Duplicity restore reports "Invalid SSH password" when I'm using a private key for connection

Question

I'm testing the restoration of a backup with duplicity 0.6.15.

I can login to my backup server just fine using ssh and sftp using the following commands and my private key:

...sftp

root@client:~# sftp -oPort=7843 [email protected]
Enter passphrase for key '/root/.ssh/id_rsa':
Connected to 192.168.x.x
sftp> exit

...ssh

root@client:~# ssh -p7843 [email protected]
Enter passphrase for key '/root/.ssh/id_rsa':
Connected to 192.168.x.x
Last Login: ....

I have the following restore script used to restore the contents of the signed and encrypted backup:

#!/bin/bash
export SIGN_PASSPHRASE='<signed-key-passphrase'
export PASSPHRASE='<encryption-passphrase>'

duplicity -v9 --encrypt-key="<encryption-key-id>" --sign-key="<signed-key-id>" --force \
scp://b[email protected]:7843//home/backupUser/backup /mnt/restore

However when I run the script duplicity:

root@client~#: ./restore_script.sh

Duplicity gives me the following error when duplicity uses it to attempt to login to my backup server:

Using archive dir: /root/.cache/duplicity/b1a470f45b67cd7784bc8e6449383df7
Using backup name: b1a470f45b67cd7784bc8e6449383df7
Import of duplicity.backends.hsibackend Succeeded
Import of duplicity.backends.ftpbackend Succeeded
Import of duplicity.backends.botobackend Succeeded
Import of duplicity.backends.rsyncbackend Succeeded
Import of duplicity.backends.imapbackend Succeeded
Import of duplicity.backends.localbackend Succeeded
Import of duplicity.backends.giobackend Succeeded
Import of duplicity.backends.ftpsbackend Succeeded
Import of duplicity.backends.cloudfilesbackend Succeeded
Import of duplicity.backends.gdocsbackend Succeeded
Import of duplicity.backends.tahoebackend Succeeded
Import of duplicity.backends.u1backend Succeeded
Import of duplicity.backends.webdavbackend Succeeded
Import of duplicity.backends.sshbackend Succeeded
Main action: restore
================================================================================
duplicity 0.6.15 (August 19, 2011)
Args: /usr/bin/duplicity -v9 --encrypt-key=<encryption-key-id> --sign-key=<signature-key-id> --force scp://[email protected]:7843//home/backupUser/backup /mnt/restore
Linux client 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:50:42 UTC 2011 i686 i686
/usr/bin/python 2.7.2+ (default, Oct  4 2011, 20:03:08) 
[GCC 4.6.1]
================================================================================
Using temporary directory /tmp/duplicity-sLukkP-tempdir
Registering (mkstemp) temporary file /tmp/duplicity-sLukkP-tempdir/mkstemp-12JD0o-1
Temp has 4995375104 available, backup will use approx 34078720.
Running 'sftp  -oPort=7843 -oServerAliveInterval=15 -oServerAliveCountMax=2 [email protected]' (attempt #1)
State = sftp, Before = 'Enter'
State = sftp, Before = ''
Invalid SSH password
Running 'sftp  -oPort=7843 -oServerAliveInterval=15 -oServerAliveCountMax=2 [email protected]' failed (attempt #1)
Removing still remembered temporary file /tmp/duplicity-sLukkP-tempdir/mkstemp-12JD0o-1
INT intercepted...exiting.

I have a public key in my .ssh directory, and it should allow duplicity to login using that rather than asking for an ssh-password (which I have turned off on the server anyway), so I don't understand why the server is not allowing duplicity to login.

Here's my client's listing of the .ssh directory, permissions and all:

root@client:~# ls -la /root/.ssh
total 16
drwx------ 2 root root 4096 2011-11-29 01:05 .
drwx------ 8 root root 4096 2011-11-29 12:30 ..
-rw------- 1 root root 1766 2011-11-29 01:06 id_rsa
-rw-r--r-- 1 root root  442 2011-11-29 00:38 known_hosts

Is there something I'm missing? I got the backup to work just fine, and I'd like to test out restoring the backup before sealing the deal here and saying that it works.

Answer 1

Okay, I figured it out. In order for duplicity to enter the passphrase for the ssh key, (not for the gpg encryption-key), keychain must be installed and configured, and the key must be added using the ssh-add command.

I needed to install keychain, so I did,

and then add I added it to my .bash_profile like so:

keychain --clear id_rsa
. ~/.keychain/$HOSTNAME-sh

Now assuming my public key is stored along with my private key in the /root/.ssh directory, when I switch users to root I first get an error, but after that I run ssh-add, exit out of the account, and log back in as root again.

When I return to the root account, I am asked for the ssh private key's passphrase. Now duplicity appears to work... as far as connecting to the other server anyway... I no longer get the Invalid SSH Password message I was getting earlier.