2

The problem

I'm trying to clone private repo from gitlab (self-hosted) during the gitlab build.

I'm using ssh private key without passphrase, but got an error

key_load_private_type: incorrect passphrase supplied to decrypt private key

Files and debug

.gitlab-ci.yml

image: tetraweb/php:5.5

variables:
    TIMEZONE: Asia/Novosibirsk

before_script:
    # Create deploy private key
    - mkdir ~/.ssh
    - echo $DEPLOY_KEY_PRIVATE >> ~/.ssh/id_rsa && chmod 0600 ~/.ssh/id_rsa
    - echo "Host gitlab.example.com"$'\n\t'"IdentityFile ~/.ssh/id_rsa" >> ~/.ssh/config
    - ssh-keyscan -t rsa gitlab.example.com >> ~/.ssh/known_hosts

test:
    script:
        - ssh -vT git@gitlab.example.com

DEPLOY_KEY_PRIVATE contains private key

Build output

gitlab-ci-multi-runner 0.7.2 (abcdefgh)
Using Docker executor with image tetraweb/php:5.5 ...
Pulling docker image gitlab/gitlab-runner:build ...
Pulling docker image tetraweb/php:5.5 ...

Running on runner-18f77f26-project-4-concurrent-0 via gitlab.example.com...
Fetching changes...
HEAD is now at 24c8b8d branch-1: Build 32.
From http://gitlab.example.com/my-company/my-private-repo
   24c8b8d..bfa1b67  branch-1    -> origin/branch-1
Checking out bfa1b67d as branch-1...
Previous HEAD position was 24c8b8d... branch-1: Build 32.
HEAD is now at bfa1b67... branch-1: Build 33.


Current default time zone: 'Asia/Novosibirsk'
Local time is now:      Wed Jan 27 18:43:18 NOVT 2016.
Universal Time is now:  Wed Jan 27 12:43:18 UTC 2016.

$ mkdir ~/.ssh
$ echo $DEPLOY_KEY_PRIVATE >> ~/.ssh/id_rsa && chmod 0600 ~/.ssh/id_rsa
$ echo "Host gitlab.example.com"$'\n\t'"IdentityFile ~/.ssh/id_rsa" >> ~/.ssh/config
$ ssh-keyscan -t rsa gitlab.example.com >> ~/.ssh/known_hosts
# gitlab.example.com SSH-2.0-OpenSSH_6.7p1 Debian-5
$ ssh -vT git@gitlab.example.com
OpenSSH_6.7p1 Debian-5+deb8u1, OpenSSL 1.0.1k 8 Jan 2015
debug1: Reading configuration data /root/.ssh/config
debug1: /root/.ssh/config line 1: Applying options for gitlab.example.com
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to gitlab.example.com [111.111.111.111] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 Debian-5
debug1: match: OpenSSH_6.7p1 Debian-5 pat OpenSSH* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr umac-64-etm@openssh.com none
debug1: kex: client->server aes128-ctr umac-64-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: RSA a1:a2:a3:a4:a5:a6:a7:a8:a9:b1:b2:b3:b4:b5:b6:b7
debug1: Host 'gitlab.example.com' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
Warning: Permanently added the RSA host key for IP address '111.111.111.111' to the list of known hosts.
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: key_load_private_type: incorrect passphrase supplied to decrypt private key
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).

ERROR: Build failed with: exit code 1

Trying the same ssh key on my vps

connection succeeded

me@vps:~$ ssh -vT git@gitlab.example.com
OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /home/me/.ssh/config
debug1: /home/me/.ssh/config line 1: Applying options for gitlab.example.com
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to gitlab.example.com [111.111.111.111] port 22.
debug1: Connection established.
debug1: identity file /home/me/.ssh/deploy_rsa type -1
debug1: identity file /home/me/.ssh/deploy_rsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 Debian-5
debug1: match: OpenSSH_6.7p1 Debian-5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA f1:f2:f3:f4:f5:f6:f7:f8:f9:g1:g2:g3:g4:g5:g6:g7
debug1: Host 'gitlab.example.com' is known and matches the ECDSA host key.
debug1: Found key in /home/me/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/me/.ssh/deploy_rsa
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to gitlab.example.com ([111.111.111.111]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Remote: Forced command.
debug1: Remote: Port forwarding disabled.
debug1: Remote: X11 forwarding disabled.
debug1: Remote: Agent forwarding disabled.
debug1: Remote: Pty allocation disabled.
debug1: Sending environment.
debug1: Sending env LC_PAPER = ru_RU.UTF-8
debug1: Sending env LC_ADDRESS = ru_RU.UTF-8
debug1: Sending env LC_MONETARY = ru_RU.UTF-8
debug1: Sending env LC_NUMERIC = ru_RU.UTF-8
debug1: Sending env LC_TELEPHONE = ru_RU.UTF-8
debug1: Sending env LC_IDENTIFICATION = ru_RU.UTF-8
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending env LC_MEASUREMENT = ru_RU.UTF-8
debug1: Sending env LC_TIME = ru_RU.UTF-8
debug1: Sending env LC_NAME = ru_RU.UTF-8
Welcome to GitLab, Anonymous!
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 3368, received 1856 bytes, in 0.3 seconds
Bytes per second: sent 12948.9, received 7135.7
debug1: Exit status 0
3
  • 1
    Are you certain that key formatting didn't get munged? If the ssh client cannot read in the key properly, I've seen instances where it thinks it's an encrypted key and will ask for a passphrase.
    – EEAA
    Jan 27 '16 at 14:05
  • You are right! There are no linefeeds in the $DEPLOY_KEY_PRIVATE. Please add your answer and I will accept it.
    – Jekis
    Jan 28 '16 at 5:06
  • Excellent. Glad I could help. I've posted an answer below.
    – EEAA
    Jan 28 '16 at 13:53
1

Verify that key formatting didn't get munged.

If the ssh client cannot read in the key properly, I've seen instances where it thinks it's an encrypted key and will ask for a passphrase.

2

I ran into this today and wanted to give another answer in the event I stumbled on it again.

My problem lied with the equivalent to this statement:

echo $DEPLOY_KEY_PRIVATE >> ~/.ssh/id_rsa && chmod 0600 ~/.ssh/id_rsa

I needed to enclose the variable in double quotes, i.e. "$DEPLOY_KEY_PRIVATE".

1
  • 1
    Quoting my key ended up being the solution in my case
    – davethegr8
    May 23 '17 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.