Cannot add SSH key generated on Fedora / openssh 7.8p1-1

MeneDev · September 4, 2018, 6:55am

Hi,

I want to push to github as part of my build process, so I generated a key with

ssh-keygen -t rsa -b 4096 -C "my@mail.com" -f keyfile

and empty passphrase.

Then I try to add the key under project settings > SSH Permissions.

On pressing “Add SSH key” the button only changes text to “Failed”. Looking at the Network traffic reveals that the Response is:

{message: "it looks like private key is invalid key. Double check"}

I did double check and I have no idea what the problem might be.

The key is (not used anywhere, will use different one, just to reproduce)

halfer · September 4, 2018, 9:44am

My guess is that your one is not an RSA key. I just did the same on a Linux Mint (basically Debian) system and got this:

My experience is that all RSA keys start with MII, so I wonder if the rsa thing did not work in your case. Try spinning up an Ubuntu/Vagrant VM and doing the key gen again? What OS are you using?

halfer · September 4, 2018, 9:46am

I reported the lack of on-screen messages here, thanks for confirming it. Perhaps you could post on that one to confirm it is an issue for you too? I had wondered if it was my NoScript interfering with the JavaScript app.

MeneDev · September 4, 2018, 11:35am

Thanks for looking into it! I’m on Fedora 28.
When I run ssh-keygen -lf keyfile it reports

4096 SHA256:J9yAgvE+2bCc7cuZJ/nFKIR+r5pYQ6C2f2k1lZ2iNPg my@mail.com (RSA)

Running ldd /usr/bin/ssh-keygen yields

linux-vdso.so.1 (0x00007ffdca553000)
libfipscheck.so.1 => /lib64/libfipscheck.so.1 (0x00007f2dc17a7000)
libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f2dc131b000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007f2dc1117000)
libutil.so.1 => /lib64/libutil.so.1 (0x00007f2dc0f14000)
libz.so.1 => /lib64/libz.so.1 (0x00007f2dc0cfd000)
libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f2dc0ad4000)
libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f2dc08bd000)
libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f2dc0694000)
libc.so.6 => /lib64/libc.so.6 (0x00007f2dc02d5000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f2dc00b6000)
/lib64/ld-linux-x86-64.so.2 (0x00007f2dc1c14000)
libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 (0x00007f2dbfe36000)

When running ssh-keygen in ubuntu:18.10 docker I indeed get a key that starts with

-----BEGIN RSA PRIVATE KEY-----
MII

and the key is accepted by Circle CI.

This change must have been made very recently, a few days ago I was able to generate a new, working key on fedora.

Some more versions:

ssh on ubuntu:18.10 apt-cache policy ssh reports Installed: 1:7.7p1-4
ssh on fedora: openssh.x86_64 7.8p1-1.fc28

Using ssh-keygen in fedora:28 docker image yields again an incompatible key using openssh-7.8p1-1.fc28.x86_64.

MeneDev · September 4, 2018, 11:51am

To get a usable private key using openssh 7.8 the command now is

ssh-keygen -t rsa -b 4096 -m PEM -C "my@mail.com" -f keyfile

I added an “Idea” for this: https://circleci.com/ideas/?idea=CCI-I-583

And the release log is actually quite clear about the problem:

Potentially-incompatible changes

This release includes a number of changes that may affect existing
configurations:

ssh-keygen(1): write OpenSSH format private keys by default
instead of using OpenSSL’s PEM format. The OpenSSH format,
supported in OpenSSH releases since 2014 and described in the
PROTOCOL.key file in the source distribution, offers substantially
better protection against offline password guessing and supports
key comments in private keys. If necessary, it is possible to write
old PEM-style keys by adding “-m PEM” to ssh-keygen’s arguments
when generating or updating a key.

system · September 14, 2018, 11:51am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Can't add ssh key Feedback & Bug Reports	2	1390	June 18, 2018
Adding SSH key gives error with correct key Feedback & Bug Reports	4	4068	March 23, 2016
Can't add an ssh key in "SSH Permissions" Feedback & Bug Reports	3	4837	November 20, 2018
Unable to add private SSH key to "SSH Permissions" Feedback & Bug Reports	5	2486	July 22, 2018
Error when adding SSH Permissions keys on macOS Mojave Feedback & Bug Reports	0	2407	January 29, 2019

Cannot add SSH key generated on Fedora / openssh 7.8p1-1

Potentially-incompatible changes

Related Topics