3

I'm trying to write a PowerShell script on Gitlab CI using Windows that will imitate my Linux build. As a first step, I need to add a private key so that I can download all of required submodules:

mkdir C:\Users\$env:UserName\.ssh
$key_path = "C:\Users\$env:UserName\.ssh\id_rsa"
echo "$DEPLOY_PRIVATE_KEY" > $key_path
(Get-Content $key_path -Raw).Replace("`r`n","`n") | Set-Content $key_path -Force
Set-Service -Name ssh-agent -StartupType Manual
Start-Service ssh-agent
ssh-add

However, I'm getting:

Could not add identity "C:\Users\gitlab_runner/.ssh/id_rsa": agent refused operation

and because I don't really know Windows, I am not sure how to approch this. Unfortunately, Windows mirror of ssh-add does not have verbose mode -v. How can I get more info about agent refusal? What could be the reason for the refusal?

Cheers!

EDIT

Following @VonC suggestion, I made sure permissions of the folder/key are not too open and that my agent is indeed running:

$ Cmd /c Icacls  %UserProfile%\.ssh /c /t /Inheritance:d
 processed file: C:\Users\gitlab_runner\.ssh
 processed file: C:\Users\gitlab_runner\.ssh\id_rsa
 Successfully processed 2 files; Failed processing 0 files
$ Cmd /c Icacls  %UserProfile%\.ssh /c /t /Grant %UserName%:F
 processed file: C:\Users\gitlab_runner\.ssh
 processed file: C:\Users\gitlab_runner\.ssh\id_rsa
 Successfully processed 2 files; Failed processing 0 files
$ Cmd /c Icacls  %UserProfile%\.ssh /c /t /Remove Administrator "Authenticated Users" BUILTIN\Administrators BUILTIN Everyone System Users
 processed file: C:\Users\gitlab_runner\.ssh
 processed file: C:\Users\gitlab_runner\.ssh\id_rsa
 Successfully processed 2 files; Failed processing 0 files

$ Get-Service ssh-agent
 Status   Name               DisplayName                           
 ------   ----               -----------                           
 Running  ssh-agent          OpenSSH Authentication Agen

From a code perspective, I looked into ssh-add.c of openssh repo and , if I'm not wrong, found that error SSH_ERR_AGENT_FAILURE is thrown on fetching identity list.

Proko
  • 1,871
  • 1
  • 11
  • 23

1 Answers1

0

Just in case, make sure to the permissions of the %USERPROFILE%\.ssh you just created are not too opened: see this answer to fix it.

Check the state of the SSH-Agent service to confirm it was indeed started, as in this issue.

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • Thanks, I'm getting some errors on the permission change. Once I will figure it out , I will get back to you :) Have a nice day :)) – Proko Jun 08 '20 at 09:39
  • So I followed both suggestions and unfortunately I didn't manage to add the key. For the record, I got information from `Icacls` that for every command, processing of the key (and folder) was successful and `Get-Service ssh-agent` returned running. Would it be ok to update my post with steps I performed? – Proko Jun 08 '20 at 14:19
  • @Proko Sure: edit your question to add more details. – VonC Jun 08 '20 at 14:30