This message was deleted.
# puppet-enterprises
Slackbot
01/09/2023, 4:51 AMThis message was deleted.
c
csharpsteen
01/09/2023, 2:08 PMHmm. Which type of private key are you using? PE uses 1.10.0-DEV because GitHub dropped support in Fall 2021 for using SHA-1 signatures with RSA keys and many other Git hosting services followed.
e
Eric Rostetter
01/09/2023, 8:29 PMI believe it is a 2048 bit SHA256 RSA key
Eric Rostetter
01/09/2023, 8:33 PMThe fact that I'm seeing this, and no one else is, suggests it is something with either my keys or my ssh server... I'm willing to admit it is something on my end, but I can't figure out what exactly. I think my work arounds are working, so, not a hurry now (though I spent about 3 days trying to fix this over the weekend).
c
csharpsteen
01/09/2023, 9:02 PMYeah, similar segfaults have occurred in a very small number of cases. So far, we haven't been able to re-produce them on internal test hardware, or GCP VMs built from official OS images, or GitHub action runners, or AWS OS images...
Is there any OS hardening applied to these nodes that might affect how they react to how processes access memory?
e
Eric Rostetter
01/10/2023, 5:57 PMWe do harden them, but I wouldn't think it would affect memory access... Good question though, I'd have to check if there is anything in the hardening that could affect memory. While one machine is RHEL and the other Ubuntu, they do get the same basic hardening since it is under puppet management.
c
csharpsteen
01/10/2023, 6:00 PMIs that basic hardening done via a Forge module? If so, that's something we could try applying to a test node to see if it results in segfaults.
e
Eric Rostetter
01/10/2023, 8:24 PMWe do some additional hardening, but most of it is done by the forge module os_hardening (like I say, along with some custom stuff).
Eric Rostetter
01/10/2023, 8:26 PMos_hardening covers the majority though (>90% probably)
c
csharpsteen
01/10/2023, 9:08 PM👍 I'll give
os_hardeningcsharpsteen
01/10/2023, 9:08 PMOh, which Git Server are you using?
e
Eric Rostetter
01/10/2023, 9:13 PMIt is a local machine, running stock RHEL 7 with stock openssh 7.4p1-22.el7_9.x86_64. We do have the account set to use /usr/bin/git-shell as the shell. Using public key auth obviously with the type of key mentioned previously.
Eric Rostetter
01/10/2023, 9:14 PMBoth the puppet server and the git server both have the os_hardening module applied.
3 Views