ANNOUNCEMENT of replacement of login2, current host of login.ibiblio.org

Outage
1

[EDIT: primary work on this migration is done. The new host is up and available. See below for details.]
[EDIT: changed date from Monday 22 to Wednesday 24]

WHAT:

Login2, the host currently powering login.ibiblio.org, will be replaced by a more modern host, also at login.ibiblio.org.

WHEN:

The change from old login.ibiblio.org to new login.ibiblio.org will happen on the morning of Wednesday the 24th of July, 2024. There will be an outage of at least one hour, and after the outage, both SSH and SFTP will be available as before, but some other tools will only be available through other resources.

WHY:

The operating system powering Login2 is reaching end-of-life, and as we prepared to replace it, we decided to alter the architecture to better support multiple PHP versions.

IMPACT:

  • If you currently use login.ibiblio.org only for copying or editing files for your website, no change to your work process should be needed.
  • If you need to run PHP to perform website updates (such as running WordPress CLI commands), you will need to use new systems to be announced. Separate announcements will be made about the transition to these systems with enough time for contributors to change their workflows.
  • Your SSH client(s) will need to accept new Host keys, since you will be connecting to a new host. These host key fingerprints are below.
256 SHA256:3MDPxxnNomzzJoFepWXIgOQW8cJ6JtNjHlcPc37Bm0Y root@login1.ibiblio.org (ECDSA)
+---[ECDSA 256]---+
|     .+o.        |
|     o.+ o . +   |
|      = + * B E  |
|     + o O & = + |
|    + B S % * =  |
|     B = o = o   |
|      . . . o    |
|           o     |
|                 |
+----[SHA256]-----+
256 SHA256:eeCCfFCNMBVc9GzX3JBCKa3DFXJ0KTLXso5BO1OmEWE root@login1.ibiblio.org (ED25519)
+--[ED25519 256]--+
|    o++*o E*=+oo |
|     oo .+*o@++o |
|    .   .o+&.=o .|
|   . o . +X..    |
|    o o S .B     |
|     . . .. .    |
|                 |
|                 |
|                 |
+----[SHA256]-----+
3072 SHA256:qWphlf31TBm963vCjhCLVseHzvWYpW5Uf6bzZyJ0S7U root@login1.ibiblio.org (RSA)
+---[RSA 3072]----+
|               . |
|              . .|
|       o       o.|
|      o .. ...o.o|
|     .  S.o.++oo=|
|    o  . o.*.o*E+|
|   . .. o o.o==+o|
|    .. .   ..oO.+|
|   ..       .+oB=|
+----[SHA256]-----+
5

After this outage and migration, when connecting to the name login.ibiblio.org you may see a warning like this one:

$ ssh login.ibiblio.org
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for login.ibiblio.org has changed,
and the key for the corresponding IP address 2606:f640:6000:322:0:bad:cafe:2
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:qWphlf31TBm963vCjhCLVseHzvWYpW5Uf6bzZyJ0S7U.
Please contact your system administrator.
Add correct host key in /home/janedoe/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/janedoe/.ssh/known_hosts:92
RSA host key for login.ibiblio.org has changed and you have requested strict checking.
Host key verification failed.

This is expected, since the host key fingerprints are in fact different. You can delete the old fingerprints from your local machine (if you’re using the command line SSH client) like so:

$ ssh-keygen -R login.ibiblio.org
# Host login.ibiblio.org found: line 92
/home/janedoe/.ssh/known_hosts updated.
Original contents retained as /home/janedoe/.ssh/known_hosts.old

Having done that, you will want to review the new fingerprints and compare them to the fingerprints in the announcement above. Only one fingerprint (the one for the connection method your client uses) needs to match.

When connecting again after deleting the old fingerprint, you will see something like this:

$ ssh login.ibiblio.org
The authenticity of host 'login.ibiblio.org (2606:f640:6000:322:0:bad:cafe:2)' can't be established.
ECDSA key fingerprint is SHA256:3MDPxxnNomzzJoFepWXIgOQW8cJ6JtNjHlcPc37Bm0Y.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Note that in my case here I only see the ECDSA fingerprint because my client negotiated to use that, but the host has other options:

$ ssh-keyscan login.ibiblio.org
# login.ibiblio.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u3
login.ibiblio.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDKzqtMgKVVCyYnlQHrB3L8utOTcLN6gGmDfBRwi/fZJBalVtGaAElB/a7V0+6BJ4dnQIFTD0fJVaUXNzYnQvmH/br+QOVpW9YUeZc716uRYaGO2OGZH/VPtpAygO0ERiWa/huQXwIg/qGeMHAv/R97chqGxbDirsWpRFsn1HTtmLNq6qmTLEamhQsPZB0Lt7ZgFmfUWUfAEq1bOxiucoEFYjeW7tcJwGROKfEAoMX9EAC/gBZaPKPAyTbU6sv22wYcCh2E6HFKW4NLpHWhDUrNnmFftTNhFcWj+By9fENTx+nHX8KJATJnkjc/cfu6YLtM+rUzoorranUZIJ1CK8pyeaupWtTvO4tt/8hs6E7ZE+1TO8hv7Unj5WuSVN/a32kDbqntITDvd6MPr7bro7PEtRu9xxQROQXXHFjf8iGT+dAAyu3g35sxeTjM3rawhTJk9SLaJrcjVaIEVhdBfbNOf6gQrXGkNz2iCEHe9k69dk16J/t808sWDWYDpgvLNCE=
# login.ibiblio.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u3
login.ibiblio.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEW6pfexT6+aMIWXrK8itrhsZI61n8rHb6ljR8+s7kyCBTbT9/rUmKop+mHAOhcHQRGCbAsNX4R3xetmhhDrydA=
# login.ibiblio.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u3
login.ibiblio.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeGJPLlss1ah0AI5bP4Iax10Rjvmk242sUfZAR2uuxM

If you like abstract word art that may be a little easier to compare, you can can connect with an extra option:

$ ssh -o "VisualHostKey=yes" login.ibiblio.org
The authenticity of host 'login.ibiblio.org (2606:f640:6000:322:0:bad:cafe:2)' can't be established.
ECDSA key fingerprint is SHA256:3MDPxxnNomzzJoFepWXIgOQW8cJ6JtNjHlcPc37Bm0Y.
+---[ECDSA 256]---+
|     .+o.        |
|     o.+ o . +   |
|      = + * B E  |
|     + o O & = + |
|    + B S % * =  |
|     B = o = o   |
|      . . . o    |
|           o     |
|                 |
+----[SHA256]-----+
Are you sure you want to continue connecting (yes/no/[fingerprint])?
6

Some of you may need to regenerate your SSH keys if you use key-based login, because old key formats are no longer accepted.

If you previously have logged in with an old key format such as ssh-dss and now it does not work, this will present itself as you getting to a password prompt rather than a login shell.

7

Primary work on this outage and migration is done. Please read this post from the top before reaching out to us with any lingering issues.