ssh fail

[tara fife]

I wasn't able to push changes to trac, and I thought the problem had to do with the ssh key, so I reset it, and now I can't connect at all. I'm using an Ubuntu 14.04, and I've also tried to connect via a Kbuntu 12.04.

When I run ``ssh -v g...@trac.sagemath.org``, I get the following error.

OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to trac.sagemath.org [104.197.143.230] port 22.
debug1: Connection established.
debug1: identity file /home/tara/.ssh/id_rsa type 1
debug1: identity file /home/tara/.ssh/id_rsa-cert type -1
debug1: identity file /home/tara/.ssh/id_dsa type -1
debug1: identity file /home/tara/.ssh/id_dsa-cert type -1
debug1: identity file /home/tara/.ssh/id_ecdsa type -1
debug1: identity file /home/tara/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/tara/.ssh/id_ed25519 type -1
debug1: identity file /home/tara/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-m...@openssh.com none
debug1: kex: client->server aes128-ctr hmac-m...@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 5b:97:c8:74:a6:c4:e4:55:d1:13:8a:84:a3:85:25:6f
debug1: Host 'trac.sagemath.org' is known and matches the ECDSA host key.
debug1: Found key in /home/tara/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/tara/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/tara/.ssh/id_dsa
debug1: Trying private key: /home/tara/.ssh/id_ecdsa
debug1: Trying private key: /home/tara/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).

[Kwankyu Lee]

Perhaps you had the same issue with mine. Then the correct fix was just to remove the line for trac.sagemath.org in the file .ssh/known_hosts, not resetting your own ssh keys. Now that you seem to have changed your ssh private/public key pair, you need to register your new ssh public key to trac. Good luck.

[tara fife]

Thanks,

I went into the known_host file, and deleted everything, since I should only have things for Sage. Then I reran ssh -v g...@trac.sagemath.org, and got the same error message as before. I already pasted my new public key into the text box in the ssh preferences tab and saved it. I don't remember doing anything else to register it the first time. And it still seems weird to me that I wasn't able to use ssh on a fresh machine.

Tara

[Kwankyu Lee]

I ran ssh -v k...@trac.sagemath.org. It also fails :-) But I have no problem in pushing changes to trac...

[Volker Braun]

You can't ssh into trac. What should work is:

$ ssh g...@git.sagemath.org

PTY allocation request failed on channel 0

hello vbraun, this is git@trac running gitolite3 3.5.3.1-2 (Debian) on git 1.9.1

 R W sage

[Erik Bray]

On Wed, Jun 29, 2016 at 9:19 AM, Volker Braun <vbrau...@gmail.com> wrote:
> You can't ssh into trac. What should work is:
>
> $ ssh g...@git.sagemath.org
> PTY allocation request failed on channel 0
> hello vbraun, this is git@trac running gitolite3 3.5.3.1-2 (Debian) on git
> 1.9.1
>
> R W sage

I'm not so sure if this is the issue. git.sagemath.org and
trac.sagemath.org are both (currently) the same server, and nothing
about the SSH or gitolite configuration cares which hostname you use:

$ ssh g...@trac.sagemath.org
Enter passphrase for key '/home/embray/.ssh/id_rsa':

PTY allocation request failed on channel 0

hello embray, this is git@trac running gitolite3 3.5.3.1-2 (Debian) on git 1.9.1

R W gitolite-admin
R W sage
Connection to trac.sagemath.org closed.

It's possible that gitolite is not working correctly. I had a problem
with this myself recently, but thought maybe it was just something
with me, since I was messing around with my keys quite a bit in
gitolite. But it's possible something else is stuck somehow (though
it was definitely working at one point).

For anyone unfamiliar, gitolite is the program that manages
authorization for git repositories when connecting via SSH as the
"git" user. When you add a new SSH key (i.e. through the Trac
interface) it adds your key to gitolite in such a way that it
associates that key with your username. It is then *supposed* to
regenerate the .ssh/authorized_keys for git. But it's possible it's
not correctly regenerating the authorized_keys file, and so you'll get
permission denied even though you think you've added your key.


Tara: I just confirmed in the gitolite logs that you did add your new
keys, but that the update to the authorized_keys file seems to have
failed. I have manually added your public key for now so you should
be able to connect now, I think. In the meantime I will investigate
why gitolite seems to be stuck.

> --
> You received this message because you are subscribed to the Google Groups
> "sage-devel" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to sage-devel+...@googlegroups.com.
> To post to this group, send email to sage-...@googlegroups.com.
> Visit this group at https://groups.google.com/group/sage-devel.
> For more options, visit https://groups.google.com/d/optout.

[Volker Braun]

I think the posts get a bit maimed because google anonymizes the email addresses to prevent spam harvesting. You need to use "git at" in front of the hostname to test your ssh keys. As for the hostname, both git.sagemath.org and trac.sagemath.org work. But you can't use "myusername at {git,trac}.sagemath.org" unless you are one of the server admins.

[Erik Bray]

On Wed, Jun 29, 2016 at 11:02 AM, Volker Braun <vbrau...@gmail.com> wrote:
> I think the posts get a bit maimed because google anonymizes the email
> addresses to prevent spam harvesting. You need to use "git at" in front of
> the hostname to test your ssh keys. As for the hostname, both
> git.sagemath.org and trac.sagemath.org work. But you can't use "myusername
> at {git,trac}.sagemath.org" unless you are one of the server admins.

Right.

I think I've fixed the blockade in gitolite for now. It was failing
to regenerate the authorized_keys file due to some invalid keys.
Normally it's able to ignore those (with a warning), but it seems
there are some code paths where certain invalid keys cause it to die
outright without fully regenerating the file. I deleted the invalid
keys, and now it's running again.

A large part of the problem is that our Trac interface does not
validate key fingerprints, and allows adding malformatted garbage. I
brought this up earlier in this issue:
https://github.com/sagemath/sage_trac_plugin/issues/12

When I have a few hours I can redo the key management plugin to be a bit saner.

[tara fife]

Thanks everyone, I am able to push changes to trac now.

Tara

[Viviane Pons]

Hi,

I'm with two new sage git users: eviatarbach and avenrias and they seem to have a similar problem. They have put their ssh key on trac (I've checked), but it keeps saying "Permission denied (publickey)" when they try

ssh -T g...@trac.sagemath.org info

Here is what they get:

OpenSSH_7.2p2 Ubuntu-4ubuntu1, OpenSSL 1.0.2g-fips  1 Mar 2016

debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to trac.sagemath.org [104.197.143.230] port 22.
debug1: Connection established.

debug1: identity file /home/eviatar/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/eviatar/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/eviatar/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/eviatar/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/eviatar/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/eviatar/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/eviatar/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/eviatar/.ssh/id_ed25519-cert type -1

debug1: Enabling compatibility mode for protocol 2.0

debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu1

debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7 pat OpenSSH_6.6.1* compat 0x04000000

debug1: Authenticating to trac.sagemath.org:22 as 'git'

debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received

debug1: kex: algorithm: curve255...@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20...@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20...@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:PLGYHWgGgFuDw+Xqa8TSHaJ9AZlcXIiaYUdlrNN1sFU

debug1: Host 'trac.sagemath.org' is known and matches the ECDSA host key.

debug1: Found key in /home/eviatar/.ssh/known_hosts:2
debug1: rekey after 134217728 blocks

debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS

debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received

debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey

debug1: Offering RSA public key: /home/eviatar/.ssh/id_rsa

debug1: Authentications that can continue: publickey

debug1: Trying private key: /home/eviatar/.ssh/id_dsa
debug1: Trying private key: /home/eviatar/.ssh/id_ecdsa
debug1: Trying private key: /home/eviatar/.ssh/id_ed25519

debug1: No more authentication methods to try.

2016-06-29 3:56 GMT-07:00 tara fife <fi....@gmail.com>:

Thanks everyone, I am able to push changes to trac now.

Tara

[Dima Pasechnik]

perhaps adding an invalid ssh key still breaks the communication between git server and trac...

Can they still push changes to the git server? 

[Jori Mäntysalo]

On Thu, 30 Jun 2016, Viviane Pons wrote:

> I'm with two new sage git users: eviatarbach and avenrias and they seem to
> have a similar problem. They have put their ssh key on trac (I've checked),
> but it keeps saying "Permission denied (publickey)" when they try

I got the same error.

(Not that it would matter, as this computer can not build docs anyway...
Back to bigger one on monday.)

--
Jori Mäntysalo

[Eviatar]

It is now working for me! Not sure what happened.

Eviatar

[Julien Lavauzelle]

Hi,

I made the git-trac update and I got the same 'Permission denied' problem with my new keys (new laptop also), when trying to push or to use 'ssh -T g...@trac.sagemath.org'. But I didn't understand how tara or eviatar fixed it. Could someone tell me ?

Best,

Julien (login jlavauzelle)

[Eviatar Bach]

Mine suddenly started working overnight. I know this was the case for at least one other person. I assume something was done on the server.

Eviatar

--
You received this message because you are subscribed to a topic in the Google Groups "sage-devel" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/sage-devel/BRv0wzw5kJ4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to sage-devel+...@googlegroups.com.

[Erik Bray]

On Tue, Jul 5, 2016 at 10:50 AM, Julien Lavauzelle
<julien.l...@gmail.com> wrote:
> Hi,
>
> I made the git-trac update and I got the same 'Permission denied' problem
> with my new keys (new laptop also), when trying to push or to use 'ssh -T
> g...@trac.sagemath.org'. But I didn't understand how tara or eviatar fixed
> it. Could someone tell me ?

I have fixed it.

The invalid keys that I previously deleted from the key repository
mysteriously came back.

Turns out there was a bug in the sage trac plugin that would cause it
to overwrite any changes manually made to the key repository every
time someone added new keys through Trac. That has been fixed.

[Parthasarathi Panda]

Hi Erik,
I am still having the same error everytime i use git trac.

[Julien Lavauzelle]

OK it works for me now.

Thanks a lot Erik,

Julien