From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) by sourceware.org (Postfix) with ESMTPS id ECE9D386F831 for ; Mon, 1 Jun 2020 19:46:55 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org ECE9D386F831 Received: by mail-qt1-x832.google.com with SMTP id e16so8761584qtg.0 for ; Mon, 01 Jun 2020 12:46:55 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=IHhvt1CJd5Xw/9H7fLfjwdWge6QHzD3Haq2KAwTr7l4=; b=dkZM3mUUSgG/gnELYG4cqlZIBd6+ExZovTNDHcBSpIz/nbXKnLXxvYWXwTnGUz888T 9tiEA8P+czpr/wmFfbgFX6UwJE2o4toZoiapbh+sH+aBOXAGEEj0Fief0EkNTkPk1LvX TqWmRCwYLtybxEJ14/jiVMbAruGTXVOIm1oBdATH9W/Rx+8hdx1ySZNk7M+VZJL84STk orD3dyKt2lM99x2Vg60699rq2bljFTKtD+rtpvEPXJNxYRwa4LOgwrptfXHWKnIKj1ba MOT5qPgFPHrzZIGPseksMt0YtgCqcjLW6yOsERtyzdlC4yI905wwczla/pO3vsw4iYwM 69kg== X-Gm-Message-State: AOAM530zKNrB8VKFt0akwhQFgEBdAdp8DeTuMktlindXYShqhs4+QtEf HWqan4OS61twXt8F/Eh/oEU= X-Google-Smtp-Source: ABdhPJyZdzENrw4LlAm6ndduG5PoC4myv2vEx5jpjDkxBu9hcGxi5oL3gcR0vSZ43Z8Ir/zU/AQLpQ== X-Received: by 2002:ac8:3066:: with SMTP id g35mr16230490qte.193.1591040815504; Mon, 01 Jun 2020 12:46:55 -0700 (PDT) Received: from [192.168.0.41] (75-166-103-121.hlrn.qwest.net. [75.166.103.121]) by smtp.gmail.com with ESMTPSA id b12sm210871qkk.43.2020.06.01.12.46.54 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 01 Jun 2020 12:46:54 -0700 (PDT) Subject: Re: sign_and_send_pubkey: signing failed: agent refused operation To: Jonathan Wakely Cc: "Frank Ch. Eigler" , Overseers mailing list , gcc mailing list References: <20200601181037.GB16575@redhat.com> <74ac89cb-31b7-770b-0e2a-c1256db64db1@gmail.com> From: Martin Sebor Message-ID: Date: Mon, 1 Jun 2020 13:46:53 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_BARRACUDACENTRAL, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=no autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: overseers@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Overseers mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Jun 2020 19:46:57 -0000 On 6/1/20 1:25 PM, Jonathan Wakely wrote: > On Mon, 1 Jun 2020 at 20:16, Martin Sebor via Gcc wrote: >> >> On 6/1/20 12:10 PM, Frank Ch. Eigler wrote: >>> Hi - >>> >>>> git pull from the GCC and Glibc repos is failing for me with the error >>>> below. It worked fine last week and I haven't made any changes to my >>>> ssh keys. >>> >>> And are you logging in from the same workstation with access to the same >>> set of ssh private keys? >> >> Yes. >> >>> >>>> Is this a transient glitch or has something changed recently that I >>>> need to make some adjustments for? >>> >>> I know of nothing relevant that has changed on the sourceware side. >>> >>>> sign_and_send_pubkey: signing failed: agent refused operation >>>> msebor@gcc.gnu.org: Permission denied (publickey). >>>> fatal: Could not read from remote repository. >>> >>> The usual advice is to run % ssh -vv gcc.gnu.org alive >>> and report the ssh level error. >>> >>> "agent refused operation" sounds like a problem on the client end. >> >> Until last week, when I ran git pull from the GCC or Glibc repo >> I'd get prompted for my password. I'd either type it in or hit >> ctrl-C, enter ssh-add, and start over. >> >> After deleting ~/.ssh/known_hosts to resolve the problem I asked >> about last week (Re: ssh key conflicts), I'm no longer prompted >> for my password. Instead, I get the error above. > > Is ~/.ssh/known_hosts no longer present? Is ~/.ssh writable by your > user? The ssh client (or the agent) will try to create > ~/.ssh/known_hosts if it doesn't exist, to add the host key. If ~/.ssh > is not writable that will fail. ~/.ssh/known_hosts exists and ~/.ssh is rwx only by the owner. Everything works fine if I add my key by running ssh-add. What's not so great is the errors I get when I forget to do that: "agent refused operation?" > >> Both of this is new (I think since the recent server changes). Now > > The host key did change after the server upgrade, that's expected. The > other problem is not caused by the server. > >> that I've seen it and know what to expect I can adjust to it but it >> seems like things have gotten worse. Certainly the errors I got >> in both instances (i.e., last week as well as today) are not helpful. > > SSH errors usually aren't. > >> I captured the ssh -vv gcc.gnu.org output below for a successful >> invocation and a failed one if that sheds more light on why it's >> failing in (to me) a mysterious way. > > The failed attempt shows that your public key is offered to the > server, and the server says it will accept it (meaning it matches a > ~/.ssh/authorized_keys entry on the server) but then your client > refuses to use that key. > > Check your ~/.ssh and ~/.ssh/id_rsa* permissions. They're all rw by the owner only. Nothing has changed on my end (except that I removed/recreated ~/.ssh/known_hosts to avoid some mysterious problems last week). I have it working now so I don't want to use up too much of anyone else's time trying to debug things. It just feels like too much of a coincidence that I started having these problems only after the recent server upgrade. If something jumps out at someone as a problem or missing setting on the server end, tweaking that to improve things going forward that would be great. Otherwise, let's just chalk it up to the usual joys of upgrading to "new and improved" versions of software. Martin