Bug 508286

Summary:	gnome-keyring ssh-agent breaks RSA key authentication
Product:	[Fedora] Fedora	Reporter:	Andrew Hall <andyjohnhall>
Component:	gnome-keyring	Assignee:	Tomáš Bžatek <tbzatek>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	11	CC:	maurits.lucas, tbzatek, tsmetana, walters
Target Milestone:	---
Target Release:	---
Hardware:	i686
OS:	Linux
Whiteboard:
Fixed In Version:	gnome-keyring-2.26.3-1.fc11	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-07-23 08:52:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Andrew Hall 2009-06-26 12:44:12 UTC

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b4) Gecko/20090427 Fedora/3.5-0.20.beta4.fc11 Firefox/3.5b4

Since upgrading from F10 to F11 the gnome-keyring application's built in ssh-agent causes major issues with RSA key authentication.

If you attempt to connect to a server using an RSA key you see these errors server side:

Jun 24 10:56:10 uk00pba001 sshd[12128]: error: RSA_public_decrypt failed: error:0407006A:lib(4):func(112):reason(106)
Jun 24 10:56:10 uk00pba001 sshd[12128]: error: RSA_public_decrypt failed: error:04067072:lib(4):func(103):reason(114)

Which further investigation means:

# openssl errstr 0407006A
error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
# openssl errstr 04067072
error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed

If you then disable the ssh-agent with gconf-editor (apps/gnome-keyring/daemon-components) and use a different ssh-agent instead (I chose to use keychain by creating a .keychainrc file in my home dir) then all is well again.

I assume keychain uses the ssh-agent included with the openssh-clients package but I'm not sure.

N.B. I have observed this behaviour now on three machines - all upgraded from F10 to F11 using preupgrade if that has any relevance.

Version: gnome-keyring-2.26.1-1.fc11.i586

Reproducible: Always

Steps to Reproduce:
1. Ensure the ssh-agent aspect of gnome-keyring is enabled.
2. Attempt to connect to an SSH server using RSA key authentication.
3. It results in failure.
4. Disable the ssh-agent aspect of gnome-keyring.
5. Enable keychain.
6. Attempt to connect to an SSH server using RSA key authentication.
7. It results in success.
Actual Results:
Using gnome-keyring results in failure.

Using keychain results in success.

Expected Results:
You should be able to connect using gnome-keyring with RSA keys.

Please note that prior to the upgrade and using the exact same key there were no problems whatsoever.

Comment 1 Maurits Lucas 2009-07-21 09:34:05 UTC

I have exactly the same problem, also on a machine that was upgraded from FC10 to FC11 using preupgrade.

Comment 2 Tomáš Bžatek 2009-07-22 15:40:25 UTC

This looks like https://bugzilla.gnome.org/show_bug.cgi?id=576700

Can you please grab gnome-keyring-2.26.3-1.fc11 from updates-testing
(`yum upgrade --enablerepo=updates-testing gnome-keyring` should do the trick) and try it again?

https://admin.fedoraproject.org/updates/F11/FEDORA-2009-7282

Comment 3 Andrew Hall 2009-07-22 16:49:47 UTC

Great - that seems to have fixed it !

Should I edit the bug in any other manner (apart from this comment) or leave that to yourself ?

Thanks.

Comment 4 Tomáš Bžatek 2009-07-23 08:52:30 UTC

Closing as fixed. If the problem persists, feel free to reopen this bug.

Feel free to drop a comment in https://admin.fedoraproject.org/updates/F11/FEDORA-2009-7282 to help pushing the update to stable.