| Summary: | ssh can't use an in-memory-only certificate that doesn't also have another in-memory private key | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | Peter Moody <mindrot> | ||||||
| Component: | ssh | Assignee: | Damien Miller <djm> | ||||||
| Status: | CLOSED FIXED | ||||||||
| Severity: | enhancement | CC: | cjwatson, djm | ||||||
| Priority: | P5 | ||||||||
| Version: | 7.2p1 | ||||||||
| Hardware: | amd64 | ||||||||
| OS: | Linux | ||||||||
| Bug Depends on: | |||||||||
| Bug Blocks: | 2543 | ||||||||
| Attachments: |
|
||||||||
|
Description
Peter Moody
2016-03-11 10:12:07 AEDT
Created attachment 2798 [details]
don't disregard already-certified keys
I think this might fix it.
nope :(
this works tho:
if (sshkey_equal_public(id->key, private_id->key) &&
id == private_id) {
I added a
debug2("id %p (id %d), private id %p (id %d)", id, id->key->type, private_id, private_id->key->type);
to the match, and this is the -vvv output
debug1: Server accepts key: pkalg ssh-rsa-cert-v01@openssh.com blen 2769
debug2: input_userauth_pk_ok: fp SHA256:5U6bsClkHE1aWyFRkKbynEtiK8QD3/Nf3cxeUSR+BCA
debug3: sign_and_send_pubkey: RSA-CERT SHA256:5U6bsClkHE1aWyFRkKbynEtiK8QD3/Nf3cxeUSR+BCA
debug2: id 0x7fab613164d0 (id 5), private id 0x7fab613164d0 (id 5)
debug2: sign_and_send_pubkey: using private key "[Valid until Sat 12 Mar 2016 11:55 UTC, Version 2]" from agent for certificate
debug3: send packet: type 50
debug3: receive packet: type 52
debug1: Authentication succeeded (publickey).
this is my ssh-agent
pmoody@pmoody (148) 04:39 (.git 7.2p1) /home/pmoody/src/openssh-portable
$ ./ssh-add -l
2048 SHA256:5U6bsClkHE1aWyFRkKbynEtiK8QD3/Nf3cxeUSR+BCA [Valid until Sat 12 Mar 2016 11:55 UTC, Version 2] (RSA-CERT)
pmoody@pmoody (0) 04:39 (.git 7.2p1) /home/pmoody/src/openssh-portable
$
sorry, I forgot to include this. here was the output with your patch debug1: Offering RSA-CERT public key: [Valid until Sat 12 Mar 2016 11:55 UTC, Version 2] debug3: send_pubkey_test debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 60 debug1: Server accepts key: pkalg ssh-rsa-cert-v01@openssh.com blen 2769 debug2: input_userauth_pk_ok: fp SHA256:5U6bsClkHE1aWyFRkKbynEtiK8QD3/Nf3cxeUSR+BCA debug3: sign_and_send_pubkey: RSA-CERT SHA256:5U6bsClkHE1aWyFRkKbynEtiK8QD3/Nf3cxeUSR+BCA debug1: sign_and_send_pubkey: no private key for certificate "[Valid until Sat 12 Mar 2016 11:55 UTC, Version 2]" debug1: Trying private key: /home/pmoody/.ssh/id_rsa debug3: no such identity: /home/pmoody/.ssh/id_rsa: No such file or directory debug1: Trying private key: /home/pmoody/.ssh/id_dsa debug3: no such identity: /home/pmoody/.ssh/id_dsa: No such file or directory debug1: Trying private key: /home/pmoody/.ssh/id_ecdsa debug3: no such identity: /home/pmoody/.ssh/id_ecdsa: No such file or directory debug1: Trying private key: /home/pmoody/.ssh/id_ed25519 debug3: no such identity: /home/pmoody/.ssh/id_ed25519: No such file or directory debug2: we did not send a packet, disable method debug1: No more authentication methods to try. Permission denied (publickey). Created attachment 2799 [details]
attempt 2: try cert if no separate key matches
Try this one instead - it just falls back to using the certificate directly if no other private key matches.
that works, thanks! Committed, this will be in OpenSSH 7.3 - thanks! commit c38905ba391434834da86abfc988a2b8b9b62477 Author: djm@openbsd.org <djm@openbsd.org> Date: Mon Mar 14 16:20:54 2016 +0000 upstream commit unbreak authentication using lone certificate keys in ssh-agent: when attempting pubkey auth with a certificate, if no separate private key is found among the keys then try with the certificate key itself. bz#2550 reported by Peter Moody Upstream-ID: f939cd76d68e6a9a3d1711b5a943d6ed1e623966 It might not hurt to update the comment above that block too, which in master still reads:
/*
* If the key is an certificate, try to find a matching private key
* and use it to complete the signature.
* If no such private key exists, return failure and continue with
* other methods of authentication.
*/
Good point, Colin - fixed. Close all resolved bugs after 7.3p1 release |