Project

General

Profile

Actions
Copy link

Bug #1869

closed

openssh update key problems

Added by alexh over 13 years ago. Updated over 13 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:

Description

It seems that now ssh doesn't work with my .ssh/id_rsa file, yet it works just
fine with the .ssh/identity. Since ssh defaults to using (it seems) the id_rsa
file, I couldn't login without -i anymore.

11:38 : alexh@: # ssh
11:38 : alexh@: Permission denied (publickey,keyboard-interactive).

11:41 : alexh@: 9:02:57 dragon:~
11:41 : alexh@: 1 # cmp .ssh/identity .ssh/id_rsa
11:41 : alexh@: 9:03:01 dragon:~
11:41 : alexh@: #
11:41 : alexh@: yet ssh i .ssh/id_rsa doesn't work
-11:41 : alexh@: but ssh -i .ssh/identity does

Actions
Copy link
 #1

Updated by alexh over 13 years ago

I don't know what went wrong with the update but it's really annoying, I
basically can't commit anymore.

It doesn't help having only the identity file or only the id_rsa file in ~/.ssh.
I really need to manually do ssh -i ~/.ssh/identity and no idea how you can do
that with git.

Actions
Copy link
 #2

Updated by alexh over 13 years ago

And some debug:

255 # ssh vvv
OpenSSH_5.6p1-hpn13v10 DragonFly-20100928, OpenSSL 1.0.0a 1 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to leaf.dragonflybsd.org [216.240.41.26] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug3: Not a RSA1 key file /root/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /root/.ssh/id_rsa type 1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6p1
hpn13v10 DragonFly-20100928
debug1: match: OpenSSH_5.6p1-hpn13v10 DragonFly-20100928 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6p1-hpn13v10 DragonFly-20100928
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-
group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ,ssh-dss-cert-
,,,ssh-
rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,,zlib
debug2: kex_parse_kexinit: none,,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-
group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,
debug2: kex_parse_kexinit: none,
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 113/256
debug2: bits set: 516/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: host leaf.dragonflybsd.org filename
/root/.ssh/known_hosts
debug3: check_host_in_hostfile: host leaf.dragonflybsd.org filename
/root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 2
debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:2
debug2: bits set: 490/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/id_rsa (0x28400070)
debug2: key: /root/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /root/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: userauth_kbdint: disable: no info_req_seen
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.

Actions
Copy link
 #3

Updated by qhwt.dfly over 13 years ago

Alex Hornung <> added the comment:

I don't know what went wrong with the update but it's really annoying, I
basically can't commit anymore.

Are you using an RSA identity created for SSH protocol version 1?
The recent upgrade has changed something in readconf.c near a line containing

if (options->protocol == SSH_PROTO_UNKNOWN)

which might affect you.

It doesn't help having only the identity file or only the id_rsa file in ~/.ssh.
I really need to manually do ssh -i ~/.ssh/identity and no idea how you can do
that with git.

You can have an entry like this in your ~/.ssh/config:

Host leaf.dragonflybsd.org
IdentityFile ~/.ssh/identity

Cheers.

Actions
Copy link
 #4

Updated by alexh over 13 years ago

For whatever it's worth, this doesn't happen on my laptop with exactly the same
key. Everything works fine there.

Actions
Copy link
 #5

Updated by qhwt.dfly over 13 years ago

For whatever it's worth, this doesn't happen on my laptop with exactly the same
key. Everything works fine there.

With exactly the same /etc/ssh/ssh_config and the identical ~/.ssh/config
(other than the comment lines)?

Actions
Copy link
 #6

Updated by alexh over 13 years ago

Yes, the config files are exactly the same (see below; user-specific config
doesn't exist). Something went wrong, but since I can't pinpoint it and nobody
else seems to experience it I guess we can forget about this one... I worked
around on that machine using the hint of specifying an IdentityFile in
~/.ssh/config.

Actions
Copy link
 #7

Updated by alexh over 13 years ago

On 15/10/10 01:35, YONETANI Tomokazu wrote:

For whatever it's worth, this doesn't happen on my laptop with exactly the same
key. Everything works fine there.

With exactly the same /etc/ssh/ssh_config and the identical ~/.ssh/config
(other than the comment lines)?

Yes, the config files are exactly the same (see below; user-specific
config doesn't exist). Something went wrong, but since I can't pinpoint
it and nobody else seems to experience it I guess we can forget about
this one... I worked around on that machine using the hint of specifying
an IdentityFile in ~/.ssh/config.

  1. diff Naurw /usr/src/crypto/openssh/ssh_config /etc/ssh/ssh_config
    --     /usr/src/crypto/openssh/ssh_config 2010-09-30 06:23:10 0100
    ++ /etc/ssh/ssh_config 2009-12-04 08:08:16 0000
    @ -1,4 +1,5 @
    -# $OpenBSD: ssh_config,v 1.26 2010/01/11 01:39:46 dtucker Exp $
    # $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $
    +# $DragonFly: src/crypto/openssh-5/ssh_config,v 1.3 2008/09/28
    03:19:46 pavalos Exp $
    1. This is the ssh client system-wide configuration file. See
    2. ssh_config(5) for more information. This file provides defaults for
      @ -47,4 +48,3 @
    3. TunnelDevice any:any
    4. PermitLocalCommand no
    5. VisualHostKey no
      -# ProxyCommand ssh -q -W %h:%p gateway.example.com
Actions
Copy link
 #8

Updated by alexh over 13 years ago

A diff between the non-working verbose output and the working one: (root
user doesn't work, 'alex' user works, same machine). FWIW on the laptop
both root and 'alex' work just fine.

Pay special attention to the debug2: key: foo/id_rsa (N) and then
'Offering RSA public key' vs 'Trying private key'.

debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
-debug1: Found key in /root/.ssh/known_hosts:2
-debug2: bits set: 495/1024
+debug1: Found key in /home/alex/.ssh/known_hosts:1
+debug2: bits set: 507/1024
 debug1: ssh_rsa_verify: signature correct
 debug2: kex_derive_keys
 debug2: set_newkeys: mode 1
@ -99,8 +98,8 @
 debug1: SSH2_MSG_SERVICE_REQUEST sent
 debug2: service_accept: ssh-userauth
 debug1: SSH2_MSG_SERVICE_ACCEPT received
-debug2: key: /root/.ssh/id_rsa (0x28400070)
-debug2: key: /root/.ssh/id_dsa (0x0)
+debug2: key: /home/alex/.ssh/id_rsa (0x0)
+debug2: key: /home/alex/.ssh/id_dsa (0x0)
 debug1: Authentications that can continue: publickey,keyboard-interactive
 debug3: start over, passed a different list publickey,keyboard-interactive
 debug3: preferred publickey,keyboard-interactive,password
@ -108,21 +107,109 @
 debug3: remaining preferred: keyboard-interactive,password
 debug3: authmethod_is_enabled publickey
 debug1: Next authentication method: publickey
-debug1: Offering RSA public key: /root/.ssh/id_rsa
-debug3: send_pubkey_test
+debug1: Trying private key: /home/alex/.ssh/id_rsa
+debug1: read PEM private key done: type RSA
+debug3: sign_and_send_pubkey: RSA
3b:83:6e:15:d1:89:cd:d3:9b:0a:eb:87:56:c5:ac:e1
 debug2: we sent a publickey packet, wait for reply
Actions
Copy link
 #9

Updated by alexh over 13 years ago

And here comes the resolution. Seems that having an id_rsa.pub file in
~/.ssh makes stuff not work properly.

10:06:22 dragon:~
1 # ls .ssh
id_rsa id_rsa.pub identity known_hosts
10:16:59 dragon:~
  1. mv .ssh/id_rsa.pub .
    10:17:05 dragon:~
  2. ssh
    Last login: Sat Oct 16 03:46:30 2010 from 87-194-42-220.b
    Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994

On 16/10/10 11:51, Alex Hornung wrote:

A diff between the non-working verbose output and the working one: (root
user doesn't work, 'alex' user works, same machine). FWIW on the laptop
both root and 'alex' work just fine.

Pay special attention to the debug2: key: foo/id_rsa (N) and then
'Offering RSA public key' vs 'Trying private key'.

debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
-debug1: Found key in /root/.ssh/known_hosts:2
-debug2: bits set: 495/1024
+debug1: Found key in /home/alex/.ssh/known_hosts:1
+debug2: bits set: 507/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
@ -99,8 +98,8 @
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
-debug2: key: /root/.ssh/id_rsa (0x28400070)
-debug2: key: /root/.ssh/id_dsa (0x0)
+debug2: key: /home/alex/.ssh/id_rsa (0x0)
+debug2: key: /home/alex/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
@ -108,21 +107,109 @
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
-debug1: Offering RSA public key: /root/.ssh/id_rsa
-debug3: send_pubkey_test
+debug1: Trying private key: /home/alex/.ssh/id_rsa
+debug1: read PEM private key done: type RSA
+debug3: sign_and_send_pubkey: RSA
3b:83:6e:15:d1:89:cd:d3:9b:0a:eb:87:56:c5:ac:e1
debug2: we sent a publickey packet, wait for reply

Actions
Copy link
 #10

Updated by peter over 13 years ago

On Sat, Oct 16, 2010 at 11:59:53AM +0100, Alex Hornung wrote:

And here comes the resolution. Seems that having an id_rsa.pub file in
~/.ssh makes stuff not work properly.

I have a id_rsa.pub in ~/.ssh/ and things work fine.

--Peter

Actions
Copy link
 #11

Updated by dillon over 13 years ago

Hmm. Also check your /etc/ssh/sshd_config, maybe there is an issue
in there.

-Matt
                    Matthew Dillon 
                    &lt;&gt;
Actions
Copy link
 #12

Updated by alexh over 13 years ago

Seems the public key didn't match the private key for some reason and previous
openssh versions always generated a public key directly from the private key for
authentication.

In any case this isn't really a bug as far as I can tell, so I'm closing it.

Thanks to Peter for checking all sorts of things to get this working for me
again.

Cheers,
Alex

Actions
Copy link

Also available in: Atom PDF