3

What could be the reason that ssh < host > is asking for public key password

Enter passphrase for key '/home/%d/.ssh/id_rsa.pub':

even if provided a good password?

I have no problem with pkcs11 pam module login when I specific a provider and I have no problem when I add key via ssh-add

100% it's a client side problem could be that ssh agent is catching request?

Do you mean, that you're constantly asked for the password, and not even the correct password is accepted? What exactly do you mean with "when i specific a provider" .. ? gerhard d

$ ssh {host}
Enter passphrase for key '/home/%d/.ssh/id_rsa.pub': 
Enter passphrase for key '/home/%d/.ssh/id_rsa.pub': 
Enter passphrase for key '/home/%d/.ssh/id_rsa.pub': 
Permission denied (publickey).


$ ssh-add
Enter passphrase for /home/%d/.ssh/id_rsa: 
Identity added: /home/%d/.ssh/id_rsa (/home/%d/.ssh/id_rsa)

$ ssh {host}
logged in 

after reboot I can't ssh as enter passphrase failed but I can add key to agent or ssh via pkcs11

$ ssh -I /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so {host}
Enter PIN for 'PIV_II (PIV Card Holder pin)': 
...
logged in

ps. distro = debian sid , %d is my home folder

solution -> change ssh config entry:

as Jakuje wrote the problem was in wrong ssh config file entry

# ~/.ssh/config

Host {host}
    IdentityFile  ~/.ssh/id_rsa.pub   # should be ~/.ssh/id_rsa 
  • Do you mean, that you're constantly asked for the password, and not even the correct password is accepted? What exactly do you mean with "when i specific a provider" .. ? – gerhard d. Jun 16 '16 at 16:02
  • @gerhardd. see edit – ceph3us Jun 16 '16 at 17:16
  • Related to the continuous asking for a passphrase: unix.stackexchange.com/questions/251194/… – Jakuje Jun 16 '16 at 19:21
6

You probably have in your ssh_config in ~/.ssh/config a line like

Host *
  IdentityFile /home/%d/.ssh/id_rsa.pub

or similar. This have two problems. Substitution %d means whole home directory and IdentityFile option should get the private key, not the public one.

The reason why it asks for passphrase is described in this upstream bug (in short, OpenSSH does not validate the errors returned from OpenSSL and every error interprets as a bad passphrase) and it should be fixed in the next update.

Or you might have some similar alias trying to use this key? What is the output of type ssh?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.