Keys with passphrases for SFTP #1039

New Issue

tahoe-lafs · 2010-05-13T23:20:51Z

josipl commented

2010-05-13 23:20:51 +00:00

Currently ssh keys with passphareses raise following exception:
twisted.conch.ssh.keys.EncryptedKeyError: encrypted key with no passphrase

Twisted has support for passphrases but currently there is no way in Tahoe-LAFS to acquire the passphrase from user.

The solution for now is just to generate keys without a passphrase~~, even though source:docs/frontends/FTP-and-SFTP.txt suggests otherwise~~.

Currently ssh keys with passphareses raise following exception: `twisted.conch.ssh.keys.EncryptedKeyError: encrypted key with no passphrase` Twisted has [support for passphrases](http://twistedmatrix.com/trac/browser/trunk/twisted/conch/ssh/keys.py) but currently there is no way in Tahoe-LAFS to acquire the passphrase from user. The solution for now is just to generate keys without a passphrase~~, even though source:docs/frontends/FTP-and-SFTP.txt suggests otherwise~~.

tahoe-lafs added the

labels 2010-05-13 23:20:51 +00:00

tahoe-lafs added this to the 1.8.0 milestone 2010-05-13 23:20:51 +00:00

davidsarah commented

2010-05-14 00:12:13 +00:00

FTP-and-SFTP.txt doesn't actually suggest otherwise, but I can see how [the current wording]source:docs/frontends/FTP-and-SFTP.txt#L28 could be confusing (it is actually referring to user passwords, not the passphrase of the server private key).

warner commented

2010-05-14 00:17:38 +00:00

Server-side keys don't generally have passphrases. When they do, things like sshd can't start up by themselves. The usual linux distributions creates passphraseless keys in /etc/ssh/ssh_host_dsa_key at install time.

I think it's perfectly fine to have Tahoe's SFTP server refuse to use passphrase'd server keys. And yeah, the docs should encourage this by showing an example of running 'ssh-keygen' without providing a passphrase.

Server-side keys don't generally have passphrases. When they do, things like sshd can't start up by themselves. The usual linux distributions creates passphraseless keys in /etc/ssh/ssh_host_dsa_key at install time. I think it's perfectly fine to have Tahoe's SFTP server refuse to use passphrase'd server keys. And yeah, the docs should encourage this by showing an example of running 'ssh-keygen' without providing a passphrase.

davidsarah commented

2010-05-16 21:16:53 +00:00

Milestone 1.7 to make the docs clear that this isn't supported; then we can decide whether to leave the ticket open or wontfix it.

tahoe-lafs modified the milestone from 1.8.0 to 1.7.0

2010-05-16 21:16:53 +00:00

davidsarah commented

2010-06-19 00:30:08 +00:00

Attachment sftp-and-ftp-doc.dpatch (57063 bytes) added

FTP-and-SFTP.txt: remove description of public key format that is not actually implemented. Document that SFTP does not support server private keys with passphrases, and that FTP cannot list directories containing mutable files.

**Attachment** sftp-and-ftp-doc.dpatch (57063 bytes) added FTP-and-SFTP.txt: remove description of public key format that is not actually implemented. Document that SFTP does not support server private keys with passphrases, and that FTP cannot list directories containing mutable files.

sftp-and-ftp-doc.dpatch

56 KiB

davidsarah commented

2010-06-19 00:57:09 +00:00

Attachment sftp-and-ftp-doc-known-issues.dpatch (57796 bytes) added

Update to previous patch adding a 'Known Issues' section

**Attachment** sftp-and-ftp-doc-known-issues.dpatch (57796 bytes) added Update to previous patch adding a 'Known Issues' section

sftp-and-ftp-doc-known-issues.dpatch

56 KiB

kevan commented

2010-06-19 01:08:54 +00:00

The updated patch looks good to me; I like the known issues section.