SSH 에이전트가 pkcs8 개인 키와 작동하지 않습니다

나는 openssl pkcs8 -topk8 -in id_rsa -out id_rsa_new -v2 des3(http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html)

하지만 이제 ssh-agent는 더 이상 작동하지 않습니다. SSH를 사용하여 컴퓨터에 연결하려고 하면:

OpenSSH_6.1p1 Debian-4, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.178.38 [192.168.178.38] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/damon/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /home/damon/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/damon/.ssh/id_rsa-cert type -1
debug1: identity file /home/damon/.ssh/id_dsa type -1
debug1: identity file /home/damon/.ssh/id_dsa-cert type -1
debug1: identity file /home/damon/.ssh/id_ecdsa type -1
debug1: identity file /home/damon/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-3ubuntu1
debug1: match: OpenSSH_6.0p1 Debian-3ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.1p1 Debian-4
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "192.168.178.38" from file "/home/damon/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/damon/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA d0:42:c3:a4:bb:2e:f0:cd:38:c1:32:d5:a5:ac:4c:d5
debug3: load_hostkeys: loading entries for host "192.168.178.38" from file "/home/damon/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/damon/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug1: Host '192.168.178.38' is known and matches the ECDSA host key.
debug1: Found key in /home/damon/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/damon/.ssh/id_rsa (0x7f15643f1e30)
debug2: key: /home/damon/.ssh/id_dsa ((nil))
debug2: key: /home/damon/.ssh/id_ecdsa ((nil))
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/damon/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp ee:e0:8c:60:ee:9f:05:4c:cd:0e:45:85:e2:91:64:95
debug3: sign_and_send_pubkey: RSA ee:e0:8c:60:ee:9f:05:4c:cd:0e:45:85:e2:91:64:95
Agent admitted failure to sign using the key.
debug1: Trying private key: /home/damon/.ssh/id_dsa
debug3: no such identity: /home/damon/.ssh/id_dsa
debug1: Trying private key: /home/damon/.ssh/id_ecdsa
debug3: no such identity: /home/damon/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

새로 설치된 Linux Mint 15 x64 VM 및 기타 여러 Linux Mint 설치에서 이것을 실행했지만 모두 연결할 수 없습니다.

다음은 pkcs8 암호화된 개인 키의 예입니다(공유하기 위해 생성했으니 걱정하지 마세요).

damon@DamonVirtual ~/.ssh $ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/damon/.ssh/id_rsa): id_rsa_test
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in id_rsa_test.
Your public key has been saved in id_rsa_test.pub.
The key fingerprint is:
f6:58:aa:43:c4:08:51:54:34:e5:5a:76:ae:ed:bd:30 damon@DamonVirtual
The key's randomart image is:
+--[ RSA 2048]----+
|  .+oo+..        |
|  .    o         |
|   . o  + .      |
|    . o+ o       |
|     .. S o      |
|      .. B       |
|     .  + E      |
|      .. . +     |
damon@DamonVirtual ~/.ssh $ openssl pkcs8 -topk8 -in id_rsa_test -out id_rsa_test_enc -v2 des3
Enter Encryption Password:
Verifying - Enter Encryption Password:
damon@DamonVirtual ~/.ssh $ chmod id_rsa_test_enc 600
chmod: Ungültiger Modus: »id_rsa_test_enc“
„chmod --help“ liefert weitere Informationen.
damon@DamonVirtual ~/.ssh $ chmod 600 id_rsa_test_enc
damon@DamonVirtual ~/.ssh $ cat id_rsa_test_enc
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIsRD8OicdxA0CAggA
MBQGCCqGSIb3DQMHBAhpBxvnSmEyaQSCBMj1vvjrx3KiEa++l1xtDDimOPXDqrh6
AAQBZGBBgDNX7OqmqDK6gvbliZUsYEBdbxA8g53tQe168tmXw6RbpDUqwRT0N8MU
an5pBJkOd1nT9TGFivhvBVRLeoCko9jmrcia38/Cc4D088rirYbTOdi47qB88zin
WVxNVCXTAB2IXAvgSVuYlbzRku++OCZAY4YI+4Q8diY1pnY5rMVNc1eTknMp2Gyc
s+37nVpc2Xz3kI1T/2yiJEkOucyyNxbvKfDdmkhxYnflghjQAIFZXhALgGwTAeD+
SkuCpHCyQ6Rw+X/lSvsyj9RNpioF51iTMazy1NbDSyv8FaB+cF8QLC9wz9hHZ3yV
xiNVy38yVwMDr4OudXB+qjc8nDSjQdK5Ade8OWQZS7KXiT0K0wdGYn6NSGuoJTU3
UI9m+Glwv5JI5WE9nUm2GyZzUTujhH7lzJKw/20/IhosrS78/TVWUJ5MW5jNrDz+
raKG9jTLjEirhQFvCowh2oYJUxq0Fmh5d2Iskq19rVdL8iDMyZMJxfsiKTxd6TcK
uGtFkX+IS80Is6r2ZnDsQwlMiKw1pZ223JAQvLHX6baBvoDGr7vSeb4m91G4DYOK
gzdAICHuX0bIXbPhNxfkpstakdvrR2Fz1QNpInTO8K4fQ9dqnCyeiferbzpEkhVD
BVVNRcBVynGPWs6SwBTkRW7D5tWNdFA/ngVkqDDnYaw+/xiaKPF3T/gtOzjEvkgA
CYxBrO+Y1Y6eVA4wD+U9f/6mfA55xf95P+BQ31GT8NoGv0F+3fuY/NGdTkWP0bg7
yhihlRshdt7it+AycDj+cKATjqOcFJpP5nDu0wSciSWAaHAakZl1aK6+qaCUnzGy
9nYZUrTyYk2dLSBP7XI5aVvmk4tzT5Rq9XxV/6Gi48lfe+uqGi2Q46IMxLqxaC1Q
pwNEMlDAiK3zMrxvhQ6YXbTROFEgjeZArzoYwDkbwv9ra8nOslmkXcAz2pYQQQJc
Jv49rtL4kS+L44/koekIk22GMajbSpTdskkieKewQVYhrPbgaBXZfyYvobshCGI9
3qwNEg3ZWhkvAtypMcXX3oflVm54NYXnQ8INk8MPqABrTZtM4VGrKunNa0rCOo8e
ULxgAcsBcZMbe6iI1lB3v+fP7hq8ceQW7oi0/8LS3inz2f3iz7SDKF0c1B1obr0l
u9dJcv6ijXU9Vvv0kejo/C1jx7vsl9q7lp0GLDer003htYNOqrc9GHc7laCh7JlB
R9Lf9IlZjEFTGD6UOJw+2L14j3QTKyLoXwQS+hTXVI7GBBaJq1SuPcCxieSjK5d4
HlkrkO7/iMKEDCwPv8Wp6ZPUowywrP5j4IH51Nk9vuN+DhmCONMjHlJLZLgCJWtm
cfpSlwRI9E86zQlZR2vrlKeHChXtm1kOGp3mkpvRwmu4gZLAQZhNo8TRCNWfQZuj
YhoYdewQJnoemHGk0bKoDA6IqQZMhlfKP2KcnmDWwLQn/rb1VudbbnHSNMF1vCt0
X/lXverUxO8PlNnmhY/D6omah53laGloGHZo/7NHnaa468rNEZyIPYw14XbZaI5A
RlNo9uT2IhJOtSKWqiBioD4YZtjciSkvmUYfC8x4cVqVWd69VuzfxaKpEjp3OzlG
bQw=
-----END ENCRYPTED PRIVATE KEY-----
damon@DamonVirtual ~/.ssh $ cat id_rsa_test.pub
ssh-rsa  AAAAB3NzaC1yc2EAAAADAQABAAABAQDNms5/HhVr903+uIFM1BTQwOz8lYWyKQsnttkyvxtrfdnJe3EEwBjKjXlipTMYgLl2gi5Lt63f3esHYT0IBwN4DPz9BdYkb3vqsPSdouV2N45/S7w6dwwx2BJ/yP35r2G91ckOiHQSioDWFDbWQMYNrHrbAAtk6QbZthwMyKFK59iGCRltAxyq2/EPU6dkoyq8AWDZao+i65AQjIfDQ5vqHhPPZo80j5q8XNWP6E8oVx+hwUiYZ/hEHLR5KWMZyG0MVzDZICs9qMruIDA9YASl9DTNc72+5L5b1Ct5rTYGeq+5bMue9w7GVCFu/6ahPUwyNI17SW8Fsu6hF/HxbgnR damon@DamonVirtual

이 암호화된 패스는 123456789입니다. 키를 생성하고 암호화할 때 내가 범하는 실수를 누구든지 알아낼 수 있나요?

(다시 말하지만, 이것은 내 개인 개인 키가 아닙니다. 방금 테스트 목적으로 이 개인 키를 생성했습니다. 이것은 내 Authorized_keys 파일에 없으며 디버그 출력은 동일한 방식으로 생성된 다른 키를 사용하여 나온 것입니다.)

내가 실패했나요, 아니면 ssh-agent가 실패했나요? 비밀번호 프롬프트가 표시되지 않아 ssh-agent가 키가 암호화되었음을 인식하지 못하는 것 같습니다. 하지만 을 사용하여 에이전트에 추가할 수 있으며 ssh-add id_rsa비밀번호를 묻는 메시지가 표시되고 작동합니다. .

편집하다

나는 무슨 일이 일어나고 있는지 알고 있다고 생각합니다. ssh-agent는 SSH 키를 자동으로 추가하려고 시도합니다. 이렇게 하면 비참하게 실패합니다. 이 실패는 제거할 수 없는 ID로 표시됩니다. 노력하다 ssh-add -D && ssh-add -l. 나머지 ID가 반환되면 ssh-agent가 뭔가 잘못하고 있는 것입니다.내 생각에는 ssh-agent가 키를 자동으로 추가할 때 암호 해독이 엉망이 되는 것 같습니다.

내 해결책은 이런 일이 발생하지 않도록 방지하는 것입니다.

• 모든 개인 키를 ot 밖으로 이동~/.ssh
• 재시작
• SSH 키 쌍을 생성하고,에 보관하지 마십시오 ~/.ssh!
• openssl을 사용하여 "평소와 같이" 개인 키를 암호화합니다.
• 암호화된 개인 키를 다음 위치로 이동하세요.~/.ssh
• ssh-add /path/to/file당신의 개인 키

이제 암호화 비밀번호를 입력하라는 메시지가 표시됩니다.

중요한:

• ssh-agent에 이미 존재하는 키 파일 이름을 사용하지 마십시오. 알려진 파일 이름을 계속해서 자동으로 추가하려고 시도하여 이러한 끔찍한 실패를 일으키는 것 같습니다.
• 알려진 지문이 있는 개인 키를 사용하지 마십시오. ssh-agent는 어떻게든 자동으로 추가합니다...
• ~/.ssh이 단계를 수행하기 전에 절대 개인 키가 없는지 확인하십시오.
• ssh-agent에 캐시된 개인 키가 전혀 없는지 확인하세요.

~/.ssh 또는 ssh-agent에 키가 남아 있으면 실패합니다. ssh-add를 사용하여 키가 올바르게 추가되면 암호화 비밀번호를 묻는 메시지가 표시되고 ~/.ssh 또는 ssh-agent에 다른 키가 없으므로 다른 키를 추가해도 괜찮은 것 같습니다.

때때로 나는 이런 종류의 일을 하는 특별한(때때로 레거시) 패킷 때문에 Linux를 싫어합니다.