OpenSSH 6.8p1-1 and keychain: can't determine fingerprint

OpenSSH 6.8p1-1 and keychain: can't determine fingerprint

[White, W John (GE Transportation)]

After updating to OpenSSH 6.8p1-1, I experienced an issue where, at
every login, keychain (in my .bash_profile) wrote a warning:

My .bash_profile lines:
# Start keychain, passing as args all private keys to be cached
keychain ${HOME}/.ssh/id_dsa #, other_key1, other_key2, ...
# That creates a file which must be sourced to set env vars
source ${HOME}/.keychain/${HOSTNAME}-sh

The warning:
Can't determine fingerprint from the following line, falling back to filename

A post
( http://newscentral.exsees.com/item/d00c4734c9eed7abe32de6a741f5a3fe-8dd4abc7f69143e4ea63672f83a77a14 )
to an Arch Linux forum expressed a similar report, along with a solution,
adding a case for SHA256 or MD5:
https://github.com/funtoo/keychain/blob/master/keychain.sh#L692 .

For clarity, that's:
*\ SHA256:[0-9a-zA-Z\+\/=]*|*\ MD5:[0-9a-zA-Z\+\/=]*)
    # The new OpenSSH 6.8+ format,
    #   1024 SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE /home/barney/.ssh/id_dsa (DSA)
    echo "$ef_line" | cut -f2 -d' '
    ;;

I applied the changes to my /usr/bin/keychain, and the errors stopped.

I think this change belongs in Cygwin, too, since OpenSSH 6.8p1-1 .

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: OpenSSH 6.8p1-1 and keychain: can't determine fingerprint

[Kal Sze]

On 1 April 2015 at 21:03, wilson <wilson@ds.net> wrote:
>
> I saw the following on https://www.cygwin.com/ml/cygwin/2015-03/msg00477.html and I've been having the same issue with keychain. The fix to the /usr/bin/keychain shell script worked as shown, but I've added information about where the fix belongs (in the script) later in this message. I suggest correcting the indentations for the proposed fix as needed.
>
>> After updating to OpenSSH 6.8p1-1, I experienced an issue where, at every login, keychain (in my .bash_profile) wrote a warning:
>>
>> <snip>
>> The warning:
>> Can't determine fingerprint from the following line, falling back to filename
>>
>> A post (http://newscentral.exsees.com/item/d00c4734c9eed7abe32de6a741f5a3fe-8dd4abc7f69143e4ea63672f83a77a14 [1]) to an Arch Linux forum expressed a similar report, along with a solution, adding a case for SHA256 or MD5: https://github.com/funtoo/keychain/blob/master/keychain.sh#L692 [2].
>>
>> For clarity, that's:
>> * SHA256:[0-9a-zA-Z+/=]*|* MD5:[0-9a-zA-Z+/=]*)
>>     # The new OpenSSH 6.8+ format,
>>     # 1024 SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE /home/barney/.ssh/id_dsa (DSA)
>>     echo "$ef_line" | cut -f2 -d' '
>>     ;;
>>
>> I applied the changes to my /usr/bin/keychain, and the errors stopped. I think this change belongs in Cygwin, too, since OpenSSH 6.8p1-1.
>
>
> I applied this fix to the case statement (penultimate entry) in the extract_fingerprints() function (around line 800) and it does seem to work for me as well. I would recommend this be added as a permanent fix in Cygwin's package.
>
>
> --
> Problem reports:       http://cygwin.com/problems.html
> FAQ:                   http://cygwin.com/faq/
> Documentation:         http://cygwin.com/docs.html
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>

If you don't have to support multiple users (like me), just
downloading the 2.8.0 keychain script to your local path and sourcing
that that in .profile/.bash_profile is probably cleaner.

I seem to notice that keychain 2.8.0 is slower to load than 2.7.1 though.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: OpenSSH 6.8p1-1 and keychain: can't determine fingerprint

[wilson]

I saw the following on 
https://www.cygwin.com/ml/cygwin/2015-03/msg00477.html and I've been 
having the same issue with keychain. The fix to the /usr/bin/keychain 
shell script worked as shown, but I've added information about where the 
fix belongs (in the script) later in this message. I suggest correcting 
the indentations for the proposed fix as needed.

> After updating to OpenSSH 6.8p1-1, I experienced an issue where, at 
> every login, keychain (in my .bash_profile) wrote a warning:
> 
> <snip>
> The warning:
> Can't determine fingerprint from the following line, falling back to 
> filename
> 
> A post 
> (http://newscentral.exsees.com/item/d00c4734c9eed7abe32de6a741f5a3fe-8dd4abc7f69143e4ea63672f83a77a14 
> [1]) to an Arch Linux forum expressed a similar report, along with a 
> solution, adding a case for SHA256 or MD5: 
> https://github.com/funtoo/keychain/blob/master/keychain.sh#L692 [2].
> 
> For clarity, that's:
> * SHA256:[0-9a-zA-Z+/=]*|* MD5:[0-9a-zA-Z+/=]*)
>     # The new OpenSSH 6.8+ format,
>     # 1024 SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE 
> /home/barney/.ssh/id_dsa (DSA)
>     echo "$ef_line" | cut -f2 -d' '
>     ;;
> 
> I applied the changes to my /usr/bin/keychain, and the errors stopped. 
> I think this change belongs in Cygwin, too, since OpenSSH 6.8p1-1.

I applied this fix to the case statement (penultimate entry) in the 
extract_fingerprints() function (around line 800) and it does seem to 
work for me as well. I would recommend this be added as a permanent fix 
in Cygwin's package.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple