Bug 119008 - [SSH2 FAQ] extssh asks for password even if already there
Summary: [SSH2 FAQ] extssh asks for password even if already there
Status: RESOLVED FIXED
Alias: None
Product: Platform
Classification: Eclipse Project
Component: CVS (show other bugs)
Version: 3.1   Edit
Hardware: PC Windows XP
: P3 normal (vote)
Target Milestone: 3.2   Edit
Assignee: platform-cvs-inbox CLA
QA Contact:
URL:
Whiteboard:
Keywords: faq
Depends on:
Blocks:
 
Reported: 2005-12-02 03:47 EST by Michael H. CLA
Modified: 2007-03-27 08:11 EDT (History)
4 users (show)

See Also:


Attachments
In this jar, password auth is disabled. (144.36 KB, application/octet-stream)
2006-04-24 21:09 EDT, Atsuhiko Yamanaka CLA
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michael H. CLA 2005-12-02 03:47:14 EST
Every time I try to connect to a CVS repository after starting Eclipse using connection type extssh I am asked for the password although the password is already saved.
If I enter a password in the appearing dialog, the dialog is shown again. This happens until I click on Cancel. Then evrything works fine.
It seems that the already stored password is used, because it also works, if I click on cancel the first time the dialog is shown.
After the first successful connect to the repository I am never asked again until I restart Eclipse.
The only thing which is abnormal is that I do not use the default port for extssh but the port 22222.
Comment 1 Edward S. Blurock CLA 2006-02-08 09:02:38 EST
I have eclipse 3.1.2, running under linux fedora core 3 (I left the window XP spec in the bug report above -- just wanted to add this extra note).
I am doint cvs under ext (default port).
I cannot save the password.  Checking the 'Save Password' does not stay.  The check is there until I close and then when I reopen, the check is not there anymore (under Password Manager in the preferences shows no extry).

The trick with cancel does not work for me.  I have to enter the password everytime.

The only thing I can think of is protection problems on one of the preference/password files (where are they)?
Comment 2 Michael Valenta CLA 2006-02-08 09:16:31 EST
The .keyring file is placed in the config directory by default. There is a command line switch (-keyring) for specifying an alternate location.
Comment 3 Michael H. CLA 2006-02-08 09:20:52 EST
(In reply to comment #0)
Somehow it works correctly now. I did not update anything in eclipse, but the password is now stored correctly and I am not asked for it anymore.
I do not know what happened. Maybe the corresponding server has changed the cvs version or the ssh version, but it is just a guess and I am not able to verify this.
So to me the bug is no longer existing.
Comment 4 Michael Valenta CLA 2006-02-08 09:39:23 EST
OK, I'll close this then. Edward, if your problem persists after moving the keyring to a known writtable location, please reopen.
Comment 5 Ris Misner CLA 2006-04-21 19:08:45 EDT
I have exactly the same problem that Michael described in the first post:

[quote]
Every time I try to connect to a CVS repository after starting Eclipse using
connection type extssh I am asked for the password although the password is
already saved.
If I enter a password in the appearing dialog, the dialog is shown again. This
happens until I click on Cancel. Then evrything works fine.
It seems that the already stored password is used, because it also works, if I
click on cancel the first time the dialog is shown.
After the first successful connect to the repository I am never asked again
until I restart Eclipse.
[/quote]

I am not using any special ports or anything.  My cvs repository is on cvsdude.org.  I have been struggling with this problem for months and it has not gone away.  Not only does it prompt the first time I use CVS after starting Eclipse, but it randomly prompts at later times - ONLY in response to explicit commands like diffs and commits.  Background sync operations never prompt me for a password.

In an attempt to get rid of this annoying problem, I tried switching to Putty as a third party SSH client, which SHOULD mean that Eclipse no longer cares about my password and will let Putty handle it... but no, it still prompts me, pointlessly, before deferring to Putty for authentication.

Having just read the bug report on here about prompting for a password after an internet connectivity error, I have this theory... when I try to connect to CVS at the same time as a background operation, MAYBE my server refuses the second simultaneous connection... leading it to have a refused connection attempt, which makes it think it should prompt for a password... even though it already knows my password.

If there is any possible work-around for this, I would love to hear it.  I would even use an alpha build to get a fix.  I'm getting really tired of hitting escape to cancel those password prompts, or queing up 5 commits and coming back 20 minutes later to find it waiting for me to enter a password...
Comment 6 Michael Valenta CLA 2006-04-21 20:54:21 EDT
The problem on our end is that we haven't been able to reproduce this problem. What build are you using? Have you tried the latest nightly builds (i.e. these are fairly stable as we are in lockdown for the 3.2 release). We've upgraded the version of Jsch we are using so it may be the case that the problem has been fixed already. If not, at least we'll know that the issue applied to the latest code base.
Comment 7 Ris Misner CLA 2006-04-24 15:04:39 EDT
I just installed 3.2RC1 and it exhibits the same problem: it prompts for my password, I enter my correct password and click OK, and it immediately prompts for my password again.  This repeats infinitely until I cancel the password prompt, at which point it uses my saved password.  It does not seem to make any difference whether I check the box to remember my password or not.

I could not try the nightly build because there's no windows installer, and I am running on Windows XP Media Center edition.

Since you have trouble reproducing the problem, I'm inclined to think it's dependant on server behavior, so you might have some luck reproducing the bug if you open a free CVS repository on cvsdude.org

I am using Putty for SSH authentication, so Putty should be handling authentication with my server, and eclipse should not even care what my password is.

Does the CVS functionality of Eclipse revert to pserver authentication if the SSH fails?  I have eclipse configured for Putty, which requires a system tray task that I DO NOT have running right now, and yet I was just able to perform a commit to CVS, which SHOULD have failed because the putty agent is not running, and yet it worked.  What the heck?  Maybe I don't understand putty as well as I thought and the agent program is not really required?
Comment 8 Atsuhiko Yamanaka CLA 2006-04-24 21:09:32 EDT
Created attachment 39380 [details]
In this jar, password auth is disabled.

Hi, I'm a committer of org.eclipse.team.cvs.ssh2 plugin.

I have guessed the reason.
May I ask you to replace 3.2RC1's plugins\com.jcraft.jsch_0.1.27.jar with attached version?

It seems cvsdude.org supports three auth methods
  publickey,password,keyboard-interactive
I guess Eclipse will try at first 'password' auth method and,
after cancel operation keyboard-interactive will be tried and succeeded.

I guess password auth has a problem on cvsdude.org, but keyboard-interactive 
don't have. By using attached jar, the trial for password auth method will be
skipped.

Please note that jar is just for testing.
Comment 9 Ris Misner CLA 2006-04-24 21:49:13 EDT
Thank you so much!  I just did two quick commit tests and it never prompted me.  Normally, the first time I load eclipse, I'm always prompted, so it looks like this change is doing the trick.  But it's an intermittent problem, so I will post back again after I have used it more thoroughly to verify that it is still not prompting me for passwords.

Yay I'm so happy!!! :)
Comment 10 Atsuhiko Yamanaka CLA 2006-04-25 01:06:27 EDT
FYI, I have written the following message to support@cvsdude.org and
it seems their configurations have been changed, now.  I hope that you will
be able to enjoy cvsdude.org with original Eclipse 3.2RC1 extssh.

  |We have received a bug report in connecting to cvsdude.org by
  |using eclipse extssh[1]
  |It seems that there is a problem in password auth on that cvsdude.org.
  |I guess your /etc/ssh/sshd_config has following lines,
  |
  |UsePAM yes
  |ChallengeResponseAuthentication yes
  |PasswordAuthentication yes
  |
  |So, by modifying as follows,
  |
  |UsePAM yes
  |ChallengeResponseAuthentication yes
  |#PasswordAuthentication yes
  |PasswordAuthentication no
  |
  |that reporter and your customers will become happy with Eclipse extssh
  |without using and configuring external programs like Putty.
  |
  |[1] https://bugs.eclipse.org/bugs/show_bug.cgi?id=119008
Comment 11 Michael Valenta CLA 2006-04-25 08:43:39 EDT
I will update the FAQ with this information.
Comment 12 Ris Misner CLA 2006-04-26 19:17:22 EDT
I am having a new problem now, and unfortunately it takes some explaining, so here's what I did...

First I should explain that when I upgraded from 3.1.2 to 3.2RC1, I copied the new version over top of the old one, allowing it to overwrite files and directories.

After you so kindly got cvsdude.org to fix their server, my CVS operations ran smoothly whether using Putty or the built-in SSH authentication, and I was never prompted for a password, so that much was working beautifully.

However, I kept getting a lot of internal errors during various operations:
- saving from diff editors
- exiting eclipse
- Override and Update operations
- and others I don't remember now (I have been taking steps to attempt correcting these problems without help, as I will explain)

I attributed this to my "dirty" install and possible files or plugins remaining from 3.1.2 being used by 3.2RC1 and causing conflicts.  Additionally, I was concerned about the replacement jsrc plugin I had used for testing.  So I deleted my eclipse folder and reinstalled from 3.2RC1 zip file I had downloaded.

Now I find that I am prompted for my password twice at startup, using the keyboard interaction dialog, and entering my correct password both times, it allows CVS to operate free of password prompts forever after that until I exit and restart the program, at which point I get two password prompts again.  Switching back to Putty does not remove these password prompts.

Additionally, the Team Sync perspective does not update correctly, and refuses to show files that I know are modified vs. the repository, even if I manually click the button to synchronize.  I find that if I browse for such a file in the Resource view, and then open that file in Eclipse's editor, THEN it realizes the file is modified and committable, and shows it in the team sync view.

So at this point, I'm thinking 3.2RC1 has bugs, and I should just roll back to 3.1.2, which worked great for me except for the password prompts, which should now be fixed by my server.  So I deleted my eclipse folder and reinstalled from the 3.1.2 zip file for windows.  Now it continues to have the problem with the team synchronization view, AND the Resource view is completely empty - it shows nothing, no root folder, no contents whatsoever, just a blank white window.  The team sync view shows the two files that I tricked it into realizing were modified by opening the files in the editor, but the resource view is empty.

I have tried reinstalling 3.2RC1 and 3.1.2 back and forth, playing with options, exiting and restarting the program, switching back to Putty, and everything I can think of to make it work, and nothing helps.  I can't get the team sync view problem to go away no matter what I do.  3.2RC1 gives many internal error messages.  3.1.2 shows an empty resource view.  And both versions fail to update the team sync view when I make changes to files, even if I manually press the sync button instead of waiting for a background sync.

What should I do?  I can't use it at all now because of these problems.  Do I have to re-checkout my project from scratch?  Will that even help?
Comment 13 Atsuhiko Yamanaka CLA 2006-04-26 19:44:29 EDT
At least, on the combination Eclipse 3.2RC1 and www.cvsdude.org(209.51.139.28)
such a password prompting issue will not appear.  Which host are you connecting to?  

And then, since its beginning, I have had a question, why you don't use 
public-key authentication?
 
Comment 14 Ris Misner CLA 2006-04-26 20:44:16 EDT
I think it was all just a corrupted installation.  To make a long story short, everything seems to be working now.

After a clean install of 3.1.2, I was still having problems as described in my last post.  After writing that message, I deleted the .metadata folder and checked out my projects from CVS all over again, allowing 3.1.2 to recreate any data it needed.  Afterward, I still had the same problems with the resource and team sync perspectives.

However, I decided to go ahead and reconfigure all the settings and UI layout to my tastes, since they had all been reset to defaults, and afterward, everything is now working as expected: my team sync view updates correctly, my Resource view shows all the files, and I'm not getting password prompts.  I changed a ton of options, so I can't be 100% certain exactly what I changed that fixed it, but... I think what I had to do was change the CVS SSH2 auth method options to use the built-in extssh, and configure the options for that so it could see my SSH key files (had to point it to the correct directory) and now all is well.  YAY!!

To answer your question, I've been trying to use public key authentication this whole time, and always wondered why eclipse was prompting me for a password anyway.  It seems it was just some weird configuration issue and I was able to straighten it out between reinstalling/reconfiguring my client, and of course your very kind help asking cvsdude.org to fix their server configuration.

I love Eclipse.  Thank you very much for all your help, and for making this software freely available.  I sincerely appreciate it :)
Comment 15 Michael Valenta CLA 2006-05-31 15:04:40 EDT
FAQ updated
Comment 16 Matthew Patterson CLA 2007-03-27 00:30:01 EDT
I think I discovered the root of this problem, or at least one cause of it. I was being prompted for my dsa key passphrase, and then for the ssh password every time I did anything with CVS. While fiddling with the public key authentication I tried simply logging in using ssh from the command line. It gave me this error:


mpatterson@mattrp:~ $ ssh localhost
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/mpatterson/.ssh/id_dsa' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: /home/mpatterson/.ssh/id_dsa
Enter passphrase for key '/home/mpatterson/.ssh/id_dsa':
Password:


When I corrected the permissions issue I was able to use eclipse CVS with no more password prompts or issues.
Comment 17 Michael Valenta CLA 2007-03-27 08:11:34 EDT
Matthew, could you open a separate bug report for that?