pahaz / sshtunnel

SSH tunnels to remote server.
MIT License
1.23k stars 184 forks source link

ERROR | Password is required for key /home/me/.ssh/id_rsa #255

Open dale-wahl opened 2 years ago

dale-wahl commented 2 years ago

I have seen similar problems resulting in ValueErrors, but I am having a problem with my rsa key and unsure how to get sshtunnel to accept my password.

server = SSHTunnelForwarder('server', ssh_pkey='~/.ssh/id_rsa', ssh_private_key_password='mypassword', remote_bind_address=('127.0.0.1',3306))
2022-02-23 10:00:05,394| ERROR   | Password is required for key /home/me/.ssh/id_rsa

The password is correct and key file exists. I have checked and the key uses the -----BEGIN RSA PRIVATE KEY----- designation at the start. I also ensured my ssh-agent was started and the key was added per this StackOverflow thread. I have also tried with allow_agent=False per the docs.

I am on Windows 10 and have tried both natively and using the Linux subsystem.

Any idea what could be causing the ERROR | Password is required for key /home/me/.ssh/id_rsa?

akrasnov-marfatech commented 2 years ago

i have same issue

sebgiles commented 2 years ago

+1

nsepetys commented 2 years ago

Any idea what could be causing the ERROR | Password is required for key /home/me/.ssh/id_rsa?

@dale-wahl - I think I determined why the issue is happening. Paramiko only supports a few ciphers for the private key. If you don't have one of these key types here (as manually checked here in this repo) then it won't be able to use the private key.

Short of this paramiko issue getting attention I don't think sshtunnel is going to build out support for this. One idea is to use openssh commandline to decrypt your private key before handing off to sshtunnel but that obviously comes with additional security problems so do at your own risk.

johnww2-nwxg commented 2 years ago

I see this log message, but it does not prevent my tunnel from working. I had a very old id_dsa file in my ~/.ssh which I was not using.

Renaming this file to DISABLE_id_dsa makes the ERROR log message stop happening, tunnel still works.