Red Hat Bugzilla – Bug 508286
gnome-keyring ssh-agent breaks RSA key authentication
Last modified: 2015-03-03 17:40:30 EST
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b4) Gecko/20090427 Fedora/3.5-0.20.beta4.fc11 Firefox/3.5b4
Since upgrading from F10 to F11 the gnome-keyring application's built in ssh-agent causes major issues with RSA key authentication.
If you attempt to connect to a server using an RSA key you see these errors server side:
Jun 24 10:56:10 uk00pba001 sshd: error: RSA_public_decrypt failed: error:0407006A:lib(4):func(112):reason(106)
Jun 24 10:56:10 uk00pba001 sshd: error: RSA_public_decrypt failed: error:04067072:lib(4):func(103):reason(114)
Which further investigation means:
# openssl errstr 0407006A
error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
# openssl errstr 04067072
error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed
If you then disable the ssh-agent with gconf-editor (apps/gnome-keyring/daemon-components) and use a different ssh-agent instead (I chose to use keychain by creating a .keychainrc file in my home dir) then all is well again.
I assume keychain uses the ssh-agent included with the openssh-clients package but I'm not sure.
N.B. I have observed this behaviour now on three machines - all upgraded from F10 to F11 using preupgrade if that has any relevance.
Steps to Reproduce:
1. Ensure the ssh-agent aspect of gnome-keyring is enabled.
2. Attempt to connect to an SSH server using RSA key authentication.
3. It results in failure.
4. Disable the ssh-agent aspect of gnome-keyring.
5. Enable keychain.
6. Attempt to connect to an SSH server using RSA key authentication.
7. It results in success.
Using gnome-keyring results in failure.
Using keychain results in success.
You should be able to connect using gnome-keyring with RSA keys.
Please note that prior to the upgrade and using the exact same key there were no problems whatsoever.
I have exactly the same problem, also on a machine that was upgraded from FC10 to FC11 using preupgrade.
This looks like https://bugzilla.gnome.org/show_bug.cgi?id=576700
Can you please grab gnome-keyring-2.26.3-1.fc11 from updates-testing
(`yum upgrade --enablerepo=updates-testing gnome-keyring` should do the trick) and try it again?
Great - that seems to have fixed it !
Should I edit the bug in any other manner (apart from this comment) or leave that to yourself ?
Closing as fixed. If the problem persists, feel free to reopen this bug.
Feel free to drop a comment in https://admin.fedoraproject.org/updates/F11/FEDORA-2009-7282 to help pushing the update to stable.