briandfoy / net-ssh-perl

Development on the Net::SSH::Perl module to support latest ciphers, key exchange mechanisms, etc.
Other
4 stars 1 forks source link

Net::SSH::Perl misreads my keyfile - MacOS 12, OpenSSH 8.6 #74

Open lordfeck opened 8 months ago

lordfeck commented 8 months ago

I'm having a problem when the module opens a new SSH connection, it looks like it is misreading the key format.

I have this line in my Perl code:

my $ssh = Net::SSH::Perl->new($host, debug => 1, version => '2');
$ssh->login($USERNAME);
$ssh->cmd('date');

When I run it, it croaks. An excerpt from the debug output:

OS2DAMAX.lan: Authentication methods that can continue: publickey.
OS2DAMAX.lan: Next method to try is publickey.
OS2DAMAX.lan: Trying pubkey authentication with key file '/Users/mjb/.ssh/id_rsa'
Wrong key type at /Users/mjb/perl5/perlbrew/perls/perl-5.38.0/lib/site_perl/5.38.0/darwin-2level/Net/SSH/Perl/Auth/PublicKey.pm line 81.

ssh-keygen reveals that my key is RSA format:

[0 mjb@OS2DAMAX nd-infrastructure %> ssh-keygen -l -f ~/.ssh/id_rsa
3072 SHA256:4PHAmhqaaCvcDv+G57b+0wOXq/RV/SNB/7hZ+9BvtT0 mjb@OS2DAMAX.lan (RSA)

Adding the following to the constructor didn't help, though it was a guess:

options => [ "HostKeyAlgorithms rsa-sha2-256" ]

My id_rsa file begins as follows:

-----BEGIN OPENSSH PRIVATE KEY-----

I've traced the code into Net::SSH::Perl::Key and it appears that the SSH module is attempting to read the key as ED25519

%OBJ_MAP = ( 
    'DSA PRIVATE KEY'  => [ 'DSA' ],
    'SSH2 ENCRYPTED PRIVATE KEY' => [ 'DSA', [ 'SSH2' ] ],
    'RSA PRIVATE KEY'  => [ 'RSA' ],
    'OPENSSH PRIVATE KEY'  => [ 'Ed25519' ],
    'EC PRIVATE KEY' => [ 'ECDSA' ],
);

I ran a fresh ssh-keygen and noted that generating Ed keys isn't the default, I wonder if there has been a change to the format? I will share the exact contents of a fresh keypair if that helps your investigation.

System details:

Using MacOS 12.7.1 and Perl 5.38

[127 mjb@OS2DAMAX nd-infrastructure %> ssh -V
OpenSSH_8.6p1, LibreSSL 3.3.6

The key works for normal SSH purposes, I can use it to login, run commands, do scp and git, etc.

briandfoy commented 8 months ago

Okay, I see this issue, but I know next to nothing about SSH's inner workings. If someone figures it out and supplies a patch, I can apply it and make a new release.

Since this module is on life support, if the actively maintained Net::OpenSSH might be a better option.