Bug 2110 - ssh-copy-id fails on nonexisting private key
Summary: ssh-copy-id fails on nonexisting private key
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-copy-id (show other bugs)
Version: 6.4p1
Hardware: Other Linux
: P3 normal
Assignee: Philip Hands
URL:
Keywords:
Depends on:
Blocks: V_7_2
  Show dependency treegraph
 
Reported: 2013-05-31 20:56 AEST by Petr Lautrbach
Modified: 2016-08-02 10:42 AEST (History)
6 users (show)

See Also:


Attachments
add a '-l' option for a legacy mode (3.32 KB, patch)
2013-10-07 20:21 AEDT, Petr Lautrbach
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Petr Lautrbach 2013-05-31 20:56:09 AEST
ssh-copy-id fails when a private key file (without .pub suffix) is not present in the same directory as the public key file.

# ls ~/.ssh/id_rsa*
/root/.ssh/id_rsa  /root/.ssh/id_rsa.pub

# cp -vf ~/.ssh/id_rsa.pub /tmp/.
‘/root/.ssh/id_rsa.pub’ -> ‘/tmp/./id_rsa.pub’

# ssh-copy-id -i /tmp/id_rsa.pub root@localhost

/usr/bin/ssh-copy-id: ERROR: failed to open ID file '/tmp/id_rsa': No such file or directory

There's no switch that would disable checking for the private key file. There's no keypair verification done, simply creating an empty /tmp/id_rsa file makes ssh-copy-id work again.
Comment 1 Ken Coar 2013-09-30 23:14:17 AEST
Although creating an empty corresponding private-key file will get past the "ERROR: failed to open ID file" problem, it doesn't solve the issue -- because the empty privkey file will cause the next step to fail:

/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/usr/bin/ssh-copy-id: WARNING: All keys were skipped because they already exist on the remote system.

That last error message is erroneous, because the ssh *login* failed, not because the key was already in the remote host's authorized_keys file.

I used to be able to use ssh-copy-id to add a colleague's public key to a remote host without having to know his private key.  This change no longer allows that, and isn't controllable by options.

Therefore, I consider this change a REGRESSION.
Comment 2 Petr Lautrbach 2013-10-07 20:21:48 AEDT
Created attachment 2345 [details]
add a '-l' option for a legacy mode

This patch adds a new option to ssh-copy-id -l for a legacy mode. The legacy mode doesn't check an existence of a private key and doesn't do remote checks.
Comment 3 Petr Lautrbach 2014-01-07 03:29:23 AEDT
ping?

Do you have any comments or objections? I've seen several people complaining about the new ssh-copy-id and "-l" for legacy mode seems to me to be reasonable trade-off
Comment 4 Jim Ciallella 2014-04-11 00:55:01 AEST
+1 for this being a problem. 1/2 of my use of ssh-copy-id is to copy other people's .pub keys to give them access.

It follows that nobody in this same position will have the other person's private key file.

A flag, or similar method, to indicate that this is a not the initiator's key would be great.
Comment 5 Thomas Waldmann 2015-01-31 16:46:47 AEDT
I just had the same problem. I had to install a pubkey of a coworker to some servers and had to fall back to copy&paste method as I ofc did not have his privkey.

See also my fresh comment on bug #2331 - I suspect the issue here is caused by the same magic that caused the issue there. Maybe just remove that magic in favor of a "do what I say" mode.
Comment 6 Josip Rodin 2015-07-09 19:28:53 AEST
Please add this, I also ran into it while trying to use the program to allow other people access. I'm not sure why it would need to be called a "legacy" mode, it's more of a "blind" mode or a "no verification" mode.
Comment 7 Philip Hands 2015-11-29 01:00:11 AEDT
In my git repo:

  http://git.hands.com/ssh-copy-id

there's now a version that has a '-f' (force) option that does what the legacy option was suggested to do (i.e. just go ahead and install things)

It would be helpful if you could test that and say whether it deals with the problem for you.

Cheers, Phil.
Comment 8 Damien Miller 2016-08-02 10:42:36 AEST
Close all resolved bugs after 7.3p1 release