Bug#621044: ssh -i id_file doesn't use encrypted pubkey file

[Mike Dornberger <Mike.Dornberger@gmx.de>]

Package: ssh
Version: 1:5.1p1-5
Severity: important

Hi,

the command

$ SSH_AGENT_PID= SSH_AUTH_SOCK= ssh -i ~/.ssh/mykey \
-o PasswordAuthentication=no -o ChallengeResponseAuthentication=no -o \
HostbasedAuthentication=no -o KbdInteractiveAuthentication=no -o \
PubkeyAuthentication=yes localhost

doesn't let me connect. Note that it doesn't also ask for a passphrase
for the key. The pubkey file works if I add it to a running ssh-agent.

I just stumbled upon the -v switch, the following excerpt (see below)
from

$ ssh -vvv localhost

might be interesting. For that test I included in ~/.ssh/config the
following stanza:

Host localhost
    IdentitiesOnly yes
    IdentityFile ~/.ssh/mykey

Excerpt from the -vvv run:

OpenSSH_5.1p1 Debian-5, OpenSSL 0.9.8g 19 Oct 2007
debug1: Reading configuration data /home/user/.ssh/config
debug1: Applying options for *
debug1: Applying options for localhost
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to localhost [127.0.0.1] port 22.
debug1: Connection established.
debug3: Not a RSA1 key file /home/user/.ssh/mykey
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
 (repeated 24 times)
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/user/.ssh/mykey type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
 ...
debug1: Host 'localhost' is known and matches the RSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:5
debug2: bits set: 506/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/user/.ssh/mykey (0xXXXXXXXX)
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,gssapi,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/user/.ssh/mykey
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug2: input_userauth_pk_ok: fp XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
debug3: sign_and_send_pubkey
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]

Note the lines starting with "debug2: key_type_from_name: unknown key
type '-----BEGIN'". In a similar run without the key added to ssh-agent
I don't see lines like e. g. "debug1: Server accepts key: pkalg ssh-rsa
blen 277".

Greeting,
 Mike Dornberger

-- System Information:
Debian Release: 5.0.8
  APT prefers oldstable
  APT policy: (500, 'oldstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-2-686 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages ssh depends on:
ii  openssh-client                1:5.1p1-5  secure shell client, an rlogin/rsh
ii  openssh-server                1:5.1p1-5  secure shell server, an rshd repla

ssh recommends no packages.

ssh suggests no packages.

-- debconf information:
  ssh/insecure_rshd:
  ssh/privsep_ask: true
* ssh/user_environment_tell:
* ssh/forward_warning:
  ssh/insecure_telnetd:
  ssh/new_config: true
* ssh/use_old_init_script: true
  ssh/rootlogin_warning:
* ssh/upgrade_to_openssh: true
* ssh/SUID_client: true
  ssh/disable_cr_auth: false
* ssh/protocol2_default:
* ssh/privsep_tell:
* ssh/ssh2_keys_merged:
  ssh/ancient_version:
  ssh/protocol2_only: true
  ssh/encrypted_host_key_but_no_keygen:
* ssh/run_sshd: true