Launchpad Bazaar and Git servers hang on SSH ECDSA/ED25519 authentication

[Mantas Mikulėnas]

When connecting to "bazaar.launchpad.net" over SSH (for "lp:..." and "bzr+ssh://...") using OpenSSH 5.8p2 client, the connection hangs when authentication using an ECDSA key is attempted.

[2011-08-21T19:42:56Z]
$ ssh -vvv <email address hidden> bzr whatever
OpenSSH_5.8p2, OpenSSL 1.0.0d 8 Feb 2011
[...]
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/grawity/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/grawity/.ssh/id_dsa
debug3: no such identity: /home/grawity/.ssh/id_dsa
debug1: Offering ECDSA public key: /home/grawity/.ssh/id_ecdsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
[hangs until killed]

This makes it impossible to checkout Launchpad projects (using "bzr co lp:....") after I have done "bzr lp-login".

[Robert Collins (lifeless)]

This may require a twisted conch patch

[James (dboyzetown)]

This is seriously annoying. Does "bzr branch" use ssh? I'm assuming it does, and I'm also assuming it doesn't run ssh with -v. I'm trying to install a package from the AUR that uses bzr, and i've literally spend the last 4 hours trying to work around this.

[Mantas Mikulėnas (grawity)]

James - yes, if you have done `bzr launchpad-login`, it starts using SSH for everything.

As a workaround, you can update your ~/.ssh/config to use a RSA key:

Host bazaar.launchpad.net
        IdentitiesOnly yes
        IdentityFile ~/.ssh/id_rsa

[James (dboyzetown)]

Yes, sorry, I forgot to post that I got this working. Confirmed though that that fix does indeed work. Thanks Mantas =]

[Mantas Mikulėnas (grawity)]

As an update (still open three years later?...), it turns out that OpenSSH "certificates" also trigger this bug:

    debug1: Offering RSA-CERT public key: /home/grawity/.ssh/id_global
    debug2: we sent a publickey packet, wait for reply
    [hangs]

Even the IdentitiesOnly option does not work here, as OpenSSH always tries <file>-cert.pub in addition to just <file> (it's documented in ssh_config with no option to disable).

Fortunately I was only testing the feature and can work around by removing ~/.ssh/*-cert.pub, but some other people wouldn't be so lucky.

[Mantas Mikulėnas (grawity)]

The next (post-6.9) OpenSSH release will have a more reliable workaround (and at the same time, more issues):

Host bazaar.launchpad.net
        # Limit client pubkeys to RSA
        PubkeyAcceptedKeyTypes ssh-rsa
        # Re-enable weak 768-bit DH group
        KexAlgorithms diffie-hellman-group1-sha1

[Colin Watson (cjwatson)]

Fixed in lazr.sshserver 0.1.6. I'll upgrade the other projects shortly so that we can actually deploy this.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r18562 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/18562>.

[Colin Watson (cjwatson)]

This is now fixed on all of our SSH endpoints. If you have workarounds for this in ~/.ssh/config, you can remove them now.