openssh unix dev - Sep 2013 - Key preference

Hello everybody,

I have a problem specifying identities with the -i option.

For easier ssh invocations, I have setup my ssh_config files with entries like
the following:

 Host *.domain.name
 Port 23457
 StrictHostKeyChecking yes
 UserKnownHostsFile    /dev/null
 GlobalKnownHostsFile  /etc/ssh/known-hosts/domain.name
 IdentityFile ~/.ssh/%h-dsa
 IdentityFile ~/.ssh/%h-rsa
 IdentityFile ~/.ssh/domain.name-dsa
 IdentityFile ~/.ssh/domain.name-rsa

In addition, I've set up a system similar to gitolite, which uses a
dedicated
account with authorized_keys set up like this:

 command="/gitrepos/.server
ab",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss
pubkey-ab
 command="/gitrepos/.server
cd",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss
pubkey-cd

This way, the connecting user is identified by its public key. This setup
works fine so far. But when I try connecting with a _specific_ key using
the -i option (to represent a specific role in the git repository), I get this
strange result:

 $ ssh -vvv -i /home/jw/.ssh/specific-key gitrepos at git.domain.name
 debug1: identity file /home/jw/.ssh/specific-key type 1
 [ ... ]
 debug2: key: /home/jw/.ssh/some-key.domain.name (0xb8db08b0)
 debug2: key: /home/jw/.ssh/specific-key (0xb8daaea0)
 [ ... ]
 debug1: Offering DSA public key: /home/jw/.ssh/some-key.domain.name

This seems strange to me. I have requested a _specific_ key with the -i
option. Why is a different key tried _before_ this specific key is even
considered? IMHO, if a specific key is specified on the command line, this
specific key (and _no_ other key) should be used.


Another annoyance is that a private key will not be loaded when the
corresponding public key is not available.


PS: Is the list on secureshell at securityfocus.com dead? If so, then
    http://www.openssh.org/de/list.html should be updated accordingly.

-- 
Josef Wolf
jw at raven.inka.de

On Fri, Sep 20, 2013 at 02:51:53PM +0200, Josef Wolf
wrote:
> I have a problem specifying identities with the -i option.
[...]
> This seems strange to me. I have requested a _specific_ key with the -i
> option. Why is a different key tried _before_ this specific key is even
> considered?
If your ssh-agent has keys those will be offered to the server first.
You can change that with the IdentitiesOnly option.
> Another annoyance is that a private key will not be loaded when the
> corresponding public key is not available.
That's because if the private key is encrypted it'd need to prompt you
for the passphrase every time you made a connection whether the key can
be used or not.

The way pubkey auth works is the client says "if I proved I had the
private key corresponding to this public key fingerprint would that
work?" and the server replies with yes or no.  In your case, what's
probably happening is that you have keys in your agent which the server
will also accept.
> PS: Is the list on secureshell at securityfocus.com dead? If so, then
>     http://www.openssh.org/de/list.html should be updated accordingly.
>From the archive it looks like it died some time in 2011.  I'll remove
it.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.