Bug 2306 - ssh-add 6.7 inserts RSA keys into the ssh-agent as "rsa w/o comment" instead of filenames
Summary: ssh-add 6.7 inserts RSA keys into the ssh-agent as "rsa w/o comment" instead ...
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-add (show other bugs)
Version: 6.7p1
Hardware: Other Linux
: P5 normal
Assignee: Assigned to nobody
URL:
Keywords:
: 2442 (view as bug list)
Depends on:
Blocks: V_6_8
  Show dependency treegraph
 
Reported: 2014-11-06 01:34 AEDT by Daniel Kahn Gillmor
Modified: 2015-08-07 13:07 AEST (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Kahn Gillmor 2014-11-06 01:34:43 AEDT
as of version 6.7 (the first version i noticed this in), it looks to me
like adding ssh keys to ssh-agent marks them all as "rsa w/o comment",
instead of putting the filename as the comment.

This appears to be because of the key function overhaul in
8668706d0f52654fe64c0ca41a96113aeab8d2b8.

ssh-add.c loads the secret keys via library-like invocations of
functions in sshkey.c, and if the comment returned is NULL, it sets the
comment to be the filename.

But in practice, these functions now return "rsa w/o comment" as the
comment, so the filename never gets applied as a comment.

Possible ways to fix:

 * One fix would be to have the functions return a NULL for the comment.

 * Another fix would be to have ssh-add just override the comment
   explicitly. 

 * A third fix would be to pass a "proposed comment" into the
   library-like call, which could be overridden by future versions if
   they're aware of a superior comment after having parsed the key.

I also note that there is no way for a user of ssh-add to explicitly set
the comment directly -- adding something like that would be a distinct
feature, i think.
Comment 1 Damien Miller 2015-01-09 00:21:12 AEDT
Fixed:

commit 1195f4cb07ef4b0405c839293c38600b3e9bdb46
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jan 8 10:14:08 2015 +0000

    upstream commit
    
    deprecate key_load_private_pem() and
     sshkey_load_private_pem() interfaces. Refactor the generic key loading API to
     not require pathnames to be specified (they weren't really used).
    
    Fixes a few other things en passant:
    
    Makes ed25519 keys work for hostbased authentication (ssh-keysign
    previously used the PEM-only routines).
    
    Fixes key comment regression bz#2306: key pathnames were being lost as
    comment fields.
    
    ok markus@
Comment 2 Damien Miller 2015-03-18 18:17:02 AEDT
openssh-6.8 is released
Comment 3 Vincent Lefevre 2015-08-07 13:07:10 AEST
*** Bug 2442 has been marked as a duplicate of this bug. ***