Reproduced on a fresh 24.04 LTS box (openssh-client 1:9.6p1) and
verified against 26.04.
Here is what happens:
1. Old key is authorized on the server, new key is not.
2. Run:
$ ssh-copy-id -o StrictHostKeyChecking=no -i /tmp/new_key.pub -o
IdentityFile=/tmp/old_key user@target
3. Output:
/usr/bin/ssh-copy-id: WARNING: All keys were skipped because they already
exist on the remote system.
(if you think this is a mistake, you may want to use -f option)
Checking authorized_keys confirms the new key was never copied.
Why this happens:
In filter_ids(), ssh-copy-id runs:
ssh -i "${PRIV_ID_FILE:-$L_TMP_ID_FILE}" -o PreferredAuthentications=publickey
-o IdentitiesOnly=yes "$@" exit
The script assumes IdentitiesOnly=yes tests only the new key from -i.
But per ssh_config(5), IdentitiesOnly still includes any IdentityFile
passed in "$@". So ssh happily logs in using the old key, exits 0, and
ssh-copy-id pats itself on the back thinking the new key is already
there.
Review of the Codex patch:
The idea of splitting option lists is spot on. However, typical AI moment: it
dropped the LOGIN_ID_OPT logic straight into the cat <<-EOF block, so on
execution it literally prints raw shell code to the user. In addition, on 26.04
when using -f, PRIV_ID_FILE is unset, leaving a dangling "-i " flag in the
suggested login command.
Attached patch:
I have cleaned up the patch, added DEP-3 headers, and attached it as
ssh-copy-id-identityfile-filter.patch.
Tested on the stand:
- Normal install with -o IdentityFile: installs properly.
- Space syntax (-o "IdentityFile ..."): works.
- Idempotency: second run detects existing key and skips as expected.
- Final login hint: outputs clean command without trailing empty flags.
** Patch added: "Fix duplicate-key probe and login hint when -o IdentityFile is
passed"
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2161129/+attachment/5997917/+files/ssh-copy-id-identityfile-filter.patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161129
Title:
ssh-copy-id mix up identities with -i and -o
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2161129/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
