Bug #1869

openssh update key problems

Added by alexh almost 4 years ago. Updated almost 4 years ago.

Status:ClosedStart date:
Priority:NormalDue date:
Assignee:-% Done:

0%

Category:-
Target version:-

Description

It seems that now ssh doesn't work with my .ssh/id_rsa file, yet it works just
fine with the .ssh/identity. Since ssh defaults to using (it seems) the id_rsa
file, I couldn't login without -i anymore.

-11:38- : alexh@: # ssh
-11:38- : alexh@: Permission denied (publickey,keyboard-interactive).

-11:41- : alexh@: 9:02:57 dragon:~
-11:41- : alexh@: 1 # cmp .ssh/identity .ssh/id_rsa
-11:41- : alexh@: 9:03:01 dragon:~
-11:41- : alexh@: #
-11:41- : alexh@: yet ssh -i .ssh/id_rsa doesn't work
-11:41- : alexh@: but ssh -i .ssh/identity does

History

#1 Updated by alexh almost 4 years ago

I don't know what went wrong with the update but it's really annoying, I
basically can't commit anymore.

It doesn't help having only the identity file or only the id_rsa file in ~/.ssh.
I really need to manually do ssh -i ~/.ssh/identity and no idea how you can do
that with git.

#2 Updated by alexh almost 4 years ago

And some debug:

255 # ssh -vvv
OpenSSH_5.6p1-hpn13v10 DragonFly-20100928, OpenSSL 1.0.0a 1 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to leaf.dragonflybsd.org [216.240.41.26] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug3: Not a RSA1 key file /root/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /root/.ssh/id_rsa type 1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6p1-
hpn13v10 DragonFly-20100928
debug1: match: OpenSSH_5.6p1-hpn13v10 DragonFly-20100928 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6p1-hpn13v10 DragonFly-20100928
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-
group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ,ssh-dss-cert-
,,,ssh-
rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,,zlib
debug2: kex_parse_kexinit: none,,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-
group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,,hmac-
ripemd160,,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,
debug2: kex_parse_kexinit: none,
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 113/256
debug2: bits set: 516/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: host leaf.dragonflybsd.org filename
/root/.ssh/known_hosts
debug3: check_host_in_hostfile: host leaf.dragonflybsd.org filename
/root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 2
debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:2
debug2: bits set: 490/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/id_rsa (0x28400070)
debug2: key: /root/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /root/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: userauth_kbdint: disable: no info_req_seen
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.

#3 Updated by qhwt.dfly almost 4 years ago

> Alex Hornung <> added the comment:
>
> I don't know what went wrong with the update but it's really annoying, I
> basically can't commit anymore.

Are you using an RSA identity created for SSH protocol version 1?
The recent upgrade has changed something in readconf.c near a line containing

if (options->protocol == SSH_PROTO_UNKNOWN)

which might affect you.

> It doesn't help having only the identity file or only the id_rsa file in ~/.ssh.
> I really need to manually do ssh -i ~/.ssh/identity and no idea how you can do
> that with git.

You can have an entry like this in your ~/.ssh/config:

Host leaf.dragonflybsd.org
IdentityFile ~/.ssh/identity

Cheers.

#4 Updated by alexh almost 4 years ago

For whatever it's worth, this doesn't happen on my laptop with exactly the same
key. Everything works fine there.

#5 Updated by qhwt.dfly almost 4 years ago

> For whatever it's worth, this doesn't happen on my laptop with exactly the same
> key. Everything works fine there.

With exactly the same /etc/ssh/ssh_config and the identical ~/.ssh/config
(other than the comment lines)?

#6 Updated by alexh almost 4 years ago

Yes, the config files are exactly the same (see below; user-specific config
doesn't exist). Something went wrong, but since I can't pinpoint it and nobody
else seems to experience it I guess we can forget about this one... I worked
around on that machine using the hint of specifying an IdentityFile in
~/.ssh/config.

#7 Updated by alexh almost 4 years ago

On 15/10/10 01:35, YONETANI Tomokazu wrote:
>> For whatever it's worth, this doesn't happen on my laptop with exactly the same
>> key. Everything works fine there.
>
> With exactly the same /etc/ssh/ssh_config and the identical ~/.ssh/config
> (other than the comment lines)?

Yes, the config files are exactly the same (see below; user-specific
config doesn't exist). Something went wrong, but since I can't pinpoint
it and nobody else seems to experience it I guess we can forget about
this one... I worked around on that machine using the hint of specifying
an IdentityFile in ~/.ssh/config.

# diff -Naurw /usr/src/crypto/openssh/ssh_config /etc/ssh/ssh_config
--- /usr/src/crypto/openssh/ssh_config 2010-09-30 06:23:10 +0100
+++ /etc/ssh/ssh_config 2009-12-04 08:08:16 +0000
@@ -1,4 +1,5 @@
-# $OpenBSD: ssh_config,v 1.26 2010/01/11 01:39:46 dtucker Exp $
+# $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $
+# $DragonFly: src/crypto/openssh-5/ssh_config,v 1.3 2008/09/28
03:19:46 pavalos Exp $

# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
@@ -47,4 +48,3 @@
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
-# ProxyCommand ssh -q -W %h:%p gateway.example.com

#8 Updated by alexh almost 4 years ago

A diff between the non-working verbose output and the working one: (root
user doesn't work, 'alex' user works, same machine). FWIW on the laptop
both root and 'alex' work just fine.

Pay special attention to the debug2: key: foo/id_rsa (*N*) and then
'Offering RSA public key' vs 'Trying private key'.

debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
-debug1: Found key in /root/.ssh/known_hosts:2
-debug2: bits set: 495/1024
+debug1: Found key in /home/alex/.ssh/known_hosts:1
+debug2: bits set: 507/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
@@ -99,8 +98,8 @@
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
-debug2: key: /root/.ssh/id_rsa (0x28400070)
-debug2: key: /root/.ssh/id_dsa (0x0)
+debug2: key: /home/alex/.ssh/id_rsa (0x0)
+debug2: key: /home/alex/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
@@ -108,21 +107,109 @@
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
-debug1: Offering RSA public key: /root/.ssh/id_rsa
-debug3: send_pubkey_test
+debug1: Trying private key: /home/alex/.ssh/id_rsa
+debug1: read PEM private key done: type RSA
+debug3: sign_and_send_pubkey: RSA
3b:83:6e:15:d1:89:cd:d3:9b:0a:eb:87:56:c5:ac:e1
debug2: we sent a publickey packet, wait for reply

#9 Updated by alexh almost 4 years ago

And here comes the resolution. Seems that having an id_rsa.pub file in
~/.ssh makes stuff not work properly.

10:06:22 dragon:~
1 # ls .ssh
id_rsa id_rsa.pub identity known_hosts
10:16:59 dragon:~
# mv .ssh/id_rsa.pub .
10:17:05 dragon:~
# ssh
Last login: Sat Oct 16 03:46:30 2010 from 87-194-42-220.b
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994

On 16/10/10 11:51, Alex Hornung wrote:
> A diff between the non-working verbose output and the working one: (root
> user doesn't work, 'alex' user works, same machine). FWIW on the laptop
> both root and 'alex' work just fine.
>
> Pay special attention to the debug2: key: foo/id_rsa (*N*) and then
> 'Offering RSA public key' vs 'Trying private key'.
>
>
> debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
> -debug1: Found key in /root/.ssh/known_hosts:2
> -debug2: bits set: 495/1024
> +debug1: Found key in /home/alex/.ssh/known_hosts:1
> +debug2: bits set: 507/1024
> debug1: ssh_rsa_verify: signature correct
> debug2: kex_derive_keys
> debug2: set_newkeys: mode 1
> @@ -99,8 +98,8 @@
> debug1: SSH2_MSG_SERVICE_REQUEST sent
> debug2: service_accept: ssh-userauth
> debug1: SSH2_MSG_SERVICE_ACCEPT received
> -debug2: key: /root/.ssh/id_rsa (0x28400070)
> -debug2: key: /root/.ssh/id_dsa (0x0)
> +debug2: key: /home/alex/.ssh/id_rsa (0x0)
> +debug2: key: /home/alex/.ssh/id_dsa (0x0)
> debug1: Authentications that can continue: publickey,keyboard-interactive
> debug3: start over, passed a different list publickey,keyboard-interactive
> debug3: preferred publickey,keyboard-interactive,password
> @@ -108,21 +107,109 @@
> debug3: remaining preferred: keyboard-interactive,password
> debug3: authmethod_is_enabled publickey
> debug1: Next authentication method: publickey
> -debug1: Offering RSA public key: /root/.ssh/id_rsa
> -debug3: send_pubkey_test
> +debug1: Trying private key: /home/alex/.ssh/id_rsa
> +debug1: read PEM private key done: type RSA
> +debug3: sign_and_send_pubkey: RSA
> 3b:83:6e:15:d1:89:cd:d3:9b:0a:eb:87:56:c5:ac:e1
> debug2: we sent a publickey packet, wait for reply

#10 Updated by peter almost 4 years ago

On Sat, Oct 16, 2010 at 11:59:53AM +0100, Alex Hornung wrote:
> And here comes the resolution. Seems that having an id_rsa.pub file in
> ~/.ssh makes stuff not work properly.
>

I have a id_rsa.pub in ~/.ssh/ and things work fine.

--Peter

#11 Updated by dillon almost 4 years ago

Hmm. Also check your /etc/ssh/sshd_config, maybe there is an issue
in there.

-Matt
Matthew Dillon
<>

#12 Updated by alexh almost 4 years ago

Seems the public key didn't match the private key for some reason and previous
openssh versions always generated a public key directly from the private key for
authentication.

In any case this isn't really a bug as far as I can tell, so I'm closing it.

Thanks to Peter for checking all sorts of things to get this working for me
again.

Cheers,
Alex

Also available in: Atom PDF