1.6 upgrade: /etc/exports overwritten, captures stuck in /images/dev (SSH on non-standard port)

[Fog_Newb]

The upgrade itself went smoothly, but two things broke afterward.

1. The Kubuntu menu entry lost its NFS export. My Kubuntu entry boots the live ISO over NFS: the ISO is extracted to /srv/kubuntu, the kernel and initrd are served over HTTP, and the kernel line uses boot=casper netboot=nfs nfsroot=[fog server IP] :/srv/kubuntu. That needs its own line in /etc/exports:

/srv/kubuntu *(ro,sync,no_subtree_check,insecure,fsid=2)

The 1.6 installer rewrote /etc/exports (it saved my original as /etc/exports.<timestamp>) and kept only the /images and /images/dev exports, so the Kubuntu entry broke. Re-adding the line and running exportfs -ra fixed it. The menu entry itself carried over fine.

It would be nice if the installer preserved non-FOG lines in /etc/exports instead of replacing the file. Anyone else serving extra NFS shares from their FOG box will hit this on every update.

2. Captures stuck in /images/dev. After the upgrade, captures finished but never moved out of /images/dev/<MAC>. The Apache error log showed:

ssh2_connect(): Unable to connect to [fog server IP] on port 22

1.6 now does the post-capture move over SSH, and my sshd runs on a non-standard port with key-only auth. Two fixes were needed:

FOGSSH.php reads a FOG_SSH_PORT setting, but it didn’t exist in my database, so I (Claude) inserted it:

sql

INSERT INTO globalSettings (settingKey, settingDesc, settingValue, settingCategory)
VALUES ('FOG_SSH_PORT', 'SSH port FOG uses to reach storage nodes', 'custom port of ssh server', 'General Settings');

FOG only authenticates with a password (auth_password), so I allowed password logins for the service account from the server itself only:

Match User fogproject Address [fog server IP],127.0.0.1
    PasswordAuthentication yes

Suggestions: expose FOG_SSH_PORT in FOG Settings by default, have the installer detect sshd’s port, and mention the SSH requirement in the upgrade notes, since FTP alone isn’t enough anymore.

Question: is SSH key authentication on the roadmap for FOG’s storage node connections? Right now FOGSSH.php only uses auth_password, so I had to carve out a password-login exception for fogproject on a box that’s otherwise key-only. Supporting ssh2_auth_pubkey_file, with a key pair the installer generates for the service account, would let servers keep password authentication disabled entirely. Is that possible today through a setting I’m missing, or would it need a code change?

Thanks

[Tom Elliott]

@Fog_Newb Thanks for the detailed write-up. Taking them in order:

1. /etc/exports. This is long-standing installer behavior: it rebuilds the file and keeps the old one as /etc/exports.<timestamp>. To keep your own exports, run the installer once with -E (--no-exportbuild). That writes STORAGE_rebuild_nfs_exports='no' to /opt/fog/.fogsettings, and later updates leave the file alone. If you do that, you maintain the /images and /images/dev lines yourself.

2. FOG_SSH_PORT missing. That is a bug, and your diagnosis is right. A 1.5 database arrives at a schema step count past the 1.6 step that creates FOG_SSH_PORT, so an upgraded server never gets the row. Six other settings had the same problem. The fix is https://github.com/FOGProject/fogproject/pull/2057: the updater now adds any of those rows that are missing. Your hand-inserted row is fine and stays as it is. Once the fix is in, the setting shows under FOG Settings > General Settings. Note that it is one port for every node FOG connects to.

You are also right that 1.6 moves the finished capture over SSH, where 1.5 used FTP. So the storage node user needs working SSH from the FOG server.

3. Key authentication. Not today. FOGSSH only does password auth, and no setting changes that. Your Match User fogproject Address ... block is the right way to keep the rest of the box key-only in the meantime. Key-based auth would need a code change.

[Fog_Newb]

@Tom-Elliott Thanks Tom! Glad the SSH_PORT report turned up the other six settings too.

For the exports, I went a different route that keeps FOG managing its own lines: NFS also reads /etc/exports.d/*.exports, so I put the Kubuntu export in /etc/exports.d/kubuntu.exports. The installer rebuilds /etc/exports but never touches that folder. I’ll confirm it survives the next update.