mainSavannah Administration - Support: sr #109210, I can't connect to my repository...

 
 

sr #109210: I can't connect to my repository via ssh, but cvs can?

Submitter:  Michael Pagan <pegzmasta>
Submitted:  Tue 27 Dec 2016 10:48:42 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  agn
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sun 05 Feb 2017 12:33:30 AM UTC, comment #6: 

Excellent! :-)

Bob Proulx <rwp>
Site Administrator
Sat 04 Feb 2017 11:28:16 PM UTC, comment #5: 


> Because scp is part of ssh and uses ssh it uses ssh rsa keys not passwords.


I did not know that scp was part of ssh.  I understand the process a lot better now.  Also, I started using the prune option (-P) with cvs; makes sense to keep deleted files in the cvs history in case someone wants to checkout an older tagged version.

> "Interactive shell login is not possible for security reasons. VCS commands are allowed"


Yes, if I saw that message then I would have found out sooner why I wasn't able to ssh into the vcs.  I followed the Savannah docs for setting up an ssh-key and configuration, but that was almost 2 years ago (when I first made my account).

You explained everything very thoroughly-- thank you!  The problem is solved, so you can close both tickets now.

Michael Pagan <pegzmasta>
Sat 04 Feb 2017 09:22:23 PM UTC, comment #4: 

After seeing your other ticket 109246 I wanted to ask here what the status of this problem is for you. All okay now?

My summary of your problem report is that users are allowed to run version control commands such as cvs commands (or svn or git or others) but are not allowed general ssh shell access.  The vcs server is reserved for vcs commands and not a command line host. That is why you can connect using cvs for a version control command but not using ssh for a full shell. That is what the error message is telling you.

It is sometimes useful for us to use command line ssh as a debugging tool just the same. Because if it tells you that message then we know things about what parts are working and what parts are not working. Making that useful for debugging.

Because scp is part of ssh and uses ssh it uses ssh rsa keys not passwords. Passwords are not used at Savananah. Instead ssh rsa keys are used. On your client side your ssh rsa key will have a passphrase encrypting it. What you have been entering into your client is your ssh rsa decryption passphrase to unlock your ssh rsa key for authentication at Savannah. Savannah doesn't see the passphrase in that case. Your ssh client sees the passphrase and uses it to unlock the rsa key and then it sends the rsa key.  Savannah sees the rsa key.

When you try to connect directly to vcs.savannah.gnu.org using ssh this first challenges for an rsa "pubkey" key. Something wrong happened there because you did not see the "Interactive shell login is not possible for security reasons. VCS commands are allowed" message. Because you did not see that message we suspect some problem with your ssh configuration. Therefore the request for debug testing of it. However because cvs directly works I would simply stop there now that you know command line access is not allowed. There was some initial error but I don't think it is worth trying to figure it out. I looked at your log of it and your rsa key was rejected which is the root cause of that problem. I don't know why. Maybe there was a transient network failure on the internal network between the vcs system and the database account server. It is impossible to know after all of this time.

Meanwhile the original reason you were asking was:

> I was attempting to log in via ssh, so I can delete an empty directory which used to contain a duplicate file. I needed to do this via ssh, since [cvs can't remove empty directories]


That is simply a basic limitation of cvs. On the cvs server side of things there is an Attic directory which holds deleted files.  That way the history can be browsed. That way older tagged versions can be checked out. Otherwise they couldn't be and people would no longer be able to check out older tagged versions.

As the reference you cited notes the usual thing is to use the cvs update -P option.  That tells cvs update to prune empty directories. Then in your local copy they will not be present. I put that in my ~/.cvsrc file.

If you have something wrong with your repository that needs more than this then please let us know. One of us will look at your repository and do whatever needs to be done to it. That is fine. It is okay to ask us to help you on the server side of things.

I am hoping this helps explain what is happening. Please let us know if you have your problem solved or not. The ticket is still open on it.



Bob Proulx <rwp>
Site Administrator
Wed 28 Dec 2016 11:12:29 PM UTC, comment #3: 


> First,
> On our servers I see there is one ssh public key configured for you. Please
> double-check on your computer that the fingerprint matches the following:
>     e8:[...]:72:b7
> using
>     ssh-keygen -l -f ~/.ssh/id_rsa.pub

I confirm: My ssh key fingerprint starts with `e8' and ends with
`72:b7' using the suggested command.

> Second,
> Read-only CVS connections to savannah do not use SSH at all (that is, using
> anonymous cvs in pserver mode listening on tcp port 2401).
> So I'm not sure what exactly is and isn't working.

I was not using anonymous checkout, I used the admin checkout.  The
following command and it's output indicates that the ssh server is
started when I checkout my repository (perhaps I'm interpreting it
wrong, but that's what it looks like):

$ cvs -t -d:ext:pegzmasta@cvs.savannah.nongnu.org:/sources/genshiken co genshiken |& grep ssh
 -> Starting server: ssh -l pegzmasta cvs.savannah.nongnu.org cvs server

> Third,
> <snip>
> Can you please try to connect with SSH to the following two hosts:
>
>     $ host vcs.savannah.gnu.org
>     vcs.savannah.gnu.org has address 208.118.235.72
>     $ ssh -email is unavailable-


Trying the first host, `vcs':

$ host vcs.savannah.gnu.org
vcs.savannah.gnu.org has address 208.118.235.72

$ ssh -email is unavailable-
Linux vcs.savannah.gnu.org 2.6.32-5-xen-686 #1 SMP Fri Feb 5 18:24:28 UTC 2016 i686

Interactive shell login is not possible for security reasons.
VCS commands are allowed.
You tried to execute:
Sorry, you are not allowed to execute that command.
Connection to vcs.savannah.gnu.org closed.

> and
>
>     $ host vcs0.savannah.gnu.org
>     vcs0.savannah.gnu.org has address 208.118.235.201
>     $ ssh -email is unavailable-

> And tell us what are the results ?


Trying the second host, `vcs0':

$ host vcs0.savannah.gnu.org
vcs0.savannah.gnu.org has address 208.118.235.201

$ ssh -email is unavailable-
The authenticity of host 'vcs0.savannah.gnu.org (208.118.235.201)' can't be established.
ECDSA key fingerprint is 65:b8:1c:2f:82:7c:0e:39:e1:4a:63:f2:13:10:e8:9c.
Are you sure you want to continue connecting (yes/no)? yes
yes
Warning: Permanently added 'vcs0.savannah.gnu.org' (ECDSA) to the list of known hosts.
Warning: the ECDSA host key for 'vcs0.savannah.gnu.org' differs from the key for the IP address '208.118.235.201'
Offending key for IP in /home/pagan/.ssh/known_hosts:11
Are you sure you want to continue connecting (yes/no)? no
no
Host key verification failed.

*After receiving that error, I removed the "Offending key" with the
following command:*

$ sed -i '11d' /home/pagan/.ssh/known_hosts

*Afterwords, I tried again and received what I believe are the correct
results:*


$ host vcs0.savannah.gnu.org
vcs0.savannah.gnu.org has address 208.118.235.201

$ ssh pegzmasta@vcs0.savannah.gnu.org
Welcome to Trisquel GNU/Linux 7.0, Belenos (GNU/Linux 3.13.0-105-generic x86_64)
   ___        ___               ___        ___       ___        ___        ___
  /\  \      /\  \      ___    /\  \      /\  \     /\__\      /\  \      /\__\
  \ \  \    /  \  \    /\  \  /  \  \    /  \  \   / /  /     /  \  \    / /  /
   \ \  \  / /\ \  \   \ \  \/ /\ \  \  / /\ \  \ / /  /     / /\ \  \  / /  /
   /  \  \/  \ \ \  \  /  \__\ \ \ \  \/ /  \ \  \ /  /  ___/  \ \ \  \/ /  /
  / /\ \__\/\ \ \ \__\/ /\/__/\ \ \ \__\/__/ \ \__\__/  /\__\/\ \ \ \__\/__/
 / /  \/__/_|  \/ /  / /  /\ \ \ \ \/__/\  \ / /  /  \ / /  /\ \ \ \/__/\  \
/ /  /      | |  /  / /__/  \ \ \ \__\ \ \/\/ /  / \  / /  /\ \ \ \__\ \ \  \
\/__/       | |\/__/\ \__\   \ \/ /  /  \    /  / \ \/ /  /  \ \ \/__/  \ \  \
            | |  |   \/__/    \  /  /    \  /  /   \  /  /    \ \__\     \ \__\
             \|__|             \/__/      \/__/     \/__/      \/__/      \/__/

Welcome to Trisquel GNU/Linux
Documentation: http://trisquel.info/wiki/

  The programs included with the Trisquel GNU/Linux system are free software.
  The exact distribution terms for each program are described in the individual
  files in /usr/share/doc/*/copyright.

  Trisquel GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted
  by applicable law.


  The programs included with the Trisquel GNU/Linux system are free software.
  The exact distribution terms for each program are described in the individual
  files in /usr/share/doc/*/copyright.

  Trisquel GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted
  by applicable law.

Last login: Wed Dec 28 17:39:08 2016 from ool-2f149472.dyn.optonline.net
You tried to execute:
Sorry, you are not allowed to execute that command.
Connection to vcs0.savannah.gnu.org closed.


> If your SSH key is working, you should see the following message from both
> servers:
>
>      Interactive shell login is not possible for security reasons.
>      VCS commands are allowed.
>      Last login: Wed Dec 28 04:58:11 2016 from X.X.X.X
>      You tried to execute:
>      Sorry, you are not allowed to execute that command.
>      Connection to vcs.savannah.gnu.org closed.


I received this message from both servers.

> If you SSH key is not working, then on 'vcs' you should see immediately
> the message "Permission denied (publickey).",


I did not experience this.

> but on 'vcs0' you will be asked for a password (which will never be
> accepted).


I experienced this; however, I corrected that error with sed; tried again,
and then I received the working message: "_Sorry, you are not allowed to
execute that command_."  I don't know what caused the initial error?

> <snip>
> Lastly,
> You've mentioned you have been using 'scp' to store files on
> 'download.savannah.gnu.org' and you've been using a password to login - can
> you confirm this is what you meant, and it has worked for you in the
> past?


My mistake, I think the server was just verifying my identity using GPG,
and what I entered was actually my "_GPG Password_."

Michael Pagan <pegzmasta>
Wed 28 Dec 2016 05:15:39 AM UTC, comment #2: 

Hello Michael,

I'd like to take a step back and ask you to check few things in order, so we'll have better understanding of what's going on.

First,
On our servers I see there is one ssh public key configured for you. Please double-check on your computer that the fingerprint matches the following:
    e8:[...]:72:b7
using
    ssh-keygen -l -f ~/.ssh/id_rsa.pub


Second,
Read-only CVS connections to savannah do not use SSH at all (that is, using anonymous cvs in pserver mode listening on tcp port 2401).
So I'm not sure what exactly is and isn't working.

Third,
Because we are in the middle of transitioning to new servers for savannah, there are actually few different hosts that provide SSH access.

Can you please try to connect with SSH to the following two hosts:

    $ host vcs.savannah.gnu.org
    vcs.savannah.gnu.org has address 208.118.235.72
    $ ssh -email is unavailable-

and

    $ host vcs0.savannah.gnu.org
    vcs0.savannah.gnu.org has address 208.118.235.201
    $ ssh -email is unavailable-
 
And tell us what are the results ?

If your SSH key is working, you should see the following message from both servers:

     Interactive shell login is not possible for security reasons.
     VCS commands are allowed.
     Last login: Wed Dec 28 04:58:11 2016 from X.X.X.X
     You tried to execute:
     Sorry, you are not allowed to execute that command.
     Connection to vcs.savannah.gnu.org closed.

If you SSH key is not working, then on 'vcs' you should see immediately
the message "Permission denied (publickey).",
but on 'vcs0' you will be asked for a password (which will never be accepted).

To emphasize:
if you are asked for a password, it means you key is not working - password logins to savannah's SSH are not supported.


Lastly,
You've mentioned you have been using 'scp' to store files on 'download.savannah.gnu.org' and you've been using a password to login - can you confirm this is what you meant, and it has worked for you in the past?
I'm very surprised to hear this is working - password-based SSH logins should not be working on any savannah server.

regards,
 - assaf

Assaf Gordon <agn>
Site Administrator
Wed 28 Dec 2016 12:00:35 AM UTC, comment #1: 

I did not end the verbatim tag properly when I made this post via the tracker.  Some debugging information is provided below of my failure to connect via ssh (it asks for my password):


$ echo $CVS_RSH
ssh

$ ssh-keygen -lf ~/.ssh/id_rsa.pub
2048 e8:6f:38:b8:1b:7b:fe:9f:3b:92:d5:2c:6e:93:72:b7  pagan@pagan-Libreboot-X200 (RSA)

# sudo ssh -v pegzmasta@cvs.savannah.gnu.org
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to cvs.savannah.gnu.org [208.118.235.201] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Trisquel_GNU/linux_7.0-1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Trisquel_GNU/linux_7.0-1
debug1: match: OpenSSH_6.6.1p1 Trisquel_GNU/linux_7.0-1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 65:b8:1c:2f:82:7c:0e:39:e1:4a:63:f2:13:10:e8:9c
The authenticity of host 'cvs.savannah.gnu.org (208.118.235.201)' can't be established.
ECDSA key fingerprint is 65:b8:1c:2f:82:7c:0e:39:e1:4a:63:f2:13:10:e8:9c.
Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added 'cvs.savannah.gnu.org' (ECDSA) to the list of known hosts.
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
pegzmasta@cvs.savannah.gnu.org's password:

debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
pegzmasta@cvs.savannah.gnu.org's password:


debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
pegzmasta@cvs.savannah.gnu.org's password:
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).


Michael Pagan <pegzmasta>
Tue 27 Dec 2016 10:48:42 PM UTC, original submission:  

Good afternoon, Savannah Hackers:

My ssh public key is already registered at Savannah, which was one of
the first things I did when I made an account.  Whenever I instruct cvs
to checkout my repository at cvs.savannah.nongnu.org, an ssh
connection is established automatically; however, today I decided to
connect to the repository via ssh directly (without using cvs).  It
asked for my password, which I thought would be the same password I use
with `scp' to send files over to the Download Area of GNU Savannah... I
was wrong!

It asked me three times for the password, I typed it in, and it replied
with: "Permission denied."  The last response was: "Permission denied
(publickey,password)."  I was attempting to log in via ssh, so I can
delete an empty directory which used to contain a duplicate file.  I
needed to do this via ssh, since [cvs can't remove empty
directories][0].  I have read the official documentation for [ssh and
savannah][1], but I still can't figure it out?  I have no idea if this
has anything to do with the Savannah server migration, because this is
my first time trying to connect with ssh directly.

Last thing I should note: Connecting to cvs.savannah.nongnu.org via
cvs works just fine, for some reason?  So... cvs can connect as
pegzmasta, but pegzmasta can not connect as pegzmasta?  I'm confused.

[0]: http://www.network-theory.co.uk/docs/cvsmanual/Removingdirectories.html
[1]: http://savannah.gnu.org/maintenance/SshAccess/

Attached is a log file (seeing that it is over 2000 lines) containing
the verbose output of me successfully connecting to
cvs.savannah.nongnu.org via cvs; attached is another log file of my
failure to connect via ssh after several attempts (it no longer asks for
my password); some debugging information is provided below of my failure
to connect via ssh (it asks for my password):


$ echo $CVS_RSH
ssh

$ ssh-keygen -lf ~/.ssh/id_rsa.pub
2048 e8:6f:38:b8:1b:7b:fe:9f:3b:92:d5:2c:6e:93:72:b7  pagan@pagan-Libreboot-X200 (RSA)

# sudo ssh -v pegzmasta@cvs.savannah.gnu.org
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to cvs.savannah.gnu.org [208.118.235.201] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Trisquel_GNU/linux_7.0-1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Trisquel_GNU/linux_7.0-1
debug1: match: OpenSSH_6.6.1p1 Trisquel_GNU/linux_7.0-1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 65:b8:1c:2f:82:7c:0e:39:e1:4a:63:f2:13:10:e8:9c
The authenticity of host 'cvs.savannah.gnu.org (208.118.235.201)' can't be established.
ECDSA key fingerprint is 65:b8:1c:2f:82:7c:0e:39:e1:4a:63:f2:13:10:e8:9c.
Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added 'cvs.savannah.gnu.org' (ECDSA) to the list of known hosts.
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
pegzmasta@cvs.savannah.gnu.org's password:

debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
pegzmasta@cvs.savannah.gnu.org's password:


debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
pegzmasta@cvs.savannah.gnu.org's password:
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).
+verbatim+

Michael Pagan <pegzmasta>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #39322:  pegzmasta-cvs-checkout.log added by pegzmasta (118KiB - text/x-log - Debug Information Provided)
file #39323:  pegzmasta-ssh-fail.log added by pegzmasta (8KiB - text/x-log - Debug Information Provided)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by agn (Posted a comment)
  • -email is unavailable- added by pegzmasta (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-05 rwp Open/ClosedOpen Closed
    2016-12-28 agn Assigned toNone agn
    2016-12-27 pegzmasta Attached File- Added pegzmasta-cvs-checkout.log, #39322
        Attached File- Added pegzmasta-ssh-fail.log, #39323

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code