Installed pam-1.2.1 and pam_ssh-2.1 on ~amd64 today and now my ssh passphrase is rejected. Reverting to pam_ssh-1.9.8 fixes the problem. Portage 2.2.20 (python 2.7.10-final-0, default/linux/amd64/13.0/desktop, gcc-4.9.3, glibc-2.20-r2, 3.14.46-gentoo x86_64) ================================================================= System uname: Linux-3.14.46-gentoo-x86_64-AMD_A6-3600_APU_with_Radeon-tm-_HD_Graphics-with-gentoo-2.2 KiB Mem: 7664392 total, 5170060 free KiB Swap: 4144732 total, 4144732 free Timestamp of repository gentoo: Tue, 07 Jul 2015 13:30:01 +0000 sh bash 4.3_p39 ld GNU ld (Gentoo 2.25 p1.2) 2.25 app-shells/bash: 4.3_p39::gentoo dev-java/java-config: 2.2.0::gentoo dev-lang/perl: 5.20.2-r1::gentoo dev-lang/python: 2.7.10::gentoo, 3.3.5-r1::gentoo, 3.4.3::gentoo dev-util/cmake: 3.2.3::gentoo dev-util/pkgconfig: 0.28-r3::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.17::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69-r1::gentoo sys-devel/automake: 1.11.6-r1::gentoo, 1.12.6::gentoo, 1.13.4::gentoo, 1.14.1::gentoo, 1.15::gentoo sys-devel/binutils: 2.23.2::gentoo, 2.25-r1::gentoo sys-devel/gcc: 4.8.4::gentoo, 4.9.3::gentoo sys-devel/gcc-config: 1.8::gentoo sys-devel/libtool: 2.4.6-r1::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 4.1::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--keep-going=y --quiet-build=n" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://gentoo.oregonstate.edu http://www.ibiblio.org/pub/linux/distributions/gentoo" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j4" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/home/portage" USE="3dnow 3dnowext 64bit X a52 aac acl adns aio alsa amd64 amr apng archive aspell audio autoipd automount autotools avahi bash-completion berkdb bidi bittorrent boost bufferevents bzip2 cairo caja cdda cdparanoia cdr cdrom cjk cli client clutter cmake corefonts cracklib crypt css cups cxx dane dbus dconf device-mapper djvu dri drm dts dv dvd dvdr ecc egl elfutils elisp emboss enca encode evdev evo exceptions exif extensions faac faad fame fat fax ffmpeg flac fltk fontconfig fpx frei0r ftp fts3 fuse g3dvl gallium gcrypt gdbm gdu geoip gif gimp git glamor gles glib glut gmp gnome-keyring gnutls gpg graphite gstreamer gtk gtk2 gtk3 gudev h323 hpcups http hwdb iconv imagemagick imap imlib internal-jsoncpp iplayer ipv6 java java6 javascript jbig jbootstrap jce jpeg jpeg2k kqemu kvm lame lcms libburn libkms libnotify libssh2 libwww live llvm-gcc logrotate lua lzma lzo mad madwifi mate md5sum mdev mdnsresponder-compat mime mimencode minizip mjpeg mms mmx mmxext mng modemmanager modperl modules mozdom mp3 mp4 mpeg mplayer mta mtp multilib multislot nat-pmp ncurses net netpbm network networking nfs nfsdcld nfsidmap nfsv3 nfsv4 nfsv41 nntp nocd nptl nsplugin offensive ogg ogg123 opengl openmp openrc opensslcrypt opus oss pam pam_ssh pango parted passfile passwordsave pcap pcre pcre16 pcre32 pdf pdfimport perl pgf pkcs11 playlist png pnm policykit pop posix postproc ppds ppp pppd pulseaudio python python2 qemu qt4 quicktime rar rdesktop rdp readline real regex rtsp sasl scanner sdl secure-delete security sendto session sha512 sharedmem sidebar sip smime smp smtp sockets sound spice sqlite sqlite3 sse sse2 ssh ssl startup-notification svg swat symlink sysfs syslog system-boost system-sqlite systemd sysvipc tcl tcpd templates tga tgif theora threads threadsafe thunderbird tiff tk tls tools tor tor-hardening transcode truetype twolame type3 udev udisks unicode unlock-notify usb usbredir utils uudeview uuencode vdpau vga vhost-net video vorbis vte wav weather webgl webm webp widevine win32codecs wma wxwidgets x264 xanim xcb xft xine xml xorg xpm xrandr xterm xv xvid xvmc youtube yv12 zip zlib" ABI_X86="64 32" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="3dnow 3dnowext mmx mmxext popcnt sse sse2 sse3 sse4a" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby20" USERLAND="GNU" VIDEO_CARDS="fglrx vga" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON Reproducible: Always Actual Results: Jul 07 07:54:01 a6 login[4033]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty2 ruser= rhost= user=wa1ter Jul 07 07:54:04 a6 login[4033]: FAILED LOGIN (1) on '/dev/tty2' FOR 'wa1ter', Authentication failure Jul 07 07:54:21 a6 login[4033]: FAILED LOGIN (2) on '/dev/tty2' FOR 'wa1ter', Authentication failure Jul 07 07:54:33 a6 login[4033]: TOO MANY LOGIN TRIES (3) on '/dev/tty2' FOR 'wa1ter' Jul 07 07:54:33 a6 login[4033]: pam_unix(login:session): session closed for user wa1ter Jul 07 07:54:33 a6 login[4033]: pam_mail(login:session): pam_putenv: delete non-existent entry; MAIL Jul 07 07:54:33 a6 login[4033]: PAM 2 more authentication failures; logname=LOGIN uid=0 euid=0 tty=/dev/tty2 ruser= rhost= user=wa1ter I'm using systemd. My /etc/login.defs is unmodified and was installed by shadow-4.2.1-r1. /etc/pam.d/system-* are unmodified and were installed by pambase-20150213^b
Same issue here on ~AMD64, though my system is shamefully unstable due to compile flags. Adding this as the OP's seems sane. Jul 9 10:18:58 peen pam_ssh[7582]: init authentication module Jul 9 10:18:58 peen pam_ssh[7582]: No SSH login-keys directory. Jul 9 10:18:58 peen pam_ssh[7582]: Asking for SSH key passphrase. Jul 9 10:19:03 peen pam_ssh[7582]: Looking for SSH keys in '/home/sietze/.ssh/session-keys.d'. Jul 9 10:19:03 peen pam_ssh[7582]: No SSH session-keys directory. Jul 9 10:19:03 peen pam_ssh[7582]: Looking for SSH keys in '/home/sietze/.ssh/login-keys.d'. Jul 9 10:19:03 peen pam_ssh[7582]: Looking for SSH keys in '/home/sietze/.ssh'. Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'id_ed25519'. Jul 9 10:19:03 peen pam_ssh[7582]: debug1: key_load_private: No such file or directory Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'id_ed25519' failed. Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'id_ecdsa'. Jul 9 10:19:03 peen pam_ssh[7582]: debug1: key_load_private: No such file or directory Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'id_ecdsa' failed. Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'id_dsa'. Jul 9 10:19:03 peen pam_ssh[7582]: debug1: key_load_private: No such file or directory Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'id_dsa' failed. Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'id_rsa'. Jul 9 10:19:03 peen pam_ssh[7582]: SSH key 'id_rsa' decrypted. Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'identity'. Jul 9 10:19:03 peen pam_ssh[7582]: debug1: key_load_private: No such file or directory Jul 9 10:19:03 peen pam_ssh[7582]: SSH key candidate 'identity' failed. Jul 9 10:19:03 peen login[7582]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=****** Jul 9 10:19:07 peen login[7582]: FAILED LOGIN (1) on '/dev/tty1' FOR '******', Authentication failure My private key file ~/.ssh/id_rsa seems found and decrypted.
creating a directory # mkdir ~/.ssh/login-keys.d and linking my keys used for loggin in there # ln -sf ~/.ssh/id_rsa ~/.ssh/login-keys.d/ allows me to log in again with SSH keys. This seems to be mentioned in the ChangeLog, Version 2.0, 2013-11-10: Look for SSH keys in $HOME/.ssh/login-keys.d/, given that SSH keys with .disabled or .frozen as suffix are ignored. It could've been clearer, maybe even an einfo in the ebuild?
Thank you. Adding the new directory and symlink fixed the problem. Questions: is this change coming from upstream or from gentoo? What problem is it solving?
(In reply to walt from comment #3) Gentoo maintains no patches on pam_ssh. all behavior changes are from upstream.
should be all set now in the tree; thanks for the report! Commit message: Add notice for upstream changes wrt ~/.ssh/login-keys.d/ http://sources.gentoo.org/sys-auth/pam_ssh/pam_ssh-2.1.ebuild?r1=1.1&r2=1.2
