Bug 508286 - gnome-keyring ssh-agent breaks RSA key authentication
Summary: gnome-keyring ssh-agent breaks RSA key authentication
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: gnome-keyring
Version: 11
Hardware: i686
OS: Linux
low
medium
Target Milestone: ---
Assignee: Tomáš Bžatek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-06-26 12:44 UTC by Andrew Hall
Modified: 2015-03-03 22:40 UTC (History)
4 users (show)

Fixed In Version: gnome-keyring-2.26.3-1.fc11
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-07-23 08:52:30 UTC
Type: ---


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
GNOME Bugzilla 576700 Normal RESOLVED SSH key not working via gnome-keyring / gnome-terminal 2020-10-01 17:23:20 UTC

Description Andrew Hall 2009-06-26 12:44:12 UTC
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b4) Gecko/20090427 Fedora/3.5-0.20.beta4.fc11 Firefox/3.5b4

Since upgrading from F10 to F11 the gnome-keyring application's built in ssh-agent causes major issues with RSA key authentication.

If you attempt to connect to a server using an RSA key you see these errors server side:

Jun 24 10:56:10 uk00pba001 sshd[12128]: error: RSA_public_decrypt failed: error:0407006A:lib(4):func(112):reason(106)
Jun 24 10:56:10 uk00pba001 sshd[12128]: error: RSA_public_decrypt failed: error:04067072:lib(4):func(103):reason(114)

Which further investigation means:

# openssl errstr 0407006A
error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
# openssl errstr 04067072
error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed

If you then disable the ssh-agent with gconf-editor (apps/gnome-keyring/daemon-components) and use a different ssh-agent instead (I chose to use keychain by creating a .keychainrc file in my home dir) then all is well again.

I assume keychain uses the ssh-agent included with the openssh-clients package but I'm not sure.

N.B. I have observed this behaviour now on three machines - all upgraded from F10 to F11 using preupgrade if that has any relevance.

Version: gnome-keyring-2.26.1-1.fc11.i586 

Reproducible: Always

Steps to Reproduce:
1. Ensure the ssh-agent aspect of gnome-keyring is enabled.
2. Attempt to connect to an SSH server using RSA key authentication.
3. It results in failure.
4. Disable the ssh-agent aspect of gnome-keyring.
5. Enable keychain.
6. Attempt to connect to an SSH server using RSA key authentication.
7. It results in success.
Actual Results:  
Using gnome-keyring results in failure.

Using keychain results in success.

Expected Results:  
You should be able to connect using gnome-keyring with RSA keys.

Please note that prior to the upgrade and using the exact same key there were no problems whatsoever.

Comment 1 Maurits Lucas 2009-07-21 09:34:05 UTC
I have exactly the same problem, also on a machine that was upgraded from FC10 to FC11 using preupgrade.

Comment 2 Tomáš Bžatek 2009-07-22 15:40:25 UTC
This looks like https://bugzilla.gnome.org/show_bug.cgi?id=576700

Can you please grab gnome-keyring-2.26.3-1.fc11 from updates-testing
(`yum upgrade --enablerepo=updates-testing gnome-keyring` should do the trick) and try it again?

https://admin.fedoraproject.org/updates/F11/FEDORA-2009-7282

Comment 3 Andrew Hall 2009-07-22 16:49:47 UTC
Great - that seems to have fixed it !

Should I edit the bug in any other manner (apart from this comment) or leave that to yourself ?

Thanks.

Comment 4 Tomáš Bžatek 2009-07-23 08:52:30 UTC
Closing as fixed. If the problem persists, feel free to reopen this bug.

Feel free to drop a comment in https://admin.fedoraproject.org/updates/F11/FEDORA-2009-7282 to help pushing the update to stable.


Note You need to log in before you can comment on or make changes to this bug.