at all. Firefox says it’s unable to connect. Chrome says it can’t be reached. I think this started a couple of days ago, maybe? Regards, Georgiy On 25/12/2024 21:02, Robert Goldman wrote: I was trying to follow a link from the projects hub, https://common-lisp.net/phub for usocket, and got a 404. I've tried clicking some other links and they all 404 also, so maybe there's some rewrite or redirect logic that's busted? Happy Holidays, R -- Ray -- Ray -- Ray

1 0

Re: Problem with project link
by David Cooper 27 Dec '24

27 Dec '24

You might try it again on 4022, because I've been messing it randomly over the past couple hours and you might have happened to try while I had it switched to 22 (and i was getting the same apparent hangs as you describe for 22 while it was switched to that). There should definitely be connectivity on port 4022 - if you do for example telnet gitlab.common-lisp.net 4022 you will get a connection and can type `GET /` (it will say "invalid ssh identification string" but this should prove that the basic connectivity is there). Dave Cooper ---- On Thu, 26 Dec 2024 20:57:51 -0500 Raymond Toy <toy.raymond(a)gmail.com> wrote --- On Thu, Dec 26, 2024 at 3:57 PM David Cooper <mailto:david.cooper@genworks.com> wrote: I see three rsa and one dsa in your authorized_hosts, no ed25519. I'll put your ed25519 one in if you can send it. Weird. I just did `ssh-copy-id ~/.ssh/id_ed25519.pub mailto:rtoy@common-lisp.net ` and that said that all keys were skipped because they already exist. I don't know why but my ed25519.pub key starts with "ssh-rsa". Also, maybe you need to update your .ssh/config with the name http://gitlab.common-lisp.net because previously you were logging in to the toplevel name (that will work for the new host as well when migration is complete, but in the interim you'll have to ssh to it as http://gitlab.common-lisp.net or its IP address). I can't ssh to http://gitlab.common-lisp.net on either port 22 or 4022. Port 4022 says connection refused. Port 22 just seems to hang. Haven't updated .ssh/config yet. Dave Cooper

1 0

Fwd: Re: Problem with project link
by David Cooper 26 Dec '24

26 Dec '24

Dave Cooper ============ Forwarded Message ============ From : david.cooper(a)genworks.com To : toy.raymond(a)gmail.com Date : Thu, 26 Dec 2024 18:57:06 -0500 Subject : Re: Problem with project link ============ Forwarded Message ============ I see three rsa and one dsa in your authorized_hosts, no ed25519. I'll put your ed25519 one in if you can send it. Also, maybe you need to update your .ssh/config with the name gitlab.common-lisp.net because previously you were logging in to the toplevel name (that will work for the new host as well when migration is complete, but in the interim you'll have to ssh to it as gitlab.common-lisp.net or its IP address). Dave Cooper ---- On Thu, 26 Dec 2024 18:34:32 -0500 toy.raymond(a)gmail.com wrote ---- On Thu, Dec 26, 2024 at 3:19 PM David Cooper <david.cooper(a)genworks.com> wrote: Dave Cooper ---- On Thu, 26 Dec 2024 17:41:05 -0500 toy.raymond(a)gmail.com wrote ---- Can you ssh to gitlab.common-lisp.net ? It might not accept older rsa keys, i.e.you might need to generate new stronger e.g. ed25519 keys (I'm not gonna go snooping around your .ssh directory unless I need to). If so, send me your new public key and I'll add it to your .ssh/authorized_keys on the new host. Hmm. I can't ssh to gitlab.common-lisp.net. I don't think I've ever tried that before. I still have my old rsa key, but I also switched to ed25519 keys quite a while ago and that's what I use for ssh now. On Thu, Dec 26, 2024 at 12:53 PM David Cooper <david.cooper(a)genworks.com> wrote: Note that the DNS for gitlab.common-lisp.net switched over to a new IP address (a new Hetzner host) Christmas eve. What is the correct IP address? Clearing the OS and browser DNS cache didn't seem to make a difference. I can ping gitlab.common-lisp.net just fine: ``` 64 bytes from future.common-lisp.net (65.108.13.229) ``` So you may need to clear your DNS caches (browsers and OS). The toplevel common-lisp.net still resolves to the old host for now, so ssh'ing there will get you to the legacy host. But the plan is to move that to the new host in due course as well. I assume you'll need a shell login for the new host? The new host is reachable via future.common-lisp.net or gitlab.common-lisp.net, and i believe your shell login account has been replicated on the new host Yes, I'd like a shell login. I still need to access it to upload cmucl release tarballs and such. Thanks for your help. I think I should reboot my modem and wifi once again. I think that's the only way to clear the DNS cache on my wifi router connected to my cable modem. already. Dave Cooper P.S. these mailing lists are still going through the legacy host. ---- On Thu, 26 Dec 2024 13:45:50 -0500 toy.raymond(a)gmail.com wrote ---- On Thu, Dec 26, 2024 at 8:54 AM Jon Boone <ipmonger(a)delamancha.org> wrote: I have no problems reaching it via Safari (Version 18.2 (20620.1.16.11.8)) or Chrome (Version 131.0.6778.205 (Official Build) (arm64)) on macOS 15.2 (24C101) as of 2024-12-26 11:55 EST. Ok, it must be me. I can't reach it on any of my computers, even after rebooting my modem and wifi point. But I can over cellular with my phone. But every other site I try works fine over my home wifi. I can even ssh into common-lisp.net. Not sure what's going on. I didn't update anything or add a proxy or anything like that. —jon On Thu, Dec 26, 2024 at 11:26 AM Raymond Toy <toy.raymond(a)gmail.com> wrote: On 12/25/24 12:28 PM, Georgiy Tugai wrote: I believe that the links should be working again now. FWIW, I can’t reach gitlab.common-lisp.net at all. Firefox says it’s unable to connect. Chrome says it can’t be reached. I think this started a couple of days ago, maybe? Regards, Georgiy On 25/12/2024 21:02, Robert Goldman wrote: I was trying to follow a link from the projects hub, https://common-lisp.net/phub for usocket, and got a 404. I've tried clicking some other links and they all 404 also, so maybe there's some rewrite or redirect logic that's busted? Happy Holidays, R ...

1 0

Re: Problem with project link
by Robert P. Goldman 25 Dec '24

25 Dec '24

Hi David, Will do! Thanks, -Robert Sent from my iPhone On Dec 25, 2024 at 14:50:15 CST, David Cooper <david.cooper(a)genworks.com> wrote: Hi Robert, gitlab-future.common-lisp.net should now resolve identically as gitlab.common-lisp.net, such that the former should no longer be needed. If you test, please go ahead and test the latter. Dave Cooper ---- On Wed, 25 Dec 2024 15:37:55 -0500 rpgoldman(a)sift.net wrote ---- Hi David, Sure. Should I try on cl.net, cl-future.net, or both? Thanks, -Robert Sent from my iPhone On Dec 25, 2024 at 14:24:56 CST, David Cooper < david.cooper(a)genworks.com > wrote: Hi Robert, If you are still looking at this stuff, could you try some of your pipelines. Thanks, Dave Cooper ---- On Wed, 25 Dec 2024 15:02:19 -0500 rpgoldman(a)sift.info wrote ---- I was trying to follow a link from the projects hub, https://common-lisp.net/phub for usocket, and got a 404. I've tried clicking some other links and they all 404 also, so maybe there's some rewrite or redirect logic that's busted? Happy Holidays, R

1 0

Re: Problem with project link
by Robert P. Goldman 25 Dec '24

25 Dec '24

Hi David, Sure. Should I try on cl.net, cl-future.net, or both? Thanks, -Robert Sent from my iPhone On Dec 25, 2024 at 14:24:56 CST, David Cooper <david.cooper(a)genworks.com> wrote: Hi Robert, If you are still looking at this stuff, could you try some of your pipelines. Thanks, Dave Cooper ---- On Wed, 25 Dec 2024 15:02:19 -0500 rpgoldman(a)sift.info wrote ---- I was trying to follow a link from the projects hub, https://common-lisp.net/phub for usocket, and got a 404. I've tried clicking some other links and they all 404 also, so maybe there's some rewrite or redirect logic that's busted? Happy Holidays, R

1 0

Quick question about cl.net github actions
by Robert Goldman 17 Dec '24

17 Dec '24

Sorry to bother you, but wondering -- did the CI issue with the Gitlab runner not being able to run newer docker images get fixed? That's the one where the Gitlab runner claims it can't find the shell when running some newer docker images. I was going to fix up some issues in the ASDF pipelines, but I think that's a blocker.

2 1

Please stop mails
by Elias Pipping 11 Dec '24

11 Dec '24

My son Elias died in 2017. I’m still caring for his accounts. In case of any questions concerning projects please contact his brother Sebastian.pipping.org Thank you! Heike Pipping Sent from my iPhone

1 0

Re: Discourse Requirements
by Mark Evenson 19 Nov '24

19 Nov '24

> On Jun 18, 2022, at 18:11, Chris Moore <moore.christopher515(a)gmail.com> wrote: > > Hey Mark! > > If it makes it easier for the foundation, I can get the host together myself (paying for w/e architecture) and get a proof of concept out for the board to review prior to attaching any kind of DNS record. Not necessary for you to get the host yourself. Sorry to have been a little recalcitrant over the last week, but I have just started a new job with <https://status.im> which has been occupying my time. Erik Hülsmann, a CLF board member, rents <https://hetzner.de/> instances for his CRM company which he essentially donates to the CLF at less than costs, so spinning up a host is no problem. We have standardized on Debian over Ubuntu as it makes the licensing situation clearer when we need a “special case”. Is there any reason you couldn’t install Discourse in the manner you wish under Debian? > > This includes me setting up whatever mail server, getting our daily backups together, and adding necessary plugins (GitHub/Gmail OAuth). If necessary, we would federate the `USER(a)common-lisp.net` domain. Currently we are running exim as the main MTA due to legacy concerns with mailman2 databases, but we wish to transition to a toplevel `postfix` that will work with the legacy `exim` for the `mailman2` app. > > I apologize for trying to rush this - I've got a lot of free time currently due to a lull in work going on at my current company. So I and the dev team are currently not doing much. I want to take advantage of the time while I can. Cool. Let’s take advantage of it. > > Let me know and I'll get this out the door ASAP. Can you please provide me with the public half of a contemporary-strength SSH keypair. We’ll set up a host, and communicate root@HOST via ip4/6 under separate cover. yours, Mark P.S. if you wanna find me online, let’s figure out a Discord rendezvous. I’m <discord:347061732705042435> aka <discord:easye#8466>. -- "A screaming comes across the sky. It has happened before but there is nothing to compare to it now."

2 1