From Mageia wiki
Jump to: navigation, search
(If you're running KDE4)
m (Adding multi language banner to create the french page)
Line 1: Line 1:
 +
{{multi language banner|[[Packagers_ssh|English]] ; [[Empaqueteur_ssh-fr|Français]] ; }}
 +
 
= Introduction =
 
= Introduction =
  

Revision as of 10:33, 27 May 2018


Drakconf multiflag.png
Other languages
English ; Français ;

Introduction

After you acquire a maintainer's account in Mageia, you will obviously need the rights to commit to SVN and submit packages to the Build System (at first you won't be able to submit packages until your training period is over and your mentor agrees to giving you a full maintainer's account status); this can be done using the SSH network protocol. This wiki article should help you with the basic setup of SSH.

Creating an SSH key

First of all you will need to create an RSA SSH authentication key:

Install the openssh package if it is not already installed.

Run the ssh-keygen command. Executing ssh-keygen will generate two files (by default):

  • ~/.ssh/id_rsa, which contains the protocol version 2 RSA authentication identity of the user
  • ~/.ssh/id_rsa.pub, which contains the protocol version 2 RSA public key for authentication.

When generating an ssh key you will be asked if you want to use a passphrase, this is very much recommended. Be aware that there is no way to recover a lost passphrase, so make sure to select one that is both strong and easily remembered by you.

The ~/.ssh/id_rsa file must not be readable for other users, as it will be ignored by ssh-agent if this condition isn't satisfied.

For more information check the man page of ssh-keygen.

Uploading your SSH key

Please ensure your account has apprentice level.

You need to upload your public SSH key to the mageia server before you are allowed to connect to the SVN. This is done through https://identity.mageia.org/.

To do that, when connected with your account on https://identity.mageia.org/, add the attribute sshPublicKey with the content of your public key (content of the file ~/.ssh/id_rsa.pub or ~/.ssh/id_dsa.pub).

Once your SSH key has been added, it can take up to ten minutes for the key to be active on the server.

To check that your ssh key has been correctly uploaded, try to connect with ssh to svn.mageia.org

 $ ssh login@svn.mageia.org :

where login is your login.

If your ssh key is accepted, you should have the following message (possibly after typing your ssh key pass phrase) :

 Sorry, you are not allowed to execute that command

This means that your ssh key was correctly uploaded to the server. If not, SSH will request a password instead of displaying this message.

Note that if you don't have a passphrase, a password will be requested, even if the ssh key was correctly loaded. In this case, you can use the test below to see if you have access.

SSH Agent

If your SSH key is protected with a pass phrase, you will need to type this pass phrase each time the key is used. This will quickly become annoying as the key is used more than once for each commit or svn operation. To avoid this, it is recommended to use an ssh agent. It is a programme to hold private keys used for public key authentication. It should be started at login, see below.

If you're running GNOME

In GNOME ssh keys are handled by gnome-keyring, which is installed by default and and running by default when GNOME is up.

If you're running KDE4

The easiest way is to follow these steps:

  • install the keychain package
  • excute this command in a terminal keychain: this will create the ~/.keychain directory in your own home directory and start an ssh-agent process
  • Open a terminal emulator (e.g. konsole): you will be asked for your ssh key passphrase. You will only need to enter the passphrase once, because after the first time your ssh key will be added to the running ssh-agent. This will survive a log out -> log in, but not a reboot.

Note that, if you have multiple SSH keys on your computer, keychain only loads $HOME/.ssh/id_rsa. If you need to load multiple keys, you can define the environment variable KEYCHAIN_KEYS in HOME/.keychain/config listing your keys, separated by a space. For instance :

KEYCHAIN_KEYS="$HOME/.ssh/id_ed25519 $HOME/.ssh/id_rsa"

The keys will be loaded in order.

Basic method

If you do not want to use any of the tools above, you can use ssh-agent:

  • First to start an ssh-agent process at login, you can add one of the following lines:
eval $(ssh-agent)
ssh-agent /bin/bash

to ~/.xinitrc.

  • Next you will need to add your ssh key to the running ssh-agent by executing ssh-add ~/.ssh/id_rsa

Editing ~/.ssh/config and SSH agent forwarding

To complete the process, you need to edit ~/.ssh/config on your local machine with any text editor (create it if it doesn't exist, but it should be there: see above) and add the following lines to it:

Host *.mageia.org 
      ForwardAgent yes
      User username

then save the file.

username is the exact user name you created in Mageia Identity (see above). Note that this is mandatory only if the user name on your local machine is different than the one in SVN, if it is the same you do not strictly need to add the User line.

ForwardAgent yes will enable SSH agent forwarding, from the ssh_config man page:

“Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.”


That's it: now you can checkout packages from the Mageia SVN repo using mgarepo (the Mageia tool for checking out and submitting packages). Note that you can't submit packages until your mentor clears your account to be a full maintainer's account.

Checking that everything is working

Try the following command to check that you can access the svn repository through ssh :

 $ svn ls svn+ssh://svn.mageia.org/svn/packages

The output should be the list of directories at the root of the packages svn repository.

Return to the Packagers portal