bug#54950: Connecting to remote guix daemon with encrypted SSH key fails

[Maxim Cournoyer]

Hi Arun,

Arun Isaac <arunisaac@systemreboot.net> writes:

> Hi Maxim,
>
>> I suspect this is due to changes in OpenSSH *client* that now refuse
>> older RSA keys for security reasons.
>
> This doesn't seem to be. Here's why: I have another machine that I ssh
> to using an unencrypted RSA key. I am able to connect to the Guix daemon
> on that machine without any trouble. What's more, the machine with an
> encrypted key, whose Guix daemon I'm unable to connect to, uses an ECDSA
> key.
>
>> Could you retry with the following option: 'StrictHostKeyChecking no'
>> applied to the host in your ~/.ssh/config?
>
> Adding 'StrictHostKeyChecking no' makes no difference. The unencrypted
> key still works, and the encrypted doesn't.

Thanks for checking.  Other things to try:

Kill pinentry, which is potentially waiting for the passphrase on the
wrong X11 display or tty, for example if you accessed the machine via
SSH:

killall pinentry

I don't know which ssh agent you use; I use the 'gpg-agent' provided by
GnuPG.  info '(gnupg) Common Problems' has this:

   * SSH hangs while a popping up pinentry was expected

     SSH has no way to tell the gpg-agent what terminal or X display it
     is running on.  So when remotely logging into a box where a
     gpg-agent with SSH support is running, the pinentry will get popped
     up on whatever display the gpg-agent has been started.  To solve
     this problem you may issue the command

          echo UPDATESTARTUPTTY | gpg-connect-agent

     and the next pinentry will pop up on your display or screen.
     However, you need to kill the running pinentry first because only
     one pinentry may be running at once.  If you plan to use ssh on a
     new display you should issue the above command before invoking ssh
     or any other service making use of ssh.

It seems this gotcha would also apply to other SSH agents.  I've had
this problem in the past, when SSH'in to a remote machine that had a
graphical session running, and killing the running pinentry and issuing
the above 'echo UPDATESTARTUPTTY | gpg-connect-agent' command did the
trick.

Let me know if this helps.

Maxim