ReleaseEngineering/How To/Adjust SSH keys on a slave

NOTE: THIS PAGE ONLY APPLIES FOR WINDOWS (Bug 792836 - Manage slave secrets with puppet)

There are three sets of keys that are important: staging, production and try.

In general, copy SSH keys from a similarly-configured slave. You will need to use -oBatchMode=no in your ssh invocation to avoid host-key failures. Note that only the private keys (*_dsa) are required, not the public keys (*_dsa.pub) (however, if you have the ".pub", it must match with the private or the key will silently fail). Also note that the staging and production keys have the same filename. The current production ffxbld_dsa has md5 beginning with '166b900'; staging's begins with '86bcf286'.

Staging

Windows steps:

rmdir /S /Q .ssh
mkdir .ssh
cd .ssh
C:\mozilla-build\msys\bin\scp cltbld@linux-ix-slave03:~/.ssh/* .
set HOME=C:\Users\cltbld

To test that we're good:

ssh -i ~/.ssh/ffxbld_dsa    ffxbld@dev-stage01.srv.releng.scl3.mozilla.com exit
ssh -i ~/.ssh/xrbld_dsa     xrbld@dev-stage01.srv.releng.scl3.mozilla.com exit
ssh -i ~/.ssh/tbirdbld_dsa  tbirdbld@dev-stage01.srv.releng.scl3.mozilla.com exit
ssh -i ~/.ssh/b2gbld_dsa    b2gbld@dev-stage01.srv.releng.scl3.mozilla.com exit
ssh -i ~/.ssh/trybld_dsa    trybld@dev-stage01.srv.releng.scl3.mozilla.com exit

These should be set up but aren't, but then we don't have good staging for mozharness.

ssh -i ~/.ssh/b2gtry_dsa    b2gtry@dev-stage01.srv.releng.scl3.mozilla.com exit
ssh -i ~/.ssh/b2gbld_dsa    ffxbld@dev-stage01.srv.releng.scl3.mozilla.com exit

Production

NOTE: Make sure that the host you try to grab keys from is on the same data-center.

Steps for Windows:

rm -rf .ssh
"C:\mozilla-build\msys\bin\scp" -o 'StrictHostKeyChecking no' -o 'BatchMode=no' -r  cltbld@b-linux64-ix-0001.build.mozilla.org:~/.ssh .ssh

if scp does not working properly coping files from windows to windows hosts, use sftp instead:

rm -rf .ssh
sftp b-2008-ix-0083.winbuild.releng.scl3.mozilla.com:.ssh/* .ssh/

To test that a production master slave is set up properly, you must be able to run the following commands:

ssh -i ~/.ssh/ffxbld_dsa    ffxbld@symbolpush.mozilla.org exit
ssh -i ~/.ssh/tbirdbld_dsa  tbirdbld@symbolpush.mozilla.org exit
ssh -i ~/.ssh/ffxbld_dsa    ffxbld@stage.mozilla.org exit
ssh -i ~/.ssh/tbirdbld_dsa  tbirdbld@stage.mozilla.org exit
ssh -i ~/.ssh/xrbld_dsa     xrbld@stage.mozilla.org exit
ssh -i ~/.ssh/b2gbld_dsa    b2gbld@stage.mozilla.org exit
ssh -i ~/.ssh/ffxbld_dsa    b2gbld@stage.mozilla.org exit
ssh -i ~/.ssh/b2gbld_dsa    b2gbld@pvtbuilds.pvt.build.mozilla.org exit
ssh -i ~/.ssh/b2gbld_dsa    b2gbld@pvtbuilds2.dmz.scl3.mozilla.com exit

Try

Try builders use different keys!

You must wipe any ssh keys that are not trybld from a newly imaged slave, and copy in the trybld keys from another try builder (staging trybld keys are on the staging slaves).

To test that a try slave is set up properly, you must be able to run the following commands without needing to answer any questions:

ssh -i ~/.ssh/trybld_dsa trybld@stage.mozilla.org hostname
ssh -i ~/.ssh/b2gtry_dsa b2gtry@pvtbuilds.pvt.build.mozilla.org hostname
ssh -i ~/.ssh/b2gtry_dsa b2gtry@pvtbuilds2.dmz.scl3.mozilla.com hostname

Steps for Windows (from SSH):

rm -rf .ssh
mkdir .ssh
scp cltbld@b-linux64-hp-0001.build.mozilla.org:~/.ssh/* .ssh
# You will have to answer 'yes' and enter the cltbld password
ssh -i ~/.ssh/trybld_dsa trybld@stage.mozilla.org hostname
ssh -i ~/.ssh/b2gtry_dsa b2gtry@pvtbuilds.pvt.build.mozilla.org hostname
ssh -i ~/.ssh/b2gtry_dsa b2gtry@pvtbuilds2.dmz.scl3.mozilla.com hostname
rm -rf /c/builds/moz2_slave

For seamicro instances, use sftp instead

rm -rf .ssh
mkdir .ssh
sftp b-2008-ix-0178.wintry.releng.scl3.mozilla.com:.ssh/* .ssh/
# You will have to answer 'yes' and enter the cltbld password
ssh -i ~/.ssh/trybld_dsa trybld@stage.mozilla.org hostname
ssh -i ~/.ssh/b2gtry_dsa b2gtry@pvtbuilds.pvt.build.mozilla.org hostname
ssh -i ~/.ssh/b2gtry_dsa b2gtry@pvtbuilds2.dmz.scl3.mozilla.com hostname
rm -rf /c/builds/moz2_slave