ssh connexion error when deploying with capistrano

[jpprost]

Hi,

as I am reaching the final step of setting up deployment with capistrano, i.e., actually deploying on the remote server, I get the following error message:

00:00 rvm1:hook
      01 mkdir -p /home/deploy/consul/rvm1scripts/
#<Thread:0x00007ff24faf5d40 /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/runners/parallel.rb:10 run> terminated with exception (report_on_exception is true):
/usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/ed25519_loader.rb:19:in `raiseUnlessLoaded': unsupported key type `ssh-ed25519' (NotImplementedError)
net-ssh requires the following gems for ed25519 support:
 * ed25519 (>= 1.2, < 2.0)
 * bcrypt_pbkdf (>= 1.0, < 2.0)
See https://github.com/net-ssh/net-ssh/issues/565 for more information
Gem::LoadError : "ed25519 is not part of the bundle. Add it to your Gemfile."
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/buffer.rb:337:in `read_keyblob'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/buffer.rb:248:in `read_key'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/key_factory.rb:102:in `load_data_public_key'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/key_factory.rb:83:in `load_public_key'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/key_manager.rb:267:in `block in load_identities'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/key_manager.rb:264:in `map'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/key_manager.rb:264:in `load_identities'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/key_manager.rb:110:in `each_identity'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/methods/publickey.rb:18:in `authenticate'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/session.rb:87:in `block in authenticate'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/session.rb:71:in `each'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh/authentication/session.rb:71:in `authenticate'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/net-ssh-7.2.0/lib/net/ssh.rb:260:in `start'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/connection_pool.rb:63:in `call'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/connection_pool.rb:63:in `with'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/netssh.rb:177:in `with_ssh'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/netssh.rb:130:in `execute_command'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/abstract.rb:148:in `block in create_command_and_execute'
	from <internal:kernel>:90:in `tap'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/abstract.rb:148:in `create_command_and_execute'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/abstract.rb:80:in `execute'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/rvm1-capistrano3-1.4.0/lib/rvm1/tasks/capistrano3.rake:5:in `block (3 levels) in <top (required)>'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/abstract.rb:31:in `instance_exec'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/backends/abstract.rb:31:in `run'
	from /usr/share/rvm/gems/ruby-3.1.4/gems/sshkit-1.21.5/lib/sshkit/runners/parallel.rb:12:in `block (2 levels) in execute'
(Backtrace restricted to imported tasks)
cap aborted!
NotImplementedError: unsupported key type `ssh-ed25519'
net-ssh requires the following gems for ed25519 support:
 * ed25519 (>= 1.2, < 2.0)
 * bcrypt_pbkdf (>= 1.0, < 2.0)
See https://github.com/net-ssh/net-ssh/issues/565 for more information
Gem::LoadError : "ed25519 is not part of the bundle. Add it to your Gemfile."

Tasks: TOP => rvm1:hook
(See full trace by running task with --trace)

In order to make sure that I had an rsa key on my server I ran again the commands:

sss-keygen -R my_domain
ssh-copy-id -i ~/.ssh/id_rsa.pub root@my_domain

then successfully connected with ssh root@my_domain.

Since I do have indeed ed-25519 key files in my ~/.ssh/, I am afraid it is a problem related to my management of ssh keys, but I just wanted to make sure, because of the gems-related comment in the message.

Any idea?

Cheers,
JP

[javierm]

I'm not sure Capistrano offers an option to configure the SSH key to use 🤔. Not an expert on these things (I only use one SSH key per system user), but maybe you could edit your ~/.ssh/config so it uses your RSA key when connecting to the production server 🤔.

[jpprost]

you could edit your ~/.ssh/config so it uses your RSA key when connecting to the production server 🤔.

Good Idea. I modified my config file to append the following:

Host consul-prod
	Hostname my.domain.name
	User deploy
	Port 22
		IdentityFile ~/.ssh/id_rsa
		IdentitiesOnly yes

But it is not enough. My guess(*) is that the ssh command itself would have to be modified in order to specify which host to use. Here it would be ssh consul-prod.

But the problem definitely comes from the multiple key-pair files, since keeping only the rsa pair in my ~/.ssh/ did work.

After a quick look around, at deploy-secrets.yml and deploy.rb (line 23), it looks to me like the ssh command in use is built somewhere else in the code and does not allow to be configured through the values given in ~/.ssh/config. Of course I might be wrong, since I couldn't find where the command itself lies in the code. But if I'm right, could an option to handle multiple keys be to automate the modification of the ssh config file, so that the command, wherever it is called, is simply something like ssh consul-prod? Of course, I'm just speculating here.
Thanks anyway for your concern, and for your suggestion ;-)

However, I now need to find a way to manage and use my other key-pairs 🤔.

(*) Reference:
https://linuxize.com/post/using-the-ssh-config-file/