openssh unix dev - Feb 2001 - ssh-agent and id_dsa

Hi!

I am distributing 2.5.1p1 for production use on my system by now and prepare
switching to protocol 2 as default protocol.

I just noted, that ssh-agent can be used for protocol 1 and 2, but the
keys kept in ssh-agent are not compared against keys in .ssh.
Example: I have a DSA key in id_dsa which I load into ssh-agent on login.
When connecting to an account accepting the key everything is fine.
If the key is not accepted, slogin will not recognize that the key was
already tried from ssh-agent and will ask me again to enter the password
to unlock the key (for another failure).
This is due to sshconnect2.c:userauth_pubkey() where this retrial is not
performed for KEY_RSA1 but for other keys.
I did not dig into the functionality yet. Is there a way to "remember"
which pubkeys were already tried from ssh-agent and to not try again
from file (and hence ask for the passphrase)?

Best regards,
	Lutz
-- 
Lutz Jaenicke                             Lutz.Jaenicke at aet.TU-Cottbus.DE
BTU Cottbus               http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik                  Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus              Fax. +49 355 69-4153

why don't you rename the key? :)

does the protocol-1 implementation remember keys?

On Tue, Feb 20, 2001 at 10:40:30AM +0100, Lutz Jaenicke
wrote:
> Hi!
> 
> I am distributing 2.5.1p1 for production use on my system by now and
prepare
> switching to protocol 2 as default protocol.
> 
> I just noted, that ssh-agent can be used for protocol 1 and 2, but the
> keys kept in ssh-agent are not compared against keys in .ssh.
> Example: I have a DSA key in id_dsa which I load into ssh-agent on login.
> When connecting to an account accepting the key everything is fine.
> If the key is not accepted, slogin will not recognize that the key was
> already tried from ssh-agent and will ask me again to enter the password
> to unlock the key (for another failure).
> This is due to sshconnect2.c:userauth_pubkey() where this retrial is not
> performed for KEY_RSA1 but for other keys.
> I did not dig into the functionality yet. Is there a way to
"remember"
> which pubkeys were already tried from ssh-agent and to not try again
> from file (and hence ask for the passphrase)?
> 
> Best regards,
> 	Lutz
> -- 
> Lutz Jaenicke                             Lutz.Jaenicke at
aet.TU-Cottbus.DE
> BTU Cottbus               http://www.aet.TU-Cottbus.DE/personen/jaenicke/
> Lehrstuhl Allgemeine Elektrotechnik                  Tel. +49 355 69-4129
> Universitaetsplatz 3-4, D-03044 Cottbus              Fax. +49 355 69-4153
>

On Thu, Mar 08, 2001 at 12:25:51PM +0100, Markus Friedl
wrote:
> On Thu, Mar 08, 2001 at 10:55:44AM +0100, Lutz Jaenicke wrote:
> > debug1: got SSH2_MSG_SERVICE_ACCEPT
> > debug1: authentications that can continue:
publickey,password,keyboard-interactive
> > debug1: next auth method to try is publickey
> > debug1: userauth_pubkey_agent: testing agent key
/home/aet/serv01/jaenicke/.ssh/id_rsa
> > debug2: we sent a publickey packet, wait for reply
> > debug1: input_userauth_pk_ok: pkalg ssh-rsa blen 149 lastkey 4001da88
hint -1
> 
> this means the server will accept the agent key.
> 
> it did stop here? you did not login automatically??
It does mean precisely that, the login failed with the error shown below.
> could you try -v -v -v?
> (server output is not relevant).
> 
> > debug1: next auth method to try is publickey
> > debug2: userauth_pubkey_agent: no more keys
> > debug2: userauth_pubkey_agent: no message sent
> > debug1: try pubkey: /home/aet/serv01/jaenicke/.ssh/id_rsa
> > debug2: we sent a publickey packet, wait for reply
> > Disconnecting: protocol error: rcvd type 60
> > debug1: Calling cleanup 0x4000dffa(0x0)
And here is the output with triple -v:
debug1: done: KEX2.
debug1: send SSH2_MSG_SERVICE_REQUEST
debug1: service_accept: ssh-userauth
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: authentications that can continue:
publickey,password,keyboard-interactive
debug3: start over, passed a different list
debug3: authmethod_lookup publickey
debug3: authmethod_is_enabled publickey
debug1: next auth method to try is publickey
debug1: userauth_pubkey_agent: testing agent key
/home/aet/serv01/jaenicke/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: input_userauth_pk_ok: pkalg ssh-rsa blen 149 lastkey 4001da88 hint -1
debug3: authmethod_lookup publickey
debug3: authmethod_is_enabled publickey
debug1: next auth method to try is publickey
debug2: userauth_pubkey_agent: no more keys
debug2: userauth_pubkey_agent: no message sent
debug1: try pubkey: /home/aet/serv01/jaenicke/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
Disconnecting: protocol error: rcvd type 60
debug1: Calling cleanup 0x4000dffa(0x0)

I can also add my id_dsa key into ssh-agent to no avail:
debug1: send SSH2_MSG_SERVICE_REQUEST
debug1: service_accept: ssh-userauth
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: authentications that can continue:
publickey,password,keyboard-interactive
debug3: start over, passed a different list
debug3: authmethod_lookup publickey
debug3: authmethod_is_enabled publickey
debug1: next auth method to try is publickey
debug1: userauth_pubkey_agent: testing agent key
/home/aet/serv01/jaenicke/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: input_userauth_pk_ok: pkalg ssh-rsa blen 149 lastkey 4001da88 hint -1
debug3: authmethod_lookup publickey
debug3: authmethod_is_enabled publickey
debug1: next auth method to try is publickey
debug1: userauth_pubkey_agent: testing agent key
/home/aet/serv01/jaenicke/.ssh/id_dsa
debug2: we sent a publickey packet, wait for reply
Disconnecting: protocol error: rcvd type 60
debug1: Calling cleanup 0x4000dffa(0x0)

Best regards,
	Lutz
-- 
Lutz Jaenicke                             Lutz.Jaenicke at aet.TU-Cottbus.DE
BTU Cottbus               http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik                  Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus              Fax. +49 355 69-4153

> Any suggestions ?
Yeah, throw up a trace and see who got the last packet.

I believe ssh -v -v -v will display additional packet level traces too.

--Dan