ssh client not using correct identity key

[Niall Parker]

Binary package hint: openssh-client

after a recent upgrade to 8.04 from 7.10, I noticed that I no longer had shell access to one of our servers. Using the same keys works fine in OpenSSH_4.6p1 Debian-5ubuntu0.5, OpenSSL 0.9.8e 23 Feb 2007 (from ssh -v), but using the default with 8.04 (OpenSSH_4.7p1 Debian-8ubuntu1.2, OpenSSL 0.9.8g 19 Oct 2007), the client will not use an alternate identity file (either specified in .ssh/config or via the -i command line flag).

This only occurs if the default id_dsa key file exists in .ssh ... renaming it to id_dsa_old eliminates the problem. It appears the client is using the default file name in precedence over the config and command line options.

To recreate:
1. create two key pairs and copy to server
2. restrict one of the keys (in this case I had command="/usr/bin/cvs server")
3. try connecting with both keys and note expected behaviour (default shell and restricted to cvs)
4. rename restricted key to 'id_dsa' and try both keys again via -i option
*** restricted key will be used despite -i option

Workaround: don't have default 'id_dsa' for key filename

[Randy Slzlr (ubuntu-bug-data-warp)]

Could this be related to 302252, which I reported last week.
Similarities include: 1) ssh uses the wrong "-i id_rsa-..." key, 2) noticed shortly after upgrade.

I'm using id_rsa, instead of id_dsa. Unlike this bug, the workaround (removing the default key) does not work.

[Kees Cook (kees)]

Is this still a problem now that bug 275010 is fixed?

[Chuck Short (zulcss)]

We'd like to figure out what's causing this bug for you, but we haven't heard back from you in a while. Could you please provide the requested information? Thanks!

[Niall Parker (stuff-npengineering)]

Chuck Short wrote:
> We'd like to figure out what's causing this bug for you, but we haven't
> heard back from you in a while. Could you please provide the requested
> information? Thanks!
>

I responded to your last (automatic ?) query, and yes, the problem is
still present on my system (naturally as any bug fixes haven't (yet)
been backported to 8.04 LTS)

     ... Niall

[Varspigil (varspigil)]

I can provide further information on this bug as well.

Apparently the settings in ssh_config on the client machine are ignored and the OpenSSH client continues using id_rsa to search for key authentication.

If you run the client connection using the verbose switch, you'll see it.