3

What could be the reason that ssh < host > is asking for public key password

Enter passphrase for key '/home/%d/.ssh/id_rsa.pub':

even if provided a good password?

I have no problem with pkcs11 pam module login when I specific a provider and I have no problem when I add key via ssh-add

100% it's a client side problem could be that ssh agent is catching request?

Do you mean, that you're constantly asked for the password, and not even the correct password is accepted? What exactly do you mean with "when i specific a provider" .. ? gerhard d

$ ssh {host}
Enter passphrase for key '/home/%d/.ssh/id_rsa.pub': 
Enter passphrase for key '/home/%d/.ssh/id_rsa.pub': 
Enter passphrase for key '/home/%d/.ssh/id_rsa.pub': 
Permission denied (publickey).


$ ssh-add
Enter passphrase for /home/%d/.ssh/id_rsa: 
Identity added: /home/%d/.ssh/id_rsa (/home/%d/.ssh/id_rsa)

$ ssh {host}
logged in 

after reboot I can't ssh as enter passphrase failed but I can add key to agent or ssh via pkcs11

$ ssh -I /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so {host}
Enter PIN for 'PIV_II (PIV Card Holder pin)': 
...
logged in

ps. distro = debian sid , %d is my home folder

solution -> change ssh config entry:

as Jakuje wrote the problem was in wrong ssh config file entry

# ~/.ssh/config

Host {host}
    IdentityFile  ~/.ssh/id_rsa.pub   # should be ~/.ssh/id_rsa 
3
  • Do you mean, that you're constantly asked for the password, and not even the correct password is accepted? What exactly do you mean with "when i specific a provider" .. ?
    – gerhard d.
    Jun 16, 2016 at 16:02
  • @gerhardd. see edit
    – ceph3us
    Jun 16, 2016 at 17:16
  • Related to the continuous asking for a passphrase: unix.stackexchange.com/questions/251194/…
    – Jakuje
    Jun 16, 2016 at 19:21

1 Answer 1

6

You probably have in your ssh_config in ~/.ssh/config a line like

Host *
  IdentityFile /home/%d/.ssh/id_rsa.pub

or similar. This have two problems. Substitution %d means whole home directory and IdentityFile option should get the private key, not the public one.

The reason why it asks for passphrase is described in this upstream bug (in short, OpenSSH does not validate the errors returned from OpenSSL and every error interprets as a bad passphrase) and it should be fixed in the next update.

Or you might have some similar alias trying to use this key? What is the output of type ssh?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .