error in libcrypto, loading ssh key from an environment variable #21481

ctaque · 2022-10-24T16:51:05Z

ctaque
Oct 24, 2022

Operating system :

environment: docker
image: ubuntu:kinetic
openssl version 3.0.3
libssl-dev installed

I'm doing:

ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub

or

ssh-add ~/.ssh/id_rsa

What I get :

Load key "/root/.ssh/id_rsa": error in libcrypto

I'm loading an ssh private key from a Gitlab CI variable.
I tried adding a newline at the end of the variable like so:

SSH_PRIVATE_KEY: "-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAuNk4L4Cf4oDaDjXdjNydM6g5hg5/wGzxoqzENx2Xxq1QminyrZpB
...
MmlCwQe7o/n+W8xUTFPJLr6dUBwILrdI5qH6ZmKyoY4WJtdgwzTc2pLLnf7dES466jtruY
vwbTGCQPZajU5h2/ZcE3jnFLZAvJZO1IxWURXL5AwWtIf/MKOT/aS7rPiKEXotqBCWsX65
Eo6Re1Rp+K3vifSALr2QbOfhd2yVy27oM8FuFQQpOppOJQPuWuwmSyHbT6AhIlAbo8E2v1
mrCMIVawQXSytHAAAAFmN5cHJpZW5AY3lwcmllbi11YnVudHUBAgME
-----END OPENSSH PRIVATE KEY-----
"

The key can be imported in the key store in the host operating system

related SO issue :

https://stackoverflow.com/questions/74183218/gilab-ci-load-ssh-key-from-environment-variable

It may be more a usage issue rather than a bug. I've spent the day trying to solve this and would appreciate a little help.

I can do anything you need

Answered by churumellas

Jul 18, 2023

Hey guys, for future readers. I was using a ssh key file inside Gitlab CI YAML file and I kept getting error in libcrypto message. I did 2 things that FIXED the problem:
1. Just changing the variable type from `FILE` variable to `ENV_VAR`

2. Using `ssh-keygen -t ed25519` when generating the key. Looks like gitlab does not support the default `rsa` keys.
Then everything works fine.

Also use this as the base before_script:
  before_script:
    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client wget gnupg -y )'
    - wget -qO- https://get.docker.com/gpg | apt-key add -
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add …

View full answer

paulidale · 2022-10-25T05:51:19Z

paulidale
Oct 25, 2022
Collaborator

You should report this to the ssh project not OpenSSL. They are completely different.

0 replies

songleo · 2023-03-16T08:22:19Z

songleo
Mar 16, 2023

Hi @ctaque have you fixed this issue in Gitlab CI? I met the same issue if you have some solution, thanks.

0 replies

ctaque · 2023-03-16T16:07:31Z

ctaque
Mar 16, 2023
Author

yes :

  before_script:
    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client wget gnupg -y )'
    - wget -qO- https://get.docker.com/gpg | apt-key add -
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh
    - touch ~/.ssh/config
    - touch ~/.ssh/known_hosts
    - chmod -R 400 ~/.ssh
    - ssh-keyscan ip >> ~/.ssh/known_hosts
    - '[[ -f /.dockerinit ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'

create a variable SSH_PRIVATE_KEY with the content of your key (add an empty line at the end)

That being said, I could'nt make it work with a runner running on my development machine.

0 replies

JamieWithofsPXL · 2023-03-22T15:09:47Z

JamieWithofsPXL
Mar 22, 2023

I'm running into the same problem. I'm using my own ubuntu docker executor. However, the given solution doesn't seem to work for me.

0 replies

ctaque · 2023-03-22T15:17:58Z

ctaque
Mar 22, 2023
Author

It may depend on the image used, in my case:

image:
    name: debian:stretch
    entrypoint: [ '/bin/bash', '-c', 'ln -snf /bin/bash /bin/sh && /bin/bash -c $0' ]

0 replies

JamieWithofsPXL · 2023-03-23T10:25:18Z

JamieWithofsPXL
Mar 23, 2023

I'm running into the same problem. I'm using my own ubuntu docker executor. However, the given solution doesn't seem to work for me.

I solved it by doing a chmod 400 on my private key file variable like this:
chmod 400 /builds/gitlab-instance-1af93b45/drupal-poc.tmp/SSH_PRIVATE_KEY
Then I switched the order of the ssh-add command like this:
ssh-add "$SSH_PRIVATE_KEY" | tr -d '\r'

0 replies

OranGeNaL · 2023-05-27T12:59:28Z

OranGeNaL
May 27, 2023

Solved problem with Gitlab CI. Looks like if store key value like simple variable, Gitlab removes all line breaks from it. But if store key like file variable, it doesn't.

So storing key like file variable works for me.

0 replies

kasra-trendplus · 2023-07-06T11:12:05Z

kasra-trendplus
Jul 6, 2023

Hey guys, for future readers.
I was using a ssh key file inside Gitlab CI YAML file and I kept getting error in libcrypto message.
I did 2 things that FIXED the problem:

Just changing the variable type from FILE variable to ENV_VAR
Using ssh-keygen -t ed25519 when generating the key. Looks like gitlab does not support the default rsa keys.

Then everything works fine.

Also use this as the base before_script:

  before_script:
    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client wget gnupg -y )'
    - wget -qO- https://get.docker.com/gpg | apt-key add -
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh
    - touch ~/.ssh/config
    - touch ~/.ssh/known_hosts
    - chmod -R 400 ~/.ssh
    - ssh-keyscan <ip> >> ~/.ssh/known_hosts
    - '[[ -f /.dockerinit ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'

0 replies

churumellas · 2023-07-18T03:33:17Z

churumellas
Jul 18, 2023

Hey guys, for future readers. I was using a ssh key file inside Gitlab CI YAML file and I kept getting error in libcrypto message. I did 2 things that FIXED the problem:

1. Just changing the variable type from `FILE` variable to `ENV_VAR`

2. Using `ssh-keygen -t ed25519` when generating the key. Looks like gitlab does not support the default `rsa` keys.

Then everything works fine.

Also use this as the base before_script:

  before_script:
    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client wget gnupg -y )'
    - wget -qO- https://get.docker.com/gpg | apt-key add -
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh
    - touch ~/.ssh/config
    - touch ~/.ssh/known_hosts
    - chmod -R 400 ~/.ssh
    - ssh-keyscan <ip> >> ~/.ssh/known_hosts
    - '[[ -f /.dockerinit ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'

Thank you soooo muuuch!!! I want just connect ssh but none in documentation is working, removing the docker config I use this way:

  before_script:
    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
    - eval $(ssh-agent -s)
    - echo "$ID_RSA" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh
    - touch ~/.ssh/config
    - touch ~/.ssh/known_hosts
    - chmod -R 400 ~/.ssh

3 replies

yypastushenko Feb 2, 2024

There is another way to fix it.
I did not change the ci/cd variable type from file to variable (string).
Just added one \n at the end of private key in the value and it worked.

govindkailas Feb 15, 2024

Adding a new line at the end worked for me as well.

SirawichDev Apr 24, 2024

yes this solved my problem as well

azmiadhani · 2023-08-24T00:56:12Z

azmiadhani
Aug 24, 2023

When I follow the official guide (https://docs.gitlab.com/ee/ci/ssh_keys/) I cannot get things to work. But changing the variable type from File to Variable (Default) and configuring .gitlab-ci.yaml like below solves the issues.

stages:
  - deploy

deploy:
  stage: deploy
  image: ubuntu
  before_script:
    - echo "deploying app"
    ##
    ## Install ssh-agent if not already installed, it is required by Docker.
    ## (change apt-get to yum if you use an RPM-based image)
    ##
    - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client git -y )'

    ##
    ## Run ssh-agent (inside the build environment)
    ##
    - eval $(ssh-agent -s)

    ##
    ## Add the SSH key stored in SSH_PRIVATE_KEY variable to the agent store
    ## We're using tr to fix line endings which makes ed25519 keys work
    ## without extra base64 encoding.
    ## https://gitlab.com/gitlab-examples/ssh-private-key/issues/1#note_48526556
    ##
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -

    ##
    ## Create the SSH directory and give it the right permissions
    ##
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh

    ##
    ## Use ssh-keyscan to scan the keys of your private server. Replace gitlab.com
    ## with your own domain name. You can copy and repeat that command if you have
    ## more than one server to connect to.
    ##
    - ssh-keyscan $SSH_HOST >> ~/.ssh/known_hosts
    - chmod 644 ~/.ssh/known_hosts
  script:
    - ssh $SSH_USERNAME@$SSH_HOST
    # Script to run on remote server
    - ls

0 replies

detzen · 2024-01-28T23:52:22Z

detzen
Jan 28, 2024

I could solve the issue with adding a newline at the end of the private key. Variable type is set to "file". Here's the relevant part of my .gitlab-ci.yaml

script:
    - chmod 600 $SSH_PRIV_KEY
    - scp -qi $SSH_PRIV_KEY -o StrictHostKeyChecking=no -r foo $DEPLOYMENT_USER@$DEPLOYMENT_SERVER:/tmp/
    - scp -qi $SSH_PRIV_KEY -o StrictHostKeyChecking=no -r bar $DEPLOYMENT_USER@$DEPLOYMENT_SERVER:/tmp/

Have a look at https://docs.gitlab.com/ee/ci/ssh_keys/
In the Value field, paste the content of your private key from the key pair that you created earlier. Make sure the file ends with a newline.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

error in libcrypto, loading ssh key from an environment variable #21481

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 11 comments 3 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

error in libcrypto, loading ssh key from an environment variable #21481

Replies: 11 comments · 3 replies

paulidale Oct 25, 2022 Collaborator

ctaque Mar 16, 2023 Author

ctaque Mar 22, 2023 Author

Replies: 11 comments 3 replies

paulidale
Oct 25, 2022
Collaborator

ctaque
Mar 16, 2023
Author

ctaque
Mar 22, 2023
Author