Encrypted SSH Keys

[bobbytables]

When using key_file to choose which key to use for connection / provisioning on SSH I used a key that was encrypted and the error message was very... cryptic. (pun intended).

Reference: https://code.google.com/p/go/issues/detail?id=6650

Excerpt

ParsePrivateKey fails with an error like this:

asn1: structure error: tags don't match (16 vs {class:1 tag:28 length:11 > isCompound:true}) {optional:false explicit:false application:false defaultValue: tag: > stringType:0 set:false omitEmpty:false} pkcs1PrivateKey

[bobbytables]

Not sure if you'd want to attack this but it definitely was a big "what?" error.

[mitchellh]

Yeah so I tagged this as a bug. I think in the short term we at least want to show a better error. I'm not sure how to handle this well with automation and the hands-off approach Terraform takes. Any ideas?

[michiels]

@mitchellh I ran into this issue as well. If terraform is run by an actual person, won't using ssh-agent basically solve this problem?

[mitchellh]

@michiels Maybe that is a good solution. Maybe the solution is simply a better error message that says to either unencrypt it for the duration of the run or to use an SSH-agent. I like it!

Thoughts?

[bobbytables]

I'm a fan of a better error message for now. 👍

[mitchellh]

Fixed

[bobbytables]

Awesome. Thanks Mitchell.

On Tuesday, August 5, 2014, Mitchell Hashimoto notifications@github.com
wrote:

Closed #73 #73.

—
Reply to this email directly or view it on GitHub
#73 (comment).

• Robert Ross

[hh]

I want to make sure I understand:

terraform does not support ssh-agent forwarding or local, or keys with passwords yet

[JeanMertz]

@hh @mitchellh that's my understanding as well. It's a real shame, as I don't use any passwordless private keys.

To clarify: I tried setting agent to true, which resulted in:

* ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

However, I am able to ssh manually. Of course I could not set key_file, because of the password limitation.

update turns out I left the host field blank, so that was the issue for me.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.