Using bitbucket ssh key in fabric fails

[edmcdonagh]

I have setup SSH keys using the pipelines config (use-ssh-keys-in-bitbucket-pipelines), and they work.

To test, in my bitbucket-pipelines.yaml I have the following:

   - ssh deploy@dev.openrem.org date

Which results in the following output:

+ ssh deploy@dev.openrem.org date
Warning: Permanently added the RSA host key for IP address '139.162.218.154' to the list of known hosts.
Thu Jun 22 08:47:52 UTC 2017

However, when I use fabric, the key doesn't seem to be used and it tries to ask for a password instead:

fab deploy:host=deploy@dev.openrem.org<1s
+ fab deploy:host=deploy@dev.openrem.org
 /usr/local/lib/python2.7/getpass.py:83: GetPassWarning: Can not control echo on the terminal.
  passwd = fallback_getpass(prompt, stream)
Warning: Password input may be echoed.
[deploy@dev.openrem.org] Executing task 'deploy'
[deploy@dev.openrem.org] run: mkdir -p /home/deploy/sites/dev.openrem.org/database
[deploy@dev.openrem.org] Login password for 'deploy': Traceback (most recent call last):
  File "/usr/local/lib/python2.7/site-packages/fabric/main.py", line 757, in main
    *args, **kwargs
...

I have seen several questions on here that refer to getting fabric to work or similar, but all the solutions involve generating keys manually and setting environment variables (for example SSH-connection-failed-with-pipeline or How-do-I-set-up-ssh-public-key-authentication-so-that-I-can-use and from a blog building-testing-and-deploying-django-app-with-bitbucket-pipelines).

Is it possible to do this with the Bitbucket keys?

[StannousBaratheon]

The Pipelines SSH key is now configured for the default user in the build container and works for non root users. I haven't tested this with fabric specifically but there's a chance this change will also solve this issue. Let us know if you have any success with it!

[w00kie]

I'm having the same issue today so it does not seem to have fixed it for Fabric.

The docs say that Fabric will use by default:

• Any “id_rsa”, “id_dsa” or “id_ecdsa” key discoverable in ~/.ssh/
• Any key we can find through an SSH agent

Adding the key to the ~/.ssh/config file is not enough. Would it be possible to have it added to the agent automatically by default with ssh-add ?

[w00kie]

I did fix it manually by following recommendations found in a pull request somewhere:

- eval `ssh-agent`
- ssh-add /opt/atlassian/pipelines/agent/data/id_rsa

[Evgeny Evseev]

Same problem. Working solution:

```

fab -i /opt/atlassian/pipelines/agent/data/id_rsa deploy

```

[StannousBaratheon]

Hi Ed,

Pipelines configures SSH with an additional default IdentityFile which is used whenever SSH is invoked. You can `cat ~/.ssh/config` to see how it's configured.

Note that the referenced file located at `/opt/atlassian/pipelines/agent/data/id_rsa` is owned by the root user so if your process is run as a different user it will not have permission to use the key. There is an open issue to address this limitation.

I suspect either fabric is not running as the root user or it's SSH process is not using the config defined in ~/.ssh/config

If you require further assistance please raise a support ticket via https://support.atlassian.com/bitbucket/ so that we may investigate your specific issue.

Regards

Sam

[Bart Heesink]

Hi Samuel,

Can you post a link to this open issue? I would like to get some more information about it but can't find the issue.

Thnx.

[StannousBaratheon]

Hi Bart,

Sure, this is the public ticket for the issue: https://bitbucket.org/site/master/issues/14457/pipelines-ssh-keys-only-work-for-root

Regards

Sam