[BUG FIX] Fix an issue with propagating invalid exception when using RSA key but authentication failure occurs#351
Closed
Kami wants to merge 3 commits intoparamiko:mainfrom
Conversation
… a valid RSA key, but authentication failure occurs.
|
+1, thanks for writing this up :) |
Author
|
Added a test case for previous invalid behavior and for this fix in e8c7f85 If you revert my fix, the test will fail because an invalid |
asfgit
pushed a commit
to apache/libcloud
that referenced
this pull request
Jul 7, 2014
…when authentication bug (paramiko/paramiko#351) has been fixed in paramiko.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem description
Currently if you use a valid RSA key, but authentication failure occurs, paramiko will propagate an invalid
not a valid DSA private key fileexception. The exception which should be propagated isAuthentication failed.The reason why this occurs is because paramiko tries to load / parse private key in the following order:
If parsing of the key as RSA succeeds, but authentication failure occurs, paramiko won't stop, but it will also try to parse the same key which is already to be determined to be an RSA key as DSA. Obviously, parsing RSA key as DSA won't work, so
not a valid DSA private key fileexception will be stored insaved_exceptionand propagated to the end user later in the code.Note 1: I discovered this bug while debugging some Libcloud deployment issues. Sadly a work-around for us (and others) until this has been merged into master is to catch
Invalid DSS key exceptionexception and treat it in the same way as authentication failure which is far from ideal.Note 2: I wonder how more people didn't spot this issue. RSA keys are far more common than DSA keys and I would imagine that most people only use / try one key for authentication.