openssh unix dev - Nov 2012 - ssh-copy-id usability improvement

Hi,

I had trouble recently with using the ssh-copy-id -i switch (in
portable OpenSSH?s contrib/), where it told me that ?no identities
found?, while I the file existed and contained a valid public key text
line. The problem was, that the file was named something.key in stead
of something.pub, and the script tried to read the non-existent
something.key.pub.

The two small patches below fix that, by checking that
something.key.pub exists before adding the .pub suffix to
something.key. Feedback is welcome, of course.

Regards,
Amir

commit 2b739db206d2bce48e3a52dd269c2a2bb641e55d
Author: Amir Yalon <git at please.nospammail.net>
Date:   Wed Nov 7 12:26:23 2012 +0200

    ssh-copy-id: enable suffix other than .pub in argument to -i

diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
index 9451ace..15a1646 100644
--- a/contrib/ssh-copy-id
+++ b/contrib/ssh-copy-id
@@ -11,10 +11,10 @@ if [ "-i" = "$1" ]; then
   shift
   # check if we have 2 parameters left, if so the first is the new ID file
   if [ -n "$2" ]; then
-    if expr "$1" : ".*\.pub" > /dev/null ; then
-      ID_FILE="$1"
-    else
+    if [ -f "$1.pub" ]; then
       ID_FILE="$1.pub"
+    else
+      ID_FILE="$1"
     fi
     shift         # and this should leave $1 as the target name
   fi

And also a patch for the proposed new ssh-copy-id script at
http://git.hands.com/ssh-copy-id:

commit ff8993ba2cefbb28b4648d643a73f01fec64617c
Author: Amir Yalon <git at please.nospammail.net>
Date:   Wed Nov 7 12:44:40 2012 +0200

    Enable suffix other than .pub in argument to -i

diff --git a/ssh-copy-id b/ssh-copy-id
index 8cdad28..efa0d29 100755
--- a/ssh-copy-id
+++ b/ssh-copy-id
@@ -23,10 +23,10 @@ usage () {
 use_id_file() {
   local L_ID_FILE=$1

-  if expr "$L_ID_FILE" : ".*\.pub$" >/dev/null ; then
-    PUB_ID_FILE="$L_ID_FILE"
-  else
+  if [ -f "$L_ID_FILE.pub" ]; then
     PUB_ID_FILE="$L_ID_FILE.pub"
+  else
+    PUB_ID_FILE="$L_ID_FILE"
   fi

   PRIV_ID_FILE=$(dirname "$PUB_ID_FILE")/$(basename
"$PUB_ID_FILE" .pub)

Amir Yalon <yxejamir at gmail.com> writes:
> Hi,
Hi Amir,
> I had trouble recently with using the ssh-copy-id -i switch (in
> portable OpenSSH?s contrib/), where it told me that ?no identities
> found?, while I the file existed and contained a valid public key text
> line. The problem was, that the file was named something.key in stead
> of something.pub, and the script tried to read the non-existent
> something.key.pub.
>
> The two small patches below fix that, by checking that
> something.key.pub exists before adding the .pub suffix to
> something.key. Feedback is welcome, of course.
The advantage of the current approach is that it will only publish a
file to another server if it has the .pub suffix.

With your patch, I see the very slight possibility that one might manage
to lose the .pub file for a key, and then end up mistakenly using
ssh-copy-id to push a copy of your private key out.

Given that one can fix the problem you had by adding a symlink:

  something.key.pub --> something.key

I would think that the problem that perhaps needs fixing is that the
error message you were given could probably have been more helpful.

BTW I have a more up to date version of ssh-copy-id here:

  http://git.hands.com/ssh-copy-id

which checks that the key you specified is loadable before bothering to
push the .pub, which will work even less well for your scenario I'm
afraid, as it will not be able to work out the name of the private key.

If you can see a useful way of making this work for you, feel free to
suggest it, or clone the git and send me a patch or the URL for your git
once you have a patch.

Cheers, Phil.

P.S. regarding my previous attempt to get my version of ssh-copy-id
adopted for the ssh contrib dir, I note that I dropped the ball on this
bug:

  https://bugzilla.mindrot.org/show_bug.cgi?id=1980

I've now fixed the ${1%:} problem, so I'll update the bug and perhaps we
can get the new version into ssh's contrib.
-- 
|)|  Philip Hands [+44 (0)20 8530 9560]    http://www.hands.com/
|-|  HANDS.COM Ltd.                    http://www.uk.debian.org/
|(|  10 Onslow Gardens, South Woodford, London  E18 1NE  ENGLAND
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 835 bytes
Desc: not available
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20121108/cd91c96a/attachment.bin>