Bug 508286 - gnome-keyring ssh-agent breaks RSA key authentication
gnome-keyring ssh-agent breaks RSA key authentication
Product: Fedora
Classification: Fedora
Component: gnome-keyring (Show other bugs)
i686 Linux
low Severity medium
: ---
: ---
Assigned To: Tomáš Bžatek
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2009-06-26 08:44 EDT by Andrew Hall
Modified: 2015-03-03 17:40 EST (History)
4 users (show)

See Also:
Fixed In Version: gnome-keyring-2.26.3-1.fc11
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-07-23 04:52:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
GNOME Bugzilla 576700 None None None Never

  None (edit)
Description Andrew Hall 2009-06-26 08:44:12 EDT
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b4) Gecko/20090427 Fedora/3.5-0.20.beta4.fc11 Firefox/3.5b4

Since upgrading from F10 to F11 the gnome-keyring application's built in ssh-agent causes major issues with RSA key authentication.

If you attempt to connect to a server using an RSA key you see these errors server side:

Jun 24 10:56:10 uk00pba001 sshd[12128]: error: RSA_public_decrypt failed: error:0407006A:lib(4):func(112):reason(106)
Jun 24 10:56:10 uk00pba001 sshd[12128]: error: RSA_public_decrypt failed: error:04067072:lib(4):func(103):reason(114)

Which further investigation means:

# openssl errstr 0407006A
error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
# openssl errstr 04067072
error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed

If you then disable the ssh-agent with gconf-editor (apps/gnome-keyring/daemon-components) and use a different ssh-agent instead (I chose to use keychain by creating a .keychainrc file in my home dir) then all is well again.

I assume keychain uses the ssh-agent included with the openssh-clients package but I'm not sure.

N.B. I have observed this behaviour now on three machines - all upgraded from F10 to F11 using preupgrade if that has any relevance.

Version: gnome-keyring-2.26.1-1.fc11.i586 

Reproducible: Always

Steps to Reproduce:
1. Ensure the ssh-agent aspect of gnome-keyring is enabled.
2. Attempt to connect to an SSH server using RSA key authentication.
3. It results in failure.
4. Disable the ssh-agent aspect of gnome-keyring.
5. Enable keychain.
6. Attempt to connect to an SSH server using RSA key authentication.
7. It results in success.
Actual Results:  
Using gnome-keyring results in failure.

Using keychain results in success.

Expected Results:  
You should be able to connect using gnome-keyring with RSA keys.

Please note that prior to the upgrade and using the exact same key there were no problems whatsoever.
Comment 1 Maurits Lucas 2009-07-21 05:34:05 EDT
I have exactly the same problem, also on a machine that was upgraded from FC10 to FC11 using preupgrade.
Comment 2 Tomáš Bžatek 2009-07-22 11:40:25 EDT
This looks like https://bugzilla.gnome.org/show_bug.cgi?id=576700

Can you please grab gnome-keyring-2.26.3-1.fc11 from updates-testing
(`yum upgrade --enablerepo=updates-testing gnome-keyring` should do the trick) and try it again?

Comment 3 Andrew Hall 2009-07-22 12:49:47 EDT
Great - that seems to have fixed it !

Should I edit the bug in any other manner (apart from this comment) or leave that to yourself ?

Comment 4 Tomáš Bžatek 2009-07-23 04:52:30 EDT
Closing as fixed. If the problem persists, feel free to reopen this bug.

Feel free to drop a comment in https://admin.fedoraproject.org/updates/F11/FEDORA-2009-7282 to help pushing the update to stable.

Note You need to log in before you can comment on or make changes to this bug.