Adding new user and ssh-key disables admin?

[ltsuda]

Hello guys,

I was trying for the first time this project and I start up with the environment variable that enables the admin account. This works fine.

But then, when I add a new user and a new ssh key to this user, the next commands apparently is using this new user instead of the admin.
The results is that I create a new non-admin user with their ssh key, then the following commands returns as not authenticated/authorized.

I followed this section:
https://github.com/charmbracelet/soft-serve#user-management

Is this expected?

[ltsuda]

Hello guys,

I was trying for the first time this project and I start up with the environment variable that enables the admin account. This works fine.

But then, when I add a new user and a new ssh key to this user, the next commands apparently is using this new user instead of the admin. The results is that I create a new non-admin user with their ssh key, then the following commands returns as not authenticated/authorized.

I followed this section: https://github.com/charmbracelet/soft-serve#user-management

Is this expected?

Looks like this issue #303

[aymanbagabas]

How did you connect to the server? ssh by default sequentially uses all the keys in your keychain, could it pick the wrong key? You can verify what key was used using ssh -v [host]. Use ssh -i [key] -o IdentitiesOnly=yes [host] to specify a key and only use the provided identity key.

[ltsuda]

I did the installation with the initial admin key, then generated a new different key still from the soft-serve host, created a new user and added this new key to this new user.
I will try again after work and return with the results, appreciate the help.

[ltsuda]

Well, tried to reproduce installing on WSL2/W11 via go install but couldn't reproduce :( but git cloning a repo using ssh from the same WSL (another tab) gets stuck at `cloning into 'repo-name'...

I will try to setup a Ubuntu server 22.04 VM again and install it using apt. I'm sorry for now, let me see if I can reproduce and record,

[ltsuda]

I think I reproduced and kind understood the issue, after creating a new user and adding a pubkey to it, soft-serve commands was using only this new ssh key which failed to authenticate because user is not an admin.

I think the fix is to add the initial-admin token to ssh-agent with the following:

tester@tester-soft:~$ eval $(ssh-agent -s)
Agent pid 2292

tester@tester-soft:~$ ssh-add ~/.ssh/id_ed25519
Identity added: /home/tester/.ssh/id_ed25519 (soft-serve)
tester@tester-soft:~$ ssh -p 23231 localhost user list
admin
beatrice

logs:

tester@tester-soft:~$ ssh -p 23231 localhost user create beatrice
tester@tester-soft:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/tester/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/tester/.ssh/id_rsa
Your public key has been saved in /home/tester/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:75mHJPl/D5y/EjEeoTgH0PkzriWmDub+YsqpnLt9RG0 tester@tester-soft
The key's randomart image is:
+---[RSA 3072]----+
|       .o .      |
|         +   .   |
|      .   + . .  |
|     . E o * +   |
|    . . S.+ + +  |
|     .  o+.o + . |
|    .o  o+=.  =  |
|. + ++.. ooo...o |
| *+==o+o  +o...o+|
+----[SHA256]-----+

tester@tester-soft:~$ cat /home/tester/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6IE42K8I5XBkVJSwuJXkKr8y1fGDs6i7oDV19iw5nvk6lm46xYzQDB0NZ+yYPLftlGE7NHUeI3Pl+r7MSOLbv0epBMVTLE7esYceDBNmXYX6GWR35P0WV76loazaxEAExeYOkBDKD42pH1CQloNpIYoCQH3FUn67X6rWVxmiEe1O4dEuum6YuW7cwwL3t6X8d15GCsajSsnsFJDj80YrlFJSuU0BK0/B4ev+eNsT/MjvSsEltGMIDk6ImJiF3GJ0b88ESRht12Uf0jlVmXAF+1KsxcvjABE3E96y3HljkJ1Y2pZnch3YlLNiTieACdMqmgwdaD/iialwlqgKLSlNVILSiaWG24mb3CUrTVo7ZUl/C+SRpAsGFV9mlmLNZQWuUl2AS2j3H+S+uYTpql56KdBEkOIbh9hW/p7umI1vrVyxIlEtbyySsjMDWiSqOpBAPpsuFv5dpHlIrsxOdaxR4bPfif4rE06++WypWPLqpkz7fKKlTGfuXxC4SdYIZ0xE= tester@tester-soft

tester@tester-soft:~$ ssh -p 23231 localhost user add-pubkey beatrice 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6IE42K8I5XBkVJSwuJXkKr8y1fGDs6i7oDV19iw5nvk6lm46xYzQDB0NZ+yYPLftlGE7NHUeI3Pl+r7MSOLbv0epBMVTLE7esYceDBNmXYX6GWR35P0WV76loazaxEAExeYOkBDKD42pH1CQloNpIYoCQH3FUn67X6rWVxmiEe1O4dEuum6YuW7cwwL3t6X8d15GCsajSsnsFJDj80YrlFJSuU0BK0/B4ev+eNsT/MjvSsEltGMIDk6ImJiF3GJ0b88ESRht12Uf0jlVmXAF+1KsxcvjABE3E96y3HljkJ1Y2pZnch3YlLNiTieACdMqmgwdaD/iialwlqgKLSlNVILSiaWG24mb3CUrTVo7ZUl/C+SRpAsGFV9mlmLNZQWuUl2AS2j3H+S+uYTpql56KdBEkOIbh9hW/p7umI1vrVyxIlEtbyySsjMDWiSqOpBAPpsuFv5dpHlIrsxOdaxR4bPfif4rE06++WypWPLqpkz7fKKlTGfuXxC4SdYIZ0xE= tester@tester-soft'

tester@tester-soft:~$
tester@tester-soft:~$ ssh -p 23231 localhost user list
Error: unauthorized
tester@tester-soft:~$ ssh -p 23231 localhost user info admin
Error: unauthorized

############ debug:

tester@tester-soft:~$ ssh -v -p 23231 localhost user list
OpenSSH_8.9p1 Ubuntu-3ubuntu0.4, OpenSSL 3.0.2 15 Mar 2022
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to localhost [127.0.0.1] port 23231.
debug1: Connection established.
debug1: identity file /home/tester/.ssh/id_rsa type 0
debug1: identity file /home/tester/.ssh/id_rsa-cert type -1
debug1: identity file /home/tester/.ssh/id_ecdsa type -1
debug1: identity file /home/tester/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/tester/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/tester/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/tester/.ssh/id_ed25519 type 3
debug1: identity file /home/tester/.ssh/id_ed25519-cert type -1
debug1: identity file /home/tester/.ssh/id_ed25519_sk type -1
debug1: identity file /home/tester/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/tester/.ssh/id_xmss type -1
debug1: identity file /home/tester/.ssh/id_xmss-cert type -1
debug1: identity file /home/tester/.ssh/id_dsa type -1
debug1: identity file /home/tester/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1
debug1: compat_banner: match: OpenSSH_7.6p1 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to localhost:23231 as 'tester'
debug1: load_hostkeys: fopen /home/tester/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:7Fg/IqPnQswswqTfQoAjUrTpUrSute82llmo0l5yDMc
debug1: load_hostkeys: fopen /home/tester/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '[localhost]:23231' is known and matches the ED25519 host key.
debug1: Found key in /home/tester/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /home/tester/.ssh/id_rsa RSA SHA256:75mHJPl/D5y/EjEeoTgH0PkzriWmDub+YsqpnLt9RG0
debug1: Will attempt key: /home/tester/.ssh/id_ecdsa
debug1: Will attempt key: /home/tester/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/tester/.ssh/id_ed25519 ED25519 SHA256:FtWr4vsKHevpqhFGRL1bo+SU5qgh1deXppj9RFOE5rY
debug1: Will attempt key: /home/tester/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/tester/.ssh/id_xmss
debug1: Will attempt key: /home/tester/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss>
debug1: kex_input_ext_info: [email protected] (unrecognised)
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
####### >>>>>>>>>> HERE
debug1: Offering public key: /home/tester/.ssh/id_rsa RSA SHA256:75mHJPl/D5y/EjEeoTgH0PkzriWmDub+YsqpnLt9RG0offered non-admin key
######  <<<<<<<  END
debug1: Server accepts key: /home/tester/.ssh/id_rsa RSA SHA256:75mHJPl/D5y/EjEeoTgH0PkzriWmDub+YsqpnLt9RG0
Authenticated to localhost ([127.0.0.1]:23231) using "publickey".
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: filesystem
debug1: Sending environment.
debug1: channel 0: setting env LANG = "en_US.UTF-8"
debug1: Sending command: user list
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
Error: unauthorized
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 3256, received 1824 bytes, in 0.0 seconds
Bytes per second: sent 3054967.8, received 1711382.5
debug1: Exit status 1

############ fix:

tester@tester-soft:~$ eval $(ssh-agent -s)
Agent pid 2203
tester@tester-soft:~$ ssh-add ~/.ssh/
authorized_keys  id_ed25519       id_ed25519.pub   id_rsa           id_rsa.pub       known_hosts
tester@tester-soft:~$ ssh-add ~/.ssh/id_ed25519
Identity added: /home/tester/.ssh/id_ed25519 (soft-serve)
tester@tester-soft:~$ ssh -p 23231 localhost user list
admin
beatrice

full video:
https://1drv.ms/v/s!AjSNDQBeIftPgc9g0s_2SpNR2sKZTA?e=pfKIX6

[ltsuda]

Now I will try to setup the VM to expose ssh so I can clone repos from outside of the VM, on the host desktop but this is not an issue for now.

Thank you guys <3

[ltsuda]

From the following link:
Note you can skip this section if you are using our deb/rpm packages or installed Soft Serve from our Apt/Yum repositories.
https://github.com/charmbracelet/soft-serve/blob/main/systemd.md

So, how do I use after installing via apt skipping the systemd documentation? If the systemd service is started and there are no admin user to run the commands? even exporting SOFT_SERVE_INITIAL_ADMIN_KEYS='ssh-ed25519 ....' before installing apt package, restarting systemd service, admin is not present and commands like user list/create returns unauthorized.

[jeremiah]

I'm getting the same error (Error: unauthorized) even though I can login via ssh soft;

$ ssh soft
. . . 
Authenticated to localhost ([::1]:23231) using "keyboard-interactive".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Entering interactive session.
debug1: pledge: filesystem
debug1: Sending environment.
debug1: channel 0: setting env LANG = "en_US.UTF-8"
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
Connection to localhost closed.
Transferred: sent 5044, received 18336 bytes, in 3.0 seconds
Bytes per second: sent 1702.9, received 6190.5
debug1: Exit status 0

while I cannot issue any commend;

$ ssh -v soft user list
. . . 
Authenticated to localhost ([::1]:23231) using "keyboard-interactive".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Entering interactive session.
debug1: pledge: filesystem
debug1: Sending environment.
debug1: channel 0: setting env LANG = "en_US.UTF-8"
debug1: Sending command: user list
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
Error: unauthorized
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2100, received 1464 bytes, in 0.0 seconds
Bytes per second: sent 3883078.9, received 2707060.7
debug1: Exit status 1

Why can I login but not issue commands as admin using the same ssh key? Using Debian Trixie.