Public bug reported:
I try to install a new key on a host, using an old key to login, using:
ssh-copy-id -i ~/.ssh/new.pub -o IdentityFile=~/.ssh/old user@host
This fails and it say that the key is already installed, which it is not.
If I also use -f (force) it will correctly add the new key, but writes an
invalid instruction:
Now try logging into the machine, with:
ssh -i -o IdentityFile=... 'user@host'
There is an invalid empty -i option in that example.
The expected behavior would be to use the old key specified with -o to login
and copy the key only, and not to verify if the key specified with -i is
already valid. And to present me with a valid test-command afterwards.
Ubuntu 26.04 LTS (kubuntu)
$ dpkg -s openssh-client | grep ^Version
Version: 1:10.2p1-2ubuntu3.4
I had codex patch my file so that I could use it, it gave me this summary that
perhaps is useful:
Summary of ssh-copy-id IdentityFile fix
The duplicate-key check was reusing the full ssh option list, including user
options such as -o IdentityFile=~/.ssh/old. Because ssh treats IdentityFile as
additive, the filter probe could authenticate with the old key and falsely
decide that the new key was already installed.
The script now keeps separate option lists:
- the normal install path keeps all user ssh options, including IdentityFile;
- the duplicate-key filter drops explicit -o IdentityFile options so it only
tests the key being installed;
- the final "Now try logging in" hint also drops the old IdentityFile option.
The final login hint no longer prints a bare -i when -f is used with a .pub
file.
It suggests -i <matching-private-key> only when that private key is readable;
otherwise it prints the target host command without -i.
Known limitation: IdentityFile entries supplied indirectly through an ssh config
file with -F are still preserved. Handling those would require a larger config
normalization change.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: openssh-client 1:10.2p1-2ubuntu3.4
ProcVersionSignature: Ubuntu 7.0.0-27.27-generic 7.0.6
Uname: Linux 7.0.0-27-generic x86_64
ApportVersion: 2.34.0-0ubuntu2
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Fri Jul 17 21:20:34 2026
InstallationDate: Installed on 2026-06-08 (39 days ago)
InstallationMedia: Kubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423)
RelatedPackageVersions:
ssh-askpass N/A
libpam-ssh N/A
keychain N/A
ssh-askpass-gnome N/A
SSHClientVersion: OpenSSH_10.2p1 Ubuntu-2ubuntu3.4, OpenSSL 3.5.5 27 Jan 2026
SourcePackage: openssh
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: openssh (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161129
Title:
ssh-copy-id mix up identities with -i and -o
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2161129/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
