Invalid private key - secrets

[squigley]

Environment

• Python version: 3.6.8
• NetBox version: 2.6.12

Steps to Reproduce

1. Add a preexisting public key to the admin's profile
2. Attempt to add a secret to a device, click create, get prompted for the private key to get a session key
3. Provide the private key which matches the public key in the admin's profile (with header/footer, without header/footer, with newlines, without newlines..)
4. Box goes away
5. Click create again, get prompted for the private key again.

Expected Behaviour

System would accept my private key matching the public key in the profile, give me a session key, and allow me to save the secret.

Observed Behaviour

Just keeps prompting for the private key.
Using the dev tools I see that in response to submitting the private key, I am getting a 400 error, with the text "Invalid Private Key."
It doesn't matter what format I try submitting the private key, eg including the BEGIN/END lines etc, and with the encoded body as one long line, or split after x number of characters, every attempt is invalid.

I was having this issue with 2.6.7, so I upgraded to 2.6.12, deleted the public key from the profile, readded it, but there was no change. I have tried using both Firefox and Chrome, and both fail.

[hSaria]

I tried to recreate this but wasn't able to. What do you mean by preexisting, like one you've generated elsewhere? If you navigate to /user/user-key/, does it say that the user key is active?

Here's a dummy private and public key pair. It works with those

private

Generated with openssl genrsa -out private.pem 2048

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA4GDcjN87MbuvRoTpNOG0RT9UA/ThzlrTJXSEuoRnLdl1KGME
g76VDrx0cHrXtBQh63Vqx0P0RNRfiPhJQO6/GjifY5gmJhJqG5Zlv95atH2NrCdY
mW0IEUslceuV2NS0PA9v6oP/5hU4cb39Y3KC5REu7LX7qunz75HTTWncnnNfmxZo
DZN8nJKcoI3L+/PLukQlQrA0dTQJTbOBlkI37QTHt71w+sSEzDqMtR8OEyER4VUo
BWkqf6T8PttbvtK993PhRTd5sg/7rtixpJAP5T96O6icMKamEemZbOdKKu20MKxn
Dbn2VPHmRoy3Huqf7TjzEyQMTEAWYEZJggUcwwIDAQABAoIBAA0b+6bLYBT+xzXS
jCGH0lV9ZrY4d3zr94wnq52OIM0f+GVcq6Xa27CZuB/ePX4K8xRjrtJnmPzwf4hs
ITOG/2lTx5Q1Dn2I8+QavGUiY6BJ+Z4GSnnkUeVYw55NSlr5ynH74OkNv0S9Fqgm
lohZ52XkxB4WX9bThmoH1hWeysIDFZtapuvPoyZqdP/D+g2fCK/u3CEvsLbulQfY
PSRbnzVnunNLawH5KPvmb8rc1+wyY21sDjfGQkSKeGy9b2CSMwqNhFwzJm8YCTEw
s1h0JVZd2S1lRX87wEuPSk1v9CKqN5+YhOmhoA1BXV1Qb6UirmscYd3xcQC8aZW3
04WPcgkCgYEA+N8HVJo5yEtyxU25GYcpOF8kGWJK5RO3d+e/y2F830YiqK3nkabh
rcuSrJZ5fDeYiRDa0WdgbNT3qzztkBOPuMTdgfypD53qI+p55eo0JBSS7KbB2ZJ4
cdMJuuLd3itfUsJlMj1rSTsDGIDkF0U/bqBaLtTrcwdVVbcFdHrxwa0CgYEA5s46
HT9uXbtjaDC8GvuBNiho/AcvfvE2PFN7KtVyZ34aoEYVXhCMdkE2cAud1Bx/qtuc
ZKs9fTqSxqnz8E6Oy+qtcbA4H/vHr/ipGzZIAunvG4FZS6S3S33Q1d2oxgPPv6V+
VI+vtWZS6nnJuNEn6bWEPfhVaw7vRwmRg5GKhi8CgYEA5kxM1kdZjTX0YQyJa0we
IuI3352LvOw/7R9x5lyyV1Lpo7o5/hi14kPt2PPuO7qe1sfYFctZ+ZwiDD33gEn5
x3u1lyIduCvjjZTfdJkD4xd+1quB2zqlZn9qE5z4vyzXqxfk2Vbovv1y4ev0JmyY
RGDy0z+JGgsBNq6Ex8M1kIkCgYBehicWw1uX156mlQ70nfwVCge079xryK3Flwri
R/hKmkKdURZ/J5fe9mYtDRTeQa2nc7lhISBVoR9rbT8SM5oXuUy/OsRBlQP69YOM
OXbUeqoKQbcoW5UVvblBXT45mmYCvuw2BYKYcAeVL7uFjWMjO8uk9YdGCR/FoA2Q
LJLm0QKBgQDn67F0j+id/mq4eSeP1OJGxrjdmOmJOBpaOqku2CmUtmvkS88E3XOW
Bwn2dcn2mm0YEdPN284EVr0iDylgoGqJRDvX8MkLCrjOqbJaq4Clfxb9jkDPglKG
wJgxfdNlhtzTS/fX77wYfTRQjNvmf7SiXTZx9OMfk2/HRErBBgxz7g==
-----END RSA PRIVATE KEY-----

public

Generated with openssl rsa -in private.pem -outform PEM -pubout -out public.pem

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4GDcjN87MbuvRoTpNOG0
RT9UA/ThzlrTJXSEuoRnLdl1KGMEg76VDrx0cHrXtBQh63Vqx0P0RNRfiPhJQO6/
GjifY5gmJhJqG5Zlv95atH2NrCdYmW0IEUslceuV2NS0PA9v6oP/5hU4cb39Y3KC
5REu7LX7qunz75HTTWncnnNfmxZoDZN8nJKcoI3L+/PLukQlQrA0dTQJTbOBlkI3
7QTHt71w+sSEzDqMtR8OEyER4VUoBWkqf6T8PttbvtK993PhRTd5sg/7rtixpJAP
5T96O6icMKamEemZbOdKKu20MKxnDbn2VPHmRoy3Huqf7TjzEyQMTEAWYEZJggUc
wwIDAQAB
-----END PUBLIC KEY-----

[squigley]

Oh. I was trying to use my existing SSH private and public keys, and while it is an RSA key, I guess it is not in the PEM format which is required.

After using your generation commands to create a new private and public key in PEM format, and loading them into Netbox, I now get "session key received!" and am able to create and unlock secrets.

Can I suggest that the Secrets documentation page at https://netbox.readthedocs.io/en/stable/core-functionality/secrets/ be modified to add a note that SSH keys can't be used, or if they can, how to convert them into the correct format?

I think I got lead down the wrong path when I read the line "you can either generate a new RSA key pair, or upload the public key belonging to a pair you already have.", and I presumed this meant I could use my existing SSH key pair.

Thanks for the quick reply, which resolved my issue.

[jeremystretch]

I'm going to treat this as a bug, since we should be validating the key format on input. (But the docs also need to be improved.)

@squigley Would you mind generating a new key pair in the same format as the one you tried and posting it here to assist with testing? I'm pretty sure I know what's going on but it would help to be sure.

[squigley]

Sure, the keypair I was trying to use was one which was generated by "ssh-keygen", with no parameters. eg:

$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/squigley/.ssh/id_rsa): /tmp/id_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /tmp/id_rsa.
Your public key has been saved in /tmp/id_rsa.pub.
The key fingerprint is:
SHA256:K/717DPH8CaAuoRhpoaxCtGwBX0bU9rw5vOMVobJoBg squigley@9K771Z2L

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEA81rv3gmBjbyhNY33qDyM1vpVZ1sUSL5QGpxb23X21+et7Edkn5SG
FCOeeWXAA2FJRdNHOjk62qnu9+ABgzHtqO+Jp9gch8EWBpyTEaQcxA91cR0aio7AjgzOON
Kl8C1p8JpMUC6O9Rh+ulJn8l+vAl9sCOvOEEV6XpZIpAGcx7ptiHESIQbNhNcLcU1JAVJB
8XMbsdhJGUTpvkKINNKY0t9W57GluTYrSTiSJhwle3u7IqwF0nMfDDu5qJyY+U9N4OndIL
nBDw0v+pQYBYaWfTwOOnS5HqvS6AyXb2RpLCJMJASu3mgl3RU2qRlW4hTvHHsCpIa/8Ft/
tiHZ5f/S/vw0FpdR/OYFQnPn9EPWMKql0iKPAeWlN9ITh3FaordSvEq+V11Bh+aSOfq9zs
2XHpjhGWVcuuDLWsIouyjH2uP2MINO8bFd+H/v1XsQYfbNuuFR/N42GjOvi1L9Q9eoo1UK
SWS7H0gx8ZwgkJ7YzyJuXs1j1tvvHOMM/DXCgww7AAAFiM4tH23OLR9tAAAAB3NzaC1yc2
EAAAGBAPNa794JgY28oTWN96g8jNb6VWdbFEi+UBqcW9t19tfnrexHZJ+UhhQjnnllwANh
SUXTRzo5Otqp7vfgAYMx7ajviafYHIfBFgackxGkHMQPdXEdGoqOwI4MzjjSpfAtafCaTF
AujvUYfrpSZ/JfrwJfbAjrzhBFel6WSKQBnMe6bYhxEiEGzYTXC3FNSQFSQfFzG7HYSRlE
6b5CiDTSmNLfVuexpbk2K0k4kiYcJXt7uyKsBdJzHww7uaicmPlPTeDp3SC5wQ8NL/qUGA
WGln08Djp0uR6r0ugMl29kaSwiTCQErt5oJd0VNqkZVuIU7xx7AqSGv/Bbf7Yh2eX/0v78
NBaXUfzmBUJz5/RD1jCqpdIijwHlpTfSE4dxWqK3UrxKvlddQYfmkjn6vc7Nlx6Y4RllXL
rgy1rCKLsox9rj9jCDTvGxXfh/79V7EGH2zbrhUfzeNhozr4tS/UPXqKNVCklkux9IMfGc
IJCe2M8ibl7NY9bb7xzjDPw1woMMOwAAAAMBAAEAAAGASWVl7vvC/TKlFHfq9+y7NaNu2q
tXpNDxa/U4pyoe9uNDS34E1TSAc9aCV27eyKYw6URduSvFmmmiT1RaYG1QlqEYTW0avb74
m6nhmXJ70o4vB5yVgrCnVrB6Ch1OOvAXgZ+n4I8KQtXOcvejrjA5omeRN+eW0MWDsL92zT
BHTt3lZz9jDl704VnSc6uxlxpuFRp4gd0PvvVP4jhCyFu0B/WgSmUD7KZvy7eqLKBUlbet
qzli0CQ0ewYQatBAOwE1j0fSgle965GFbCsL2qti5MgOgXuuyn/tW+0IAx3c+5k3Auli4M
00Ald8etWTmmGDVSNhYbO9JZsV9c+4dn8EYUp3WrUUT1klIqxCZfKSZV5QimI93SDhrHMy
deh/JsIh4GqagJPFysy/HFHg9s9Q6Vy3Nzo6Gp4pHggOFldva1SR+ZducKI3lbF4N99OYt
8otUAH/t2SONavOVg2nSiN+h8J613/ZPjtxbOy607hZ4VeksmsaQf3jpqSRbAwP0cxAAAA
wQDeRthh/J8T/MG30BeRKDhUJ3leJHLYaPvoVp/3jYTMvQ+m6pLIUntqBQYMFmRx6u9Pzn
1ix53GEBDMXOAr+XGfkpom9vhJYoF4iSpnm4XDYuxW9su8spUVmyEmvuGQkOQ8z2iYW4wq
KJSn4gKLYLLA1StDcucCuJn2gjax72ECUfNC96vkvFlFkyqs4hoU6PpFjEmLwvjkdGHFYA
i7VNagMT9h2kzJjKxm1m2FcgUJJpWY8Y2/8KBl6Djjz8fH3WIAAADBAP5tkKBWiyHOAOmL
0WSwlGUYrWRGb4V9HBh/io9srLIaCHJyMn8sITsLBzKqExuNpthaTWE5wEJOc8u+d0EwDc
6u1KhDJ1lBg/dw3fd7rw+flBTJezdsdhZ6VsnOWr9bHnx52bgrL18EeRd7lD+V8l4YfUao
g8fuFaSIkI5WhAScE5CYIZ/OwXd35sqTFknZI8LrNQ206u40qjhI6zcOxD/TCThAjjCkcA
F7JoV/JbDZRbN+9Z7/21eOH3ONhL9XzQAAAMEA9Nvbo8STrcqiFIXubpgHHggjMXyWwuCK
XOzDTumDoF3DNnnG6ylowRQElsLL5Yu9x6eAOa0dMSSzoFXi4xbc4tCxZiNGOG/WfZUeUZ
Nvh2cn51Oia92gNK5YZ2Sce1e9lInoIR8uzRNkk5pEJyk+vKWUSd+DsOrxPA0KJLhJjTv6
lTp3RbPGmQEESPM9zXF3Pr6wsxkDLpMiO1hm4/+IbI+NCrfqr3vbccEt3MksmTYyVDeRin
WsvzeK3Z0AC1wnAAAAEXNxdWlnbGV5QDlLNzcxWjJMAQ==
-----END OPENSSH PRIVATE KEY-----

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDzWu/eCYGNvKE1jfeoPIzW+lVnWxRIvlAanFvbdfbX563sR2SflIYUI555ZcADYUlF00c6OTraqe734AGDMe2o74mn2ByHwRYGnJMRpBzED3VxHRqKjsCODM440qXwLWnwmkxQLo71GH66UmfyX68CX2wI684QRXpelkikAZzHum2IcRIhBs2E1wtxTUkBUkHxcxux2EkZROm+Qog00pjS31bnsaW5NitJOJImHCV7e7sirAXScx8MO7monJj5T03g6d0gucEPDS/6lBgFhpZ9PA46dLkeq9LoDJdvZGksIkwkBK7eaCXdFTapGVbiFO8cewKkhr/wW3+2Idnl/9L+/DQWl1H85gVCc+f0Q9YwqqXSIo8B5aU30hOHcVqit1K8Sr5XXUGH5pI5+r3OzZcemOEZZVy64Mtawii7KMfa4/Ywg07xsV34f+/VexBh9s264VH83jYaM6+LUv1D16ijVQpJZLsfSDHxnCCQntjPIm5ezWPW2+8c4wz8NcKDDDs= squigley@9K771Z2L