SSH Passphrase no longer accepted after reboot

Supay · 2018-11-03 20:45:16

Hi everyone, hoping someone can help me please. I've been scouring the Arch Wiki, as well as anywhere else I can, and I cannot find any explanation.

I have a new custom NAS setup. As part of my config I setup an SSH key pair to use on it. Using ed25519 and successfully generated them, copied across to the server and connected SSH with the passphrase accepted on the first go. I have ssh-agent running so passphrase stored there while working. I was in and out all yesterday afternoon and evening, over a span of about 9 hours, all working perfectly. I've followed the Arch wiki guidance to set this all up.

However, after a reboot my passphrase stops working. It just isn't accepted and reports back as a bad passphrase. I'll list what I have already confirmed below.

> both client and server use Arch, and are up to date.
> can ping the server, and have locally logged in to check it. sshd running and key permissions set correctly serverside. can see the client communicating when it tries to connect and no issues noted there either.
> can connect to the server via ssh using password instead.
> known hosts and authorized keys at client and server end are both correct.
> ssh -vvv user@serveraddress - shows as expected, I see it communicating with the server and choosing the correct key, all looks good up until it asks for the passphrase when it states "bad passphrase".
> permissions on .ssh and both keys in client are correct and as expected.
> set an identity in client .ssh/config just to make sure, and it doesn't change ssh -vvv outcome and looks as good as before but still fails with bad passphrase.
> tried a manual ssh-add and results in bad passphrase.
> tried changing the passphrase on my private key and when it asks for my current passphrase it states incorrect.
> tried changing the passphrase on private key as sudo (it was a punt) but still states incorrect.
> checked my keymap and typed the passphrase out in another terminal to make sure it is correct.
> reduced the passphrase down to only a few basic characters to see if that will fail too - it does.
> wiped all the keys and generated again, works perfectly again right up till I shutdown and restart, then it goes back to stating incorrect/bad passphrase.
> rebooted client repeatedly but still fails everytime.
> have generated SSH keys on my mobile to connect to the server and those work fine and have persisted between restarts.

So, I'm satisfied it is not an issue between the client and server, as I can still connect via SSH using my user password. The private key and its passphrase work right up till I shutdown and restart the client. And the bad passphrase error is returned even when just working locally on the private key in trying to add it to my agent or change the passphrase. I am struggling to work out what is wrong with my system to cause this. Can a restart corrupt my SSH private key somehow? I'm at a total loss and would appreciate any advice please, as currently my SSH keys are acting almost like one-shot keys rather than permanent ones.

mpan · 2018-11-03 21:39:56

Please be specific and supply the information, instead of listing vague opinions in the 4chan format.

> both client and server use Arch, and are up to date.

Which versions of all the related software? EXACTLY

> ssh -vvv user@serveraddress - shows as expected

Removing any sensitive information, of course, what EXACTLY does it show? If you think it “shows as expected”, your case iss already solved. Next

> permissions on .ssh and both keys in client are correct and as expected

What are they, EXACTLY?

> tried a manual ssh-add and results in bad passphrase

What EXACTLY does it say? Minus any sensitive information, of course.

> tried changing the passphrase on my private key and when it asks for my current passphrase it states incorrect.

Well… and that applies to some of the previous statements too. Which part of the [not] supplied logs tells it’s related to passphrases? In particular if the really latest update contained some changes marked as introducing incompatibilities?

What is the result of the simplest step: generating new keys and using them?

Supay · 2018-11-04 21:37:33

I don't even know what 4chan format is, but I'll update below as best I can. First, I'm going to skip all of the actions that relate to the server. I've already satisfied myself that it isn't the server as even just generating an SSH key and rebooting, without doing anything else with it, results in the error I'm having. I only really added them as I was anticipating someone asking me if I'd tried using the key for an SSH connection. But I am certain it is a client based error due to this occurring without server involvement.

Key pair generated using following:
ssh-keygen -t ed25519 -C "$(whoami)@$(hostname)-$(date -I)"

Versions:
Arch: 4.18.16-arch1-1-ARCH
OpenSSH: 7.9p1-1
OpenSSL: 1.1.1-1

Error (lo and behold it has suddenly stopped occurring but it was short and sweet and I believe as below):
"Bad passphrase, try again"

Generating new keys with the same passphrase results in the same error. First they would work, but after client reboot, they would stop working. Now, I did this again tonight but first tried a blank passphrase and they carried on working. I then reduced my passphrase length down to much less than it was before and also cut out all special characters, and it continued working. Tried using my original passphrase and it stopped working again. I've generated new keys with a reduced passphrase length from my original and with only specific special characters rather than the longer list I was using before. I wasn't aware that SSH keys passphrases had special character restrictions, and the ones I was using were not system restricted or anything fancy, but something seems to be odd about it. I'll do some testing later once I've finished my current tasks and see if I can narrow down what was causing it. Thanks for replying though, I appreciate it.

Last edited by Supay (2018-11-04 21:49:51)

Arch Linux

#1 2018-11-03 20:45:16

SSH Passphrase no longer accepted after reboot

#2 2018-11-03 21:39:56

Re: SSH Passphrase no longer accepted after reboot

#3 2018-11-04 21:37:33

Re: SSH Passphrase no longer accepted after reboot

Board footer