From d2bc0b42aabda32084f4203bd569c1f8933d51d9 Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Wed, 22 Jun 2022 17:36:22 +0200 Subject: [PATCH] init-runonce: Migrate to ECDSA keys OpenSSH 8.8 has dropped support for RSA SHA-1 keys. ECDSA is FIPS approved, so probably it's a better direction than just changing to SHA-256. Change-Id: Id06d9d8912d9677dbe0f5a666f43a209664c94b4 --- tools/init-runonce | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/init-runonce b/tools/init-runonce index f8d7b1c179..9e4b5b2b71 100755 --- a/tools/init-runonce +++ b/tools/init-runonce @@ -109,13 +109,13 @@ $KOLLA_OPENSTACK_COMMAND security group rule create --ingress --ethertype IPv4 \ $KOLLA_OPENSTACK_COMMAND security group rule create --ingress --ethertype IPv4 \ --protocol tcp --dst-port 8080 ${ADMIN_SEC_GROUP} -if [ ! -f ~/.ssh/id_rsa.pub ]; then +if [ ! -f ~/.ssh/id_ecdsa.pub ]; then echo Generating ssh key. - ssh-keygen -t rsa -N '' -f ~/.ssh/id_rsa + ssh-keygen -t ecdsa -N '' -f ~/.ssh/id_ecdsa fi -if [ -r ~/.ssh/id_rsa.pub ]; then +if [ -r ~/.ssh/id_ecdsa.pub ]; then echo Configuring nova public key and quotas. - $KOLLA_OPENSTACK_COMMAND keypair create --public-key ~/.ssh/id_rsa.pub mykey + $KOLLA_OPENSTACK_COMMAND keypair create --public-key ~/.ssh/id_ecdsa.pub mykey fi # Increase the quota to allow 40 m1.small instances to be created