Bug #1869
closed
openssh update key problems
Added by alexh over 13 years ago. Updated over 13 years ago.
0%
Description
It seems that now ssh doesn't work with my .ssh/id_rsa file, yet it works just
fine with the .ssh/identity. Since ssh defaults to using (it seems) the id_rsa
file, I couldn't login without -i anymore.
11:38 : alexh@: # ssh alexh@leaf.dragonflybsd.org11:38 : alexh@: Permission denied (publickey,keyboard-interactive).
11:41 : alexh@: 9:02:57 dragon:~11:41 : alexh@: 1 # cmp .ssh/identity .ssh/id_rsa11:41 : alexh@: 9:03:01 dragon:~11:41 : alexh@: #11:41 : alexh@: yet ssh i .ssh/id_rsa doesn't work : alexh@: but ssh -i .ssh/identity does
-11:41
Updated by alexh over 13 years ago
I don't know what went wrong with the update but it's really annoying, I
basically can't commit anymore.
It doesn't help having only the identity file or only the id_rsa file in ~/.ssh.
I really need to manually do ssh -i ~/.ssh/identity and no idea how you can do
that with git.
Updated by alexh over 13 years ago
And some debug:
255 # ssh vvv alexh@leaf.dragonflybsd.org
OpenSSH_5.6p1-hpn13v10 DragonFly-20100928, OpenSSL 1.0.0a 1 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to leaf.dragonflybsd.org [216.240.41.26] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug3: Not a RSA1 key file /root/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /root/.ssh/id_rsa type 1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6p1
hpn13v10 DragonFly-20100928
debug1: match: OpenSSH_5.6p1-hpn13v10 DragonFly-20100928 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6p1-hpn13v10 DragonFly-20100928
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-
group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-
v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-
rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-
ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-
ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-
group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-
ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-
cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-
ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-
ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 113/256
debug2: bits set: 516/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: host leaf.dragonflybsd.org filename
/root/.ssh/known_hosts
debug3: check_host_in_hostfile: host leaf.dragonflybsd.org filename
/root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 2
debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:2
debug2: bits set: 490/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/id_rsa (0x28400070)
debug2: key: /root/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /root/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: userauth_kbdint: disable: no info_req_seen
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Updated by qhwt.dfly over 13 years ago
Alex Hornung <ahornung@gmail.com> added the comment:
I don't know what went wrong with the update but it's really annoying, I
basically can't commit anymore.
Are you using an RSA identity created for SSH protocol version 1?
The recent upgrade has changed something in readconf.c near a line containing
if (options->protocol == SSH_PROTO_UNKNOWN)which might affect you.
It doesn't help having only the identity file or only the id_rsa file in ~/.ssh.
I really need to manually do ssh -i ~/.ssh/identity and no idea how you can do
that with git.
You can have an entry like this in your ~/.ssh/config:
Host leaf.dragonflybsd.org
IdentityFile ~/.ssh/identity
Cheers.
Updated by alexh over 13 years ago
For whatever it's worth, this doesn't happen on my laptop with exactly the same
key. Everything works fine there.
Updated by qhwt.dfly over 13 years ago
For whatever it's worth, this doesn't happen on my laptop with exactly the same
key. Everything works fine there.
With exactly the same /etc/ssh/ssh_config and the identical ~/.ssh/config
(other than the comment lines)?
Updated by alexh over 13 years ago
Yes, the config files are exactly the same (see below; user-specific config
doesn't exist). Something went wrong, but since I can't pinpoint it and nobody
else seems to experience it I guess we can forget about this one... I worked
around on that machine using the hint of specifying an IdentityFile in
~/.ssh/config.
Updated by alexh over 13 years ago
On 15/10/10 01:35, YONETANI Tomokazu wrote:
For whatever it's worth, this doesn't happen on my laptop with exactly the same
key. Everything works fine there.With exactly the same /etc/ssh/ssh_config and the identical ~/.ssh/config
(other than the comment lines)?
Yes, the config files are exactly the same (see below; user-specific
config doesn't exist). Something went wrong, but since I can't pinpoint
it and nobody else seems to experience it I guess we can forget about
this one... I worked around on that machine using the hint of specifying
an IdentityFile in ~/.ssh/config.
- diff
Naurw /usr/src/crypto/openssh/ssh_config /etc/ssh/ssh_config/usr/src/crypto/openssh/ssh_config 2010-09-30 06:23:10 0100
--
++ /etc/ssh/ssh_config 2009-12-04 08:08:16 0000@ -1,4 +1,5@
-# $OpenBSD: ssh_config,v 1.26 2010/01/11 01:39:46 dtucker Exp $
# $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $
+# $DragonFly: src/crypto/openssh-5/ssh_config,v 1.3 2008/09/28
03:19:46 pavalos Exp $- This is the ssh client system-wide configuration file. See
- ssh_config(5) for more information. This file provides defaults for
@ -47,4 +48,3@ - TunnelDevice any:any
- PermitLocalCommand no
- VisualHostKey no
-# ProxyCommand ssh -q -W %h:%p gateway.example.com
Updated by alexh over 13 years ago
A diff between the non-working verbose output and the working one: (root
user doesn't work, 'alex' user works, same machine). FWIW on the laptop
both root and 'alex' work just fine.
Pay special attention to the debug2: key: foo/id_rsa (N) and then
'Offering RSA public key' vs 'Trying private key'.
debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
-debug1: Found key in /root/.ssh/known_hosts:2
-debug2: bits set: 495/1024
+debug1: Found key in /home/alex/.ssh/known_hosts:1
+debug2: bits set: 507/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
@ -99,8 +98,8 @
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
-debug2: key: /root/.ssh/id_rsa (0x28400070)
-debug2: key: /root/.ssh/id_dsa (0x0)
+debug2: key: /home/alex/.ssh/id_rsa (0x0)
+debug2: key: /home/alex/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
@ -108,21 +107,109 @
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
-debug1: Offering RSA public key: /root/.ssh/id_rsa
-debug3: send_pubkey_test
+debug1: Trying private key: /home/alex/.ssh/id_rsa
+debug1: read PEM private key done: type RSA
+debug3: sign_and_send_pubkey: RSA
3b:83:6e:15:d1:89:cd:d3:9b:0a:eb:87:56:c5:ac:e1
debug2: we sent a publickey packet, wait for reply
Updated by alexh over 13 years ago
And here comes the resolution. Seems that having an id_rsa.pub file in
~/.ssh makes stuff not work properly.
1 # ls .ssh
id_rsa id_rsa.pub identity known_hosts
10:16:59 dragon:~
- mv .ssh/id_rsa.pub .
10:17:05 dragon:~ - ssh alexh@leaf.dragonflybsd.org
Last login: Sat Oct 16 03:46:30 2010 from 87-194-42-220.b
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
On 16/10/10 11:51, Alex Hornung wrote:
A diff between the non-working verbose output and the working one: (root
user doesn't work, 'alex' user works, same machine). FWIW on the laptop
both root and 'alex' work just fine.Pay special attention to the debug2: key: foo/id_rsa (N) and then
'Offering RSA public key' vs 'Trying private key'.debug1: Host 'leaf.dragonflybsd.org' is known and matches the RSA host key.
-debug1: Found key in /root/.ssh/known_hosts:2
-debug2: bits set: 495/1024
+debug1: Found key in /home/alex/.ssh/known_hosts:1
+debug2: bits set: 507/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1@ -99,8 +98,8@
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
-debug2: key: /root/.ssh/id_rsa (0x28400070)
-debug2: key: /root/.ssh/id_dsa (0x0)
+debug2: key: /home/alex/.ssh/id_rsa (0x0)
+debug2: key: /home/alex/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password@ -108,21 +107,109@
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
-debug1: Offering RSA public key: /root/.ssh/id_rsa
-debug3: send_pubkey_test
+debug1: Trying private key: /home/alex/.ssh/id_rsa
+debug1: read PEM private key done: type RSA
+debug3: sign_and_send_pubkey: RSA
3b:83:6e:15:d1:89:cd:d3:9b:0a:eb:87:56:c5:ac:e1
debug2: we sent a publickey packet, wait for reply
Updated by peter over 13 years ago
On Sat, Oct 16, 2010 at 11:59:53AM +0100, Alex Hornung wrote:
And here comes the resolution. Seems that having an id_rsa.pub file in
~/.ssh makes stuff not work properly.
I have a id_rsa.pub in ~/.ssh/ and things work fine.
--Peter
Updated by dillon over 13 years ago
Hmm. Also check your /etc/ssh/sshd_config, maybe there is an issue
in there.
-Matt
Matthew Dillon
<dillon@backplane.com>
Updated by alexh over 13 years ago
Seems the public key didn't match the private key for some reason and previous
openssh versions always generated a public key directly from the private key for
authentication.
In any case this isn't really a bug as far as I can tell, so I'm closing it.
Thanks to Peter for checking all sorts of things to get this working for me
again.
Cheers,
Alex