Invalid signature response

[luk-]

var fs = require('fs')
var smartdc = require('smartdc')

var home = process.env.HOME
var key = fs.readFileSync(home + '/.ssh/id_rsa', 'ascii')

var client = smartdc.createClient({
  url: 'https://api.joyentcloud.com',
  key: key,
  keyId: '/[joyent username]/keys/luke2'
})

client.listMachines(function (err, res) {
  if (err) return console.log(err)

  console.log(res)
})

The response contains

{ message: 'Invalid signature',
  body: { code: 'InvalidCredentials', message: 'Invalid signature' },
  httpCode: 401,
  statusCode: 401,
  restCode: 'InvalidCredentials',
  code: 'InvalidCredentials' }

node v0.8.22

If I change the keyId to a key not on the account, the API will correctly respond with invalid key name [key].

I can use the same account info on the sdc command line scripts and it functions normally.

[mcavage]

Hi Luke,

Can you email me offline with your account info? I can look into it -- that instantiation looks correct (it's mark dot cavage at joyent).

m

[AlainODea]

@mcavage this is happening for me as well. I have a workaround, at least for using a SmartMachine as a API client.

[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]# cat .profile | grep SDC
export SDC_CLI_URL=https://us-sw-1.api.joyentcloud.com
export SDC_CLI_ACCOUNT=alain.odea@gmail.com
export SDC_CLI_KEY_ID=id_rsa
export SDC_CLI_IDENTITY=/root/.ssh/id_rsa
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]# ssh-add /root/.ssh/id_rsa
Enter passphrase for /root/.ssh/id_rsa:
Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]# sdc-listmachines
Invalid signature
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]#

I have a 2048bit RSA SSH2 key encrypted with a 100 character password.

I am trying this from a base 1.9.1 SmartMachine in JPC itself to remove as many variables as possible.

The workaround has to do with ensuring that the encrypted SSH Identity is added to the SSH Agent before any requests are made with the smartdc CLI.

I have the following at the tail of .bashrc:

if [ ! "$SSH_AUTH_SOCK" ]; then
  eval $(ssh-agent)
  ssh-add "$SDC_CLI_IDENTITY"
fi

This forces me to authenticate my SSH key at the start of my session and appears to reliably get around the "Invalid Signature" issue.

I can reliably reproduce the issue by removing the ssh-add and trying to use sdc-listmachines:

Using username "root".
Authenticating with public key "alain.odea@gmail.com" from agent
Last login: Tue Apr  9 14:37:34 2013 from 209.128.21.10
   __        .                   .
 _|  |_      | .-. .  . .-. :--. |-
|_    _|     ;|   ||  |(.-' |  | |
  |__|   `--'  `-' `;-| `-' '  ' `-'
                   /  ; SmartMachine (base 1.9.1)
                   `-'  http://wiki.joyent.com/jpc2/SmartMachine+Base

Agent pid 38283
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]# sdc-listmachine
-bash: sdc-listmachine: command not found
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]# sdc-listmachines
Enter PEM pass phrase:
Invalid signature
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]# ssh-add $SDC_CLI_IDENTITY
Enter passphrase for /root/.ssh/id_rsa:
Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]# sdc-listmachines
[]
[root@486acb2e-c334-40f4-a7d1-873b1bc8d8d7 ~]#

It appears that the key decryption within smartdc doesn't work for my SSH key.

I hope this is useful in finding the root cause.

[mcavage]

Hi Alain,

Well, that's a new one. I'll put it on my list to repro that and see what it's doing.

[AlainODea]

Thank you Mark :)

[greenlib]

I don't know that this was ever completely resolved. I came to this ticket, because I'm receiving the same error. Did Alain handle it himself, and so it was never addressed?

After seeing that Alain received that message, when using a 100-character password, I could only guess that long passwords return that error message. I'm using a 64-character password. I don't know about luk-, above.

Anyway, any clues? I can't edit the backend, like Alain did. I mean, if someone explained how to get to .bashrc and add all that stuff, I could look - but as it stands, I wouldn't have any idea.

[AlainODea]

@greenlib my workaround is client-side. I didn't need to edit the backend.

I added the SSH key to ssh-agent which should work on any *NIX or inside msys or Cygwin on Windows.

I suspect a similar will work with platform SSH agents like Keychain on OS X or gnome-keyring on Ubuntu. Not sure if it will work with Pageant on Windows.

[greenlib]

@AlainODea - Oh crap, I just realized I'm not even in the right forum. I was like, what's he talking about? ... I got an error message similar to this, by using JoliCloud ...

[AlainODea]

@greenlib JoliCloud is likely using http-signature as well then :) No worries. Best of luck finding the answer.