Users may need to ignore 127.0.0.1 in SSH config to use Podman 5.3
#24567
Comments
github-actions
bot
added
macos
calebevans
changed the title
~/.ssh/config file127.0.0.1 in SSH config to use Podman 5.3
When we alreayd get a full URL with user, port and identity then we should not read the config file just to overwrite them with wrong values. This is a bad regression for user using * wildcard in their ssh_config as it makes podman machine unusable. Fixes: containers#24567 Signed-off-by: Paul Holzinger <[email protected]>
When we alreayd get a full URL with user, port and identity then we should not read the config file just to overwrite them with wrong values. This is a bad regression for user using * wildcard in their ssh_config as it makes podman machine unusable. Fixes: containers#24567 Fixes: e523734 ("Add support for ssh_config for connection") Signed-off-by: Paul Holzinger <[email protected]>
When we alreadty get a full URL with user, port and identity then we should not read the config file just to overwrite them with wrong values. This is a bad regression for user using * wildcard in their ssh_config as it makes podman machine unusable. Fixes: containers#24567 Fixes: e523734 ("Add support for ssh_config for connection") Signed-off-by: Paul Holzinger <[email protected]>
|
Fix in #24568, we are planning for a 5.3.1 release early next week with some other fixes |
|
Was the root cause here that we didn't tilde-expand the key path (for The workaround should be fine to fix the regression, but it should cope with: But it doesn't: Even if it is the default (and thus was never tested, when it came to the parser) Like so: --- a/pkg/bindings/connection.go
+++ b/pkg/bindings/connection.go
@@ -189,8 +189,13 @@ func sshClient(_url *url.URL, uri string, identity string, machine bool) (Connec
}
}
if val := cfg.Get(alias, "IdentityFile"); val != "" {
+ h, err := os.UserHomeDir()
+ if err != nil {
+ return connection, fmt.Errorf("user homedir could not be determined: %w", err)
+ }
if val != ssh_config.Default("IdentityFile") {
identity = strings.Trim(val, "\"")
+ identity = strings.Replace(identity, "~", h, 1)
found = true
}
}Then it goes back to failing "properly", i.e. due to overriding the ssh key for all hosts. |
|
The real issue was that we only had a single key, and didn't support multiple. It was supposed to start with the That is why the podman connection failed, even though ssh is still successful: Changing the order of the ssh config lines (so that The current ssh_config parser returns the first key that it can find, but only a single one. It still needs to expand tilde on the path, though: And apparently there are bugs in support for the The string |
|
@afbjorklund There are multiple issues, see the commits in the PR. But the biggest issue from your PR was that you overwrote settings that were already set in the ssh URL. For the machine connection we already have the proper user, port and identity file set so it should not pick the ones from the shh config as these are defaults not overwrites. |
When we alreadty get a full URL with user, port and identity then we should not read the config file just to overwrite them with wrong values. This is a bad regression for user using * wildcard in their ssh_config as it makes podman machine unusable. Fixes: containers#24567 Fixes: e523734 ("Add support for ssh_config for connection") Signed-off-by: Paul Holzinger <[email protected]>
When we alreadty get a full URL with user, port and identity then we should not read the config file just to overwrite them with wrong values. This is a bad regression for user using * wildcard in their ssh_config as it makes podman machine unusable. Fixes: containers#24567 Fixes: e523734 ("Add support for ssh_config for connection") Signed-off-by: Paul Holzinger <[email protected]> (cherry picked from commit a7120b5)
|
A similar problem occurs when your ssh/config contains something like this: This leads to this problem: This is probably completely my fault, but it took me quite a few hours to narrow this down and it never caused issues before. So this is just a heads-up for people who stumble upon the same issue. |
|
can confirm that adding this to my |
|
The error is still present. It would switch to using file identities instead of ssh-agent. |
Issue Description
After updating to 5.3, I started receiving the following error:
I found that adding
!127.0.0.1and!localhostto the wildcard rule resolved my issue:Steps to reproduce the issue
Steps to reproduce the issue
127.0.0.1orlocalhostin your SSH config rulesDescribe the results you received
OUTPUT
Describe the results you expected
Expected to execute Podman commands without modifying ssh config.
podman info output
Podman in a container
No
Privileged Or Rootless
None
Upstream Latest Release
Yes
Additional environment details
SYSTEM INFO
Additional information
I found that adding
!127.0.0.1and!localhostto the wildcard rule resolved my issue:The text was updated successfully, but these errors were encountered: