Key not used during SSH handshake

[webpolis]

I have my key_path set and properly mounted, but it seems it's not even used during SSH handshake:

2017/03/03 14:45:08 staging.xxxxxx.com: outputs: 
0s
8
2017/03/03 14:45:08 drone-ssh error:  ssh: handshake failed: ssh: unable to authenticate, attempted methods [none], no supported methods remain
0s
9
ssh: handshake failed: ssh: unable to authenticate, attempted methods [none], no supported methods remain

This is how the pipeline looks like:

  ssh:
    image: appleboy/drone-ssh
    when:
      branch: [staging, production]
    host: ${DRONE_BRANCH}.xxxxxx.com
    port: 9999
    user: root
    key_path: /root/${DRONE_BRANCH}.key
    script:
      - echo "yay"

And my docker-compose.yml:

  drone-server:
    container_name: xxxxxxx-ci
    image: drone/drone:0.5
    volumes:
      - /var/lib/drone:/var/lib/drone
    restart: always
    env_file: drone.env
  drone-agent:
    image: drone/drone:0.5
    command: agent
    restart: always
    depends_on: [ drone-server ]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /root/staging.key:/root/staging.key
    env_file: drone.env

Of course, the .key file is present:

-rw-r--r--  1 root root      3326 Mar  1 12:57 staging.key

[PeterCat12]

I seem to be experiencing this issue as well..

[xenji]

I would set the file permissions 0600 and give that a try. openssh is strict about the key security. If that still does not work, I would also assume a bug.

[appleboy]

Please set file permission as 400.

[appleboy]

@webpolis Any updates?

[fredix]

hi @appleboy ,
I have the same issue, my pipeline is

ssh:
    image: appleboy/drone-ssh
    host: 192.168.254.1
    port: 22
    username: drone
    key_path: /root/drone.key
    #secrets: [ssh_username, ssh_key]
    script:
      - "docker service update --image fredix/hugo hugo"
    when:
      status: success

my yml for docker swarm is

  drone-agent:
    image: drone/drone:0.7.1
    restart: always
    env_file: .env.production-agent
    command: agent
    depends_on:
      - drone-server
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /sync/drone/agent/drone.key:/root/drone.key
    deploy:
      placement:
        constraints:
          - node.labels.location == home

permission is set to 400

ls -al /sync/drone/agent/drone.key 
-r--------. 1 root root 3243  6 juin  01:45 /sync/drone/agent/drone.key

[appleboy]

@fredix I will try your config.

[pranay-91]

Is there any update on this issue??

[dev-drprasad]

Hi @appleboy , I have the same issue, any updates ??

[appleboy]

@dev-drprasad Could you help try to add ssh key using drone secret?

[chrisliuqq]

Dear all,
i try all the method from issue, but the problem still exists,
no matter using the secrets in drone or key_path will cause the problem.

BUT, I solved the problem only by upgrading the drone from 0.7 to 0.8.
I have no idea why, if someone is still facing the problem, maybe give it a try.

[appleboy]

@chrisliuqq It is working on drone 0.5, 0.6, 0.7 and 0.8 version with secrets in drone. maybe I should try it out for the key_path way.

[PeterCat12]

This was awhile ago but I believe I experienced this issue whilst trying to mount an ssh key to my drone server's ~/.ssh directory (Which is a big no-no). I would recommend creating a brand new drone container and make sure you aren't mounting anything funky to the drone server and then adding the key via secrets as @appleboy suggests.

[appleboy]

Please enable the trusted mode in project setting if you want to load secret key from key_path. See the following screenshot.

[harryxu]

I have enabled the Trusted option on Project Settings , but still not working with key_path.

But I find a solution: Mount private key to the plugin's container instead of drone agent.

pipeline:

pipeline:
  ssh:
    image: appleboy/drone-ssh
    host: xxxxx.com
    username: deploy
    volumes:
      - /root/drone_rsa:/root/ssh/drone_rsa
    key_path: /root/ssh/drone_rsa
    script:
      - echo "test ssh"

That works!

Of course, enabled the Trusted mode is required.

[fredix]

hi @harryxu !
good job, i tried your config and it works well. @appleboy maybe you should update doc with that tips ?