Originally posted by: vapa

Hi all,

I have a AIX box, 5200-10-02-0730, when try to install openssh, have the next error
RSA key generation failed
instal: Failed while executing the ./openssh.base.server.post_i script.
0503-464 installp: The installation has FAILED for the "root" part
of the following filesets:
openssh.base.server 4.7.0.5200

installp: Cleaning up software for:openssh.base.server 4.7.0.5200
/etc/ssh > lslpp -L openssh*
Fileset Level State Type Description (Uninstaller)

---

openssh.base.client 4.7.0.5200 C F Open Secure Shell Commands
openssh.base.server 4.7.0.5200 ? F Open Secure Shell Server
openssh.license 4.7.0.5200 C F Open Secure Shell License
openssh.man.en_US 4.7.0.5200 C F Open Secure Shell
Documentation - U.S. English
openssh.msg.en_US 4.7.0.5200 C F Open Secure Shell Messages -
U.S. English
State codes:
A -- Applied.
B -- Broken.
C -- Committed.
E -- EFIX Locked.
O -- Obsolete. (partially migrated to newer version)
? -- Inconsistent State...Run lppchk -v.

Type codes:
F -- Installp Fileset
P -- Product
C -- Component
T -- Feature
R -- RPM Package
/etc/ssh >

Originally posted by: SystemAdmin

Hi, I'm having this same issue on a 5200-04, then same issue again when updated to 5200-10.
I tried some 4.7 and 5.0 ssh versions...

I already spent a week (machine not available all the time) trying out some advices from forums, nothing worked out yet.

Next, I'll try to re-create /dev/random and /dev/urandom.

I will keep you updated.

Cheers!

Originally posted by: unixgrl

You really haven't provided much for anyone to help with.
What exactly failed to execute?
What are the specific error messages? Did you run the install through smit so you
can see in the smit.log file what happened?
Have you checked whether those ssh versions are even supported on 5.2?
Did you install the openssl pre-req?
You posted something about recreating /dev/random...what does that have to
do with this ssh issue?

Originally posted by: datta13

This is common issue in AIX 5.2, try this

#randomctl -l

#startsrc -s sshd

It should be working

regards,
Datha v Parsi

Originally posted by: datta13

The solution i have posted above is if you get a problem with PRNG not seeding,

Originally posted by: SystemAdmin

Hi,

As Other folk suggested ,Please check for prerequisites ,Like for openssh.base to install, you need to have openssl, Please make sure you install/select openssl package before you install openssl.

Originally posted by: SystemAdmin

Also Quick Note : openssl Version should be Compataible for Openssh version.

Originally posted by: SystemAdmin

Thanks everybody for your help!

The exact issue is : RSA key generation failed
instal: Failed while executing the ./openssh.base.server.post_i script.

0503-464 installp: The installation has FAILED for the "root" part
of the following filesets:
openssh.base.server 4.7.0.5200

This comes from "openSSH-4.7_aix52.tar.z"
More details here :
Yes, I do have openssl installed via smitty:

Installation Summary

---

Name Level Part Event Result

---

openssl.man.en_US 0.9.8.802 USR APPLY SUCCESS
openssl.license 0.9.8.802 USR APPLY SUCCESS
openssl.base 0.9.8.802 USR APPLY SUCCESS
openssl.base 0.9.8.802 ROOT APPLY SUCCESS

I also installed following rpm :

• openssl-0.9.6m-2.aix5.1.ppc.rpm
• zlib-1.2.3-4
• prngd

I checked if the random module was loaded :
genkex | grep rand
245ad00 96f0 /usr/lib/drivers/random

When trying # randomctl -l
I'm getting /dev/random is busy
starsrc -s sshd
system not on file (of course, it is not installed..)

Permissions on /dev/random and /dev/urandom look ok :
ls -l /dev | grep random
crw-r--r-- 1 root system ... /random
crw-r--r-- 1 root system ... /urandom

...

When I try # ssh-keygen, I'm getting :
Symbol resolution failed for /usr/lib/libcrypto.a(libcrypto.so.0.9.8) because
Symbol __fd_select (number 58) is not exported from dependant module /usr/lib/libc.a(shr.o).
Examine .loader section symbols with the 'dump -Tv' command

I did try dump -Tv /usr/lib/libc.a but this shows way too many info so I don't know what I'm looking for in this (there's no .loader file in the machine)

I really don't know what else I can do, help is really appreciated. thanks in advance.

Originally posted by: datta13

When trying # randomctl -l
I'm getting /dev/random is busy

if you get this use
just remove /dev/random and /dev/urandom and try again randomctl and startsrc

else need to reboot then run randomctl and startsrc

Originally posted by: SystemAdmin

I can get rid of this message by unloading the random driver :
randomctl -u (-u is the unload option)
rm /dev/random
rm /dev/urandom
randomctl -l

startsrc -s sshd
the sshd Subsystem is not on file.

I tried reloading the random driver before installing openssh.base.server again, but I'm still getting "RSA key generation failed..."
and cannot install the root part of openssh.base.server

Originally posted by: SystemAdmin

I was reading in some Other forum, It was suggested by IBM support to perform the following.

if you list the *random devices in /dev you will find that /dev/random and /dev/urandom are supposed to have unique major/minor numbers. In my case /dev/random had the same major/minor as /dev/rmt0 and /dev/urandom had the same as /dev/rmt0.1. I removed the /dev/random and /dev/urandom rebooted and when it came back up it re-created /dev/random and /dev/urandom with unique numbers and I was able to install the openssh.base.server and it came right up.

Hope this helps someone

Originally posted by: SystemAdmin

I am not aware about minor / major numbers of devices...
Anyway, I did :

• rm /dev/random /dev/urandom
• shutdown -Fr

Then tried to install again, same error.. RSA key generation failed

I hope your post can help somebody else, but that didn't do it for me -_-

Originally posted by: datta13

I am sure RSA key generation is related to /dev/random and /dev/urandom, randomctl -l fixes this rsa keygeneration problems, I dont knnow why its not working with you, may e there is some other problem from what i taught, It worked for me last week, Once you fix the problem let us know the solution

Originally posted by: SystemAdmin

I need to leave the server until next Thursday.
I'll try to install some older versions of openssl and openssh then.

If I'm not done that day, I will leave it unresloved.
This server has dual boot and I won't be able to boot on the 5.2 bos for a while.

(ssh works like a charm on the 5.3 bos)

I'll keep you updated.

thanks again!

Originally posted by: SystemAdmin

Vapa,

Did you finally get openSSH installed?

I got another piece of advice from an IBM support guy.
Try installing openssh version 4.1 instead of a recent version.

I will try out when I got the chance to reboot my server on the drive containing Axi 5.2.. the server is unavailable for now.

I'll keep this thread updated,
Cheers!