Jira (BOLT-920) Bolt unable to connect with ecdsa key

[Cas Donoghue (JIRA)]

Title: Message Title

Cas Donoghue commented on BOLT-920   Re: Bolt unable to connect with ecdsa key Update: The title of this ticket indicates that ecdsa keys do not work with bolt. If the ecdsa key is generated with a version of Openssh that is pre 7.8 (or with the non-openssh format) then the key is compatible with the version of net-ssh (5.0.2) which shipped with bolt (pre 1.11.0). As noted in the comments the root cause is the Openssh formatted key. So keys (including keypairs that use the popular rsa algorithm) that use the Openssh format were incompatible with net-ssh (pre 5.0.2) and therefor with bolt. The bolt 1.11.0 release updated to the latest net-ssh version (5.1.0) which added support for rsa keys with the openssh format. However ecdsa keys with the Openssh format are still incompatible with the latest version (see comment above showing Net::SSH::Exception). So with bolt 1.11.0 an rsa key formatted in the Openssh format will work where previously it did not but ecdsa keys with Openssh format are still incompatible. Previously an Openssh formatted rsa key with bolt < 1.11.0 would produce the following error: [root@ebo9k1qf1fpcs67 bolt]# bolt command run whoami -n rsa-openssh Started on jlmfz1sost45dup.delivery.puppetlabs.net... Failed on jlmfz1sost45dup.delivery.puppetlabs.net: Failed to connect to jlmfz1sost45dup.delivery.puppetlabs.net: expected 64-byte String, got 3 Failed on 1 node: jlmfz1sost45dup.delivery.puppetlabs.net Ran on 1 node in 0.19 seconds Ecdsa keys stored in the Openssh format still produce the following error: [root@ebo9k1qf1fpcs67 Boltdir]# bolt command run whoami -n ecdsa-openssh Started on localhost... Failed on localhost: Failed to connect to localhost: the given identity is known, but the private key could not be loaded: Net::SSH::Exception (Cannot decode private key of type ecdsa-sha2-nistp256) Failed on 1 node: localhost Ran on 1 node in 0.16 seconds Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.