Skip to content

Cannot perform ssh public key authentication from codeserver terminal. #3189

Closed
Closed
Cannot perform ssh public key authentication from codeserver terminal.#3189
Labels
enhancementSome improvement that isn't a feature
Milestone
On Deck

Description

@penM000
penM000
opened on Apr 22, 2021

OS/Web Information

  • Web Browser:Google Chrome 90.0.4430.85（Official Build）
  • Local OS: Windows10 20H2 (19042.928)
  • Remote OS: Debian GNU/Linux 10 (buster)
  • Remote Architecture: Linux server1 4.19.0-16-amd64 terminal becomes unresponsive after socket disconnect #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64 GNU/Linux
  • code-server --version: 3.9.3 fe2dc2d

Steps to Reproduce

1.Execute ssh -T github.
2.An error will be displayed.

sign_and_send_pubkey: signing failed: agent refused operation
git@github.com: Permission denied (publickey).

Expected

Expect to get a response like ssh or COCKPIT(WEBSHELL) as follows

Enter passphrase for key '/home/server/.ssh/id_rsa': 
Hi penM000! You've successfully authenticated, but GitHub does not provide shell access.

Solution

It works properly by discarding the environment variables as follows.

server@server1:~$ ssh -T github
sign_and_send_pubkey: signing failed: agent refused operation
git@github.com: Permission denied (publickey).
server@server1:~$ sudo -E -u `whoami`  ssh -T github
sign_and_send_pubkey: signing failed: agent refused operation
git@github.com: Permission denied (publickey).
server@server1:~$ sudo -u `whoami`  ssh -T github
Enter passphrase for key '/home/server/.ssh/id_rsa': 
Hi penM000! You've successfully authenticated, but GitHub does not provide shell access.

or

server@server1:~$ sudo su root
root@server1:/home/server# su server
server@server1:~$ ssh -T github
Enter passphrase for key '/home/server/.ssh/id_rsa': 
Hi penM000! You've successfully authenticated, but GitHub does not provide shell access.

Activity

  1. code-asher commented on Apr 22, 2021

    @code-asher
    code-asher
    on Apr 22, 2021
    Member

    I suppose it must be failing to ask for the password. Have you configured it to use some other method of pinentry?

    I was unable to reproduce with this:

    1. docker run -p 8080:8080 codercom/code-server
    2. Browse to localhost:8080
    3. Open terminal
    4. Run ssh-keygen and enter a password
    5. Add key to github.com
    6. ssh -T git@github.com
    7. It asks for the password
    8. Success
  2. jsjoeio
    added
    waiting-for-infoWaiting for more information from submitter
    on Apr 22, 2021

  3. penM000 commented on Apr 23, 2021

    @penM000
    penM000
    on Apr 23, 2021
    Author

    The problem is that it doesn't even go to the state of entering a password. Therefore, we believe that the private key is not being loaded.
    This problem occurred after updating codeserver from 3.8.0 and below to 3.9.3.

  4. penM000 commented on Apr 23, 2021

    @penM000
    penM000
    on Apr 23, 2021
    Author
    2021-04-23.09-35-21.mp4

  5. code-asher commented on Apr 23, 2021

    @code-asher
    code-asher
    on Apr 23, 2021
    Member

    Are you using ssh-agent? If the SSH_AUTH_SOCK environment variable exists then unsetting it might cause it to ask for the password normally. Something like:

    SSH_AUTH_SOCK= ssh -T github

    If that doesn't help then using ssh -vvv might reveal more information.

  6. penM000 commented on Apr 24, 2021

    @penM000
    penM000
    on Apr 24, 2021
    Author

    As you mentioned, I made sure that the ssh-agent command was available.
    I also confirmed that SSH_AUTH_SOCK exists only on codeserver, as shown below.

    ssh shell

    server@server1:~$ env | grep SSH
SSH_CONNECTION=ip_address 51240 ip_address 22
SSH_CLIENT=ip_address 22
SSH_TTY=/dev/pts/4

    code server shell

    server@server1:~$ env | grep SSH
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
SSH_AGENT_PID=6733

    By deleting SSH_AUTH_SOCK in codeserver's shell, it worked fine.
    I wrote unset in the bashrc, and the codeserver shell was restored.
    Thank you very much for your advice!

    server@server1:~$ ssh -T github
sign_and_send_pubkey: signing failed: agent refused operation
git@github.com: Permission denied (publickey).
server@server1:~$ unset SSH_AUTH_SOCK
server@server1:~$ ssh -T github
Enter passphrase for key '/home/server/.ssh/id_rsa': 
Hi penM000! You've successfully authenticated, but GitHub does not provide shell access.

  7. code-asher commented on Apr 26, 2021

    @code-asher
    code-asher
    on Apr 26, 2021
    Member

    Hurrah! ssh-agent is probably trying to use a graphical pinentry which of course won't work on the terminal.

    I'm not sure if there's anything we can do on our end to fix it but it would be cool if we could make ssh-agent ask for the passphrase through VS Code.

  8. code-asher
    added
    enhancementSome improvement that isn't a feature
    and removed
    waiting-for-infoWaiting for more information from submitter
    on Apr 26, 2021
  9. jsjoeio
    added this to the On Deck milestone on Apr 29, 2021

  10. stale commented on Oct 27, 2021

    @stale
    staleBot
    on Oct 27, 2021

    This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no activity occurs in the next 5 days.

  11. stale
    added
    stale
    on Oct 27, 2021
  12. stale
    closed this as completedon Nov 2, 2021

  13. Bryce-huang commented on Jul 14, 2023

    @Bryce-huang
    Bryce-huang
    on Jul 14, 2023

    chmod 600 your_private_key, it fixed my problem

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementSome improvement that isn't a feature

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions