#728391 No diagnostic for missing private key file (!)

Package:
openssh-client
Source:
openssh
Description:
secure shell (SSH) client, for secure access to remote machines
Submitter:
Ian Jackson
Date:
2013-10-31 16:39:05 UTC
Severity:
normal
#728391#5
Date:
2013-10-31 16:24:05 UTC
From:
To:
If you have a public key file eg ~/.ssh/id_rsa.pub, but no
corresponding private key file, ssh(1) will offer the key to the
server, and if it is then accepted will silently forget about the
attempt to use it and carry on trying other authentication methods.
Even -v doesn't help.

If it is not expected that a private key would be missing, then the
appropriate response involves at the very least a complaint to stderr.

And even if it is expected, the -v output should mention why the key
is not being used despite being accepted.

Ian.

#728391#10
Date:
2013-10-31 16:34:55 UTC
From:
To:
Sorry, I see I forgot to append my transcript demonstrating the bug.
Here it is.

Ian.

zealot:~> ssh -vt ijackson@tunnel.chiark.greenend.org.uk date
OpenSSH_6.0p1 Debian-4, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /home/ian/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to tunnel.chiark.greenend.org.uk [172.31.80.8] port 22.
debug1: Connection established.
debug1: identity file /home/ian/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/ian/.ssh/id_rsa-cert type -1
debug1: identity file /home/ian/.ssh/id_dsa type -1
debug1: identity file /home/ian/.ssh/id_dsa-cert type -1
debug1: identity file /home/ian/.ssh/id_ecdsa type -1
debug1: identity file /home/ian/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_5.5p1 Debian-6+squeeze3
debug1: match: OpenSSH_5.5p1 Debian-6+squeeze3 pat OpenSSH_5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA d9:9a:1d:0d:59:8a:41:49:6d:de:16:47:94:e7:fa:0a
debug1: Host 'tunnel.chiark.greenend.org.uk' is known and matches the RSA host key.
debug1: Found key in /home/ian/.ssh/known_hosts:66
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive,hostbased
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/ian/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to tunnel.chiark.greenend.org.uk ([172.31.80.8]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Remote: Forced command.
debug1: Remote: Forced command.
debug1: Sending environment.
debug1: Sending env LANG = C
debug1: Sending command: date
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
Thu Oct 31 16:20:55 GMT 2013
debug1: channel 0: free: client-session, nchannels 1
Connection to tunnel.chiark.greenend.org.uk closed.
Transferred: sent 3072, received 2184 bytes, in 0.1 seconds
Bytes per second: sent 29431.7, received 20924.1
debug1: Exit status 0
zealot:~> mv .ssh/id_rsa .ssh/id_rsa-aside
zealot:~> ssh -vt ijackson@tunnel.chiark.greenend.org.uk date
OpenSSH_6.0p1 Debian-4, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /home/ian/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to tunnel.chiark.greenend.org.uk [172.31.80.8] port 22.
debug1: Connection established.
debug1: identity file /home/ian/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/ian/.ssh/id_rsa-cert type -1
debug1: identity file /home/ian/.ssh/id_dsa type -1
debug1: identity file /home/ian/.ssh/id_dsa-cert type -1
debug1: identity file /home/ian/.ssh/id_ecdsa type -1
debug1: identity file /home/ian/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_5.5p1 Debian-6+squeeze3
debug1: match: OpenSSH_5.5p1 Debian-6+squeeze3 pat OpenSSH_5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA d9:9a:1d:0d:59:8a:41:49:6d:de:16:47:94:e7:fa:0a
debug1: Host 'tunnel.chiark.greenend.org.uk' is known and matches the RSA host key.
debug1: Found key in /home/ian/.ssh/known_hosts:66
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive,hostbased
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/ian/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Trying private key: /home/ian/.ssh/id_dsa
debug1: Trying private key: /home/ian/.ssh/id_ecdsa
debug1: Next authentication method: keyboard-interactive
Password: ^C