Mailing List Archive

Help with ssh password pasting glitch
I suspect this problem is not with ssh itself, but I'm really at my
wit's end and don't know where else to ask.

Requiring more stringent security for a new server, I have for the
first time set up an ssh key with a password which I then store in
keepass. If I log in once onto my remote server (call this one server
"A"), I can paste in the password and connect with no problem. I can
log out, and back in, several times with no issue, each time pasting my
password in from keepass. But if I log out, stay logged out for a
while, when I return I find I can no longer successfully paste in a key.
It acts as if it's the wrong password. If I manually type the
password, then I can log in. And if I log back out, I can again paste
the key successfully. This will work for a few hours, and then the
issue starts over.

I tried using two keys. Log into server A with key 1. Log out. Wait.
When logging back in with a pasted password fails, I tried key 2.
Pasting the password with key 2 also fails. Typing in the password
manually with key 2 works. And when I log back out, I can then paste in
password successfully with either key 1 or key 2. For a while.

The trick of typing in the password to get it to work again for a while,
it works only for server A. By that, I mean, once I cannot paste in a
password to reach server A, if I ssh to server B, type in the password
manually, then exit, I still cannot paste in a password successfully to
get to server A. I have to ssh to server A, manually type in the
password, connect, exit, then I can ssh back and successfully paste the
password again for a while.

If I close the terminal window and start a new one, then I am also able
to successfully paste in a password for a time.

I at first suspected something with ssh-agent, but disabling it has no
effect.

I wonder about something with the clipboard itself. When ssh stops
working with a pasted password, I can paste the password onto the
terminal screen. I can paste passwords into sudo. It all works fine.
But ssh doesn't work. Neither does ssh-keygen. For example, I can't
paste in the original password with ssh-keygen in order to change the
password.

I quite at my wit's end on this. Any suggestions would be appreciated.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
Re: Help with ssh password pasting glitch [ In reply to ]
There was a thread here in Dec 2020, "SSH client and bracketed paste mode".

Does that provide any clue, perhaps?
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
Re: Help with ssh password pasting glitch [ In reply to ]
Thank-you. That's exactly what I needed.

I don't see the extra characters when I paste into the raw terminal.
But ssh must be seeing them. When I use the escape code to turn off
bracketed pasting ssh works as expected again.

Perhaps ssh can be made to turn it off when asking for a password? In
any case, I can now work around fairly easily.

Thanks again.

On 2021-05-02 12:11, Philipp Marek wrote:

> There was a thread here in Dec 2020, "SSH client and bracketed paste
> mode".
>
> Does that provide any clue, perhaps?
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev@mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
Re: Help with ssh password pasting glitch [ In reply to ]
Kurt Fitzner wrote:
> Requiring more stringent security for a new server, I have for the
> first time set up an ssh key with a password which I then store in
> keepass.

So to clarify, do you *want* to be asked for the passphrase on every use?

I would have recommended loading the key into an agent with confirmation
before use, so that you only need to provide the passphrase once.

(I know this has nothing to do with pasting.)

Thinking about this further, such a use-case could perhaps benefit from
ssh-agent having loaded the key encrypted (I believe the protocol doesn't
currently support that but could be exnteded) and asking for the
passphrase to decrypt before each use.


//Peter
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev