{"thread":{"id":"12912","subject":"why multiple password prompts?","startedAt":"2008-03-29T15:44:05Z","lastAt":"2008-03-30T22:05:05Z","messageCount":11,"participants":["Paul","Daniel Barkalow","Jakub Narebski","Martin Langhoff","Jeff King","Bryan Donlan"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"73323","messageId":"alpine.WNT.1.10.0803291141550.11992@znlsyl","threadId":"12912","inReplyTo":null,"subject":"why multiple password prompts?","fromName":"Paul","fromEmail":"lists@pote.com","sentAt":"2008-03-29T15:44:05Z","receivedAt":"2008-03-29T15:44:05Z","isPatch":false,"sender":{"key":"lists@pote.com","avatar":null},"body":"When I do a simple git-pull over SSH, why does it typically prompt me \nfor my SSH password two or three times? And no, I am not inputting it \nwrong.\n\n$ git-pull\nPassword:\nPassword:\nPassword:\nremote: Generating pack...\n"},{"id":"73324","messageId":"alpine.LNX.1.00.0803291241020.19665@iabervon.org","threadId":"12912","inReplyTo":"alpine.WNT.1.10.0803291141550.11992@znlsyl","subject":"Re: why multiple password prompts?","fromName":"Daniel Barkalow","fromEmail":"barkalow@iabervon.org","sentAt":"2008-03-29T16:48:02Z","receivedAt":"2008-03-29T16:48:02Z","isPatch":false,"sender":{"key":"barkalow@iabervon.org","avatar":"https://avatars.githubusercontent.com/u/55364219?v=4"},"body":"On Sat, 29 Mar 2008, Paul wrote:\n\n> When I do a simple git-pull over SSH, why does it typically prompt me for my\n> SSH password two or three times? And no, I am not inputting it wrong.\n\nIn some versions of git, it makes separate connections to find out what \nthe remote's state is and to fetch the actual data. A third connection \nshould only be needed if there are new tags to fetch, and that would be \nafter some of the messages.\n\nOne of the changes in the upcoming release is to reduce this to one, \nexcept for an occasional second one.\n\n\t-Daniel\n*This .sig left intentionally blank*\n"},{"id":"73325","messageId":"m37iflv54l.fsf@localhost.localdomain","threadId":"12912","inReplyTo":"alpine.LNX.1.00.0803291241020.19665@iabervon.org","subject":"Re: why multiple password prompts?","fromName":"Jakub Narebski","fromEmail":"jnareb@gmail.com","sentAt":"2008-03-29T16:59:04Z","receivedAt":"2008-03-29T16:59:04Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Daniel Barkalow writes:\n\n> On Sat, 29 Mar 2008, Paul wrote:\n\nPaul who?\n\n>> When I do a simple git-pull over SSH, why does it typically prompt\n>> me for my SSH password two or three times? And no, I am not\n>> inputting it wrong.\n> \n> In some versions of git, it makes separate connections to find out\n> what the remote's state is and to fetch the actual data. A third\n> connection should only be needed if there are new tags to fetch, and\n> that would be after some of the messages.\n> \n> One of the changes in the upcoming release is to reduce this to one,\n> except for an occasional second one.\n\nThe way to avoid multiple prompt for SSH password is to set up SSH key\ninfrastructure, so you can login using SSH keys which does not require\nyou to enter password, with the possible exception of adding key to\nkeyring if it is protected by password.\n\nSee ssh-add(1) and ssh-keygen(1) (and keychain(1) if you want to add\nkeyonce for all sessions).\n\n-- \nJakub Narebski\nPoland\nShadeHawk on #git\n"},{"id":"73328","messageId":"46a038f90803291137l20244abcke54941dc92c2c8b4@mail.gmail.com","threadId":"12912","inReplyTo":"alpine.LNX.1.00.0803291241020.19665@iabervon.org","subject":"Re: why multiple password prompts?","fromName":"Martin Langhoff","fromEmail":"martin.langhoff@gmail.com","sentAt":"2008-03-29T18:37:00Z","receivedAt":"2008-03-29T18:37:00Z","isPatch":false,"sender":{"key":"martin.langhoff@gmail.com","avatar":"https://gravatar.com/avatar/1e3f311b6c4c15836501901ca58f8c0b0667246488084ba524d8bc9867e22fd9?d=mp&s=160"},"body":"On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow wrote:\n> One of the changes in the upcoming release is to reduce this to one,\n> except for an occasional second one.\n\nThat's cool - didn't know a rework of the ssh interactions had\nhappened. It would be really good if we could detect if there's an\nexisting \"master\" connection and piggyback over that (see options -M\nand -O). Reading man ssh_config it looks like we may be able to say\nsomething along the lines of \" -o ControlMaster=auto \".\n\ncheers,\n\n\n\nmartin\n-- \n martin.langhoff@gmail.com\n martin@laptop.org -- School Server Architect\n - ask interesting questions\n - don't get distracted with shiny stuff - working code first\n - http://wiki.laptop.org/go/User:Martinlanghoff\n"},{"id":"73330","messageId":"alpine.LNX.1.00.0803291439450.19665@iabervon.org","threadId":"12912","inReplyTo":"46a038f90803291137l20244abcke54941dc92c2c8b4@mail.gmail.com","subject":"Re: why multiple password prompts?","fromName":"Daniel Barkalow","fromEmail":"barkalow@iabervon.org","sentAt":"2008-03-29T18:49:37Z","receivedAt":"2008-03-29T18:49:37Z","isPatch":false,"sender":{"key":"barkalow@iabervon.org","avatar":"https://avatars.githubusercontent.com/u/55364219?v=4"},"body":"On Sat, 29 Mar 2008, Martin Langhoff wrote:\n\n> On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow wrote:\n> > One of the changes in the upcoming release is to reduce this to one,\n> > except for an occasional second one.\n> \n> That's cool - didn't know a rework of the ssh interactions had\n> happened.\n\nIt's not actually anything to do with ssh; it's that the git native \nprotocol code tries to do as much as possible in each of its connections.\n\n> It would be really good if we could detect if there's an\n> existing \"master\" connection and piggyback over that (see options -M\n> and -O). Reading man ssh_config it looks like we may be able to say\n> something along the lines of \" -o ControlMaster=auto \".\n\nPeople who want that will presumably set it in their ssh configuration.\n\n\t-Daniel\n*This .sig left intentionally blank*\n"},{"id":"73331","messageId":"alpine.LNX.1.00.0803291418120.19665@iabervon.org","threadId":"12912","inReplyTo":"m37iflv54l.fsf@localhost.localdomain","subject":"Re: why multiple password prompts?","fromName":"Daniel Barkalow","fromEmail":"barkalow@iabervon.org","sentAt":"2008-03-29T19:05:34Z","receivedAt":"2008-03-29T19:05:34Z","isPatch":false,"sender":{"key":"barkalow@iabervon.org","avatar":"https://avatars.githubusercontent.com/u/55364219?v=4"},"body":"On Sat, 29 Mar 2008, Jakub Narebski wrote:\n\n> Daniel Barkalow writes:\n> \n> > On Sat, 29 Mar 2008, Paul wrote:\n> \n> Paul who?\n\nHow should I know?\n\n> >> When I do a simple git-pull over SSH, why does it typically prompt\n> >> me for my SSH password two or three times? And no, I am not\n> >> inputting it wrong.\n> > \n> > In some versions of git, it makes separate connections to find out\n> > what the remote's state is and to fetch the actual data. A third\n> > connection should only be needed if there are new tags to fetch, and\n> > that would be after some of the messages.\n> > \n> > One of the changes in the upcoming release is to reduce this to one,\n> > except for an occasional second one.\n> \n> The way to avoid multiple prompt for SSH password is to set up SSH key\n> infrastructure, so you can login using SSH keys which does not require\n> you to enter password, with the possible exception of adding key to\n> keyring if it is protected by password.\n\nSure, but it's inconvenient to wrap git-fetch and git-pull in \nssh-agent/ssh-add/kill if you want to get exactly one password prompt per \nlogical remote-using operation. Personally, I like that when I \ndo operations involving authorized access to a remote machine, I need to \nenter my password. But once per command is all I want.\n\n\t-Daniel\n*This .sig left intentionally blank*\n"},{"id":"73339","messageId":"20080329220543.GD30851@coredump.intra.peff.net","threadId":"12912","inReplyTo":"46a038f90803291137l20244abcke54941dc92c2c8b4@mail.gmail.com","subject":"Re: why multiple password prompts?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2008-03-29T22:05:43Z","receivedAt":"2008-03-29T22:05:43Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Sat, Mar 29, 2008 at 02:37:00PM -0400, Martin Langhoff wrote:\n\n> That's cool - didn't know a rework of the ssh interactions had\n> happened. It would be really good if we could detect if there's an\n> existing \"master\" connection and piggyback over that (see options -M\n> and -O). Reading man ssh_config it looks like we may be able to say\n> something along the lines of \" -o ControlMaster=auto \".\n\nI have been using this for at least a year with git; just put\n\"ControlMaster auto\" into your .ssh/config.\n\n-Peff\n"},{"id":"73340","messageId":"20080329221156.GE30851@coredump.intra.peff.net","threadId":"12912","inReplyTo":"20080329220543.GD30851@coredump.intra.peff.net","subject":"Re: why multiple password prompts?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2008-03-29T22:11:57Z","receivedAt":"2008-03-29T22:11:57Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Sat, Mar 29, 2008 at 06:05:43PM -0400, Jeff King wrote:\n\n> > That's cool - didn't know a rework of the ssh interactions had\n> > happened. It would be really good if we could detect if there's an\n> > existing \"master\" connection and piggyback over that (see options -M\n> > and -O). Reading man ssh_config it looks like we may be able to say\n> > something along the lines of \" -o ControlMaster=auto \".\n> \n> I have been using this for at least a year with git; just put\n> \"ControlMaster auto\" into your .ssh/config.\n\nOh, and if you are trying to achieve \"doing two back-to-back ssh's\nshould only need one connection because of ControlMaster\", that doesn't\nwork.\n\nThe master is closely tied to the first session, so it exits when that\nsession finishes.\n\nI think more useful semantics for something like git would be\nan opportunistic short-lived server. That is, 'ssh foo' would try:\n\n - if .ssh/cache/foo does not exist, spawn \"master\"\n - repeatedly try to connect via .ssh/cache/foo (since it\n may take a while for the connection to be made, but\n eventually time out if we can't do it)\n\nThe \"master\" would:\n - listen on .ssh/cache/foo\n - connect to 'foo' via ssh\n - multiplex any incoming connections on .ssh/cache/foo on our session\n - after N seconds of no active connections, close the ssh session\n\nBut that is an ssh problem, not a git problem at all.\n\n-Peff\n"},{"id":"73364","messageId":"3e8340490803301334g2127451cu6e9dc71eefa6241c@mail.gmail.com","threadId":"12912","inReplyTo":"alpine.LNX.1.00.0803291241020.19665@iabervon.org","subject":"Re: why multiple password prompts?","fromName":"Bryan Donlan","fromEmail":"bdonlan@gmail.com","sentAt":"2008-03-30T20:34:57Z","receivedAt":"2008-03-30T20:34:57Z","isPatch":false,"sender":{"key":"bdonlan@gmail.com","avatar":null},"body":"On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow wrote:\n> On Sat, 29 Mar 2008, Paul wrote:\n>\n> > When I do a simple git-pull over SSH, why does it typically prompt me for my\n> > SSH password two or three times? And no, I am not inputting it wrong.\n>\n> In some versions of git, it makes separate connections to find out what\n> the remote's state is and to fetch the actual data. A third connection\n> should only be needed if there are new tags to fetch, and that would be\n> after some of the messages.\n>\n> One of the changes in the upcoming release is to reduce this to one,\n> except for an occasional second one.\n\ngit.git's master branch seems to be hitting ssh twice fairly reliably...\n[bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull\nbd@130.111.246.25's password:\nbd@130.111.246.25's password:\nremote: Counting objects: 5, done.\nremote: Compressing objects: 100% (2/2)remote: , done.\nremote: Total 3 (delta 0), reused 0 (delta 0)\nUnpacking objects: 100% (3/3), done.\nFrom ssh+git://bd@130.111.246.25/home/bd/git-test\n b0b8450..57a92a7 master -> origin/master\nUpdating b0b8450..57a92a7\nFast forward\n fob | 1 +\n 1 files changed, 1 insertions(+), 0 deletions(-)\n[bd@shion git-test] ~/src/git/git --version\ngit version 1.5.5.rc2\n\nThe remote's still on 1.5.4.4 if it matters...\n"},{"id":"73368","messageId":"alpine.LNX.1.00.0803301755200.19665@iabervon.org","threadId":"12912","inReplyTo":"3e8340490803301334g2127451cu6e9dc71eefa6241c@mail.gmail.com","subject":"Re: why multiple password prompts?","fromName":"Daniel Barkalow","fromEmail":"barkalow@iabervon.org","sentAt":"2008-03-30T21:56:58Z","receivedAt":"2008-03-30T21:56:58Z","isPatch":false,"sender":{"key":"barkalow@iabervon.org","avatar":"https://avatars.githubusercontent.com/u/55364219?v=4"},"body":"On Sun, 30 Mar 2008, Bryan Donlan wrote:\n\n> git.git's master branch seems to be hitting ssh twice fairly reliably...\n> [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull\n> bd@130.111.246.25's password:\n> bd@130.111.246.25's password:\n> remote: Counting objects: 5, done.\n> remote: Compressing objects: 100% (2/2)remote: , done.\n> remote: Total 3 (delta 0), reused 0 (delta 0)\n> Unpacking objects: 100% (3/3), done.\n> From ssh+git://bd@130.111.246.25/home/bd/git-test\n> b0b8450..57a92a7 master -> origin/master\n> Updating b0b8450..57a92a7\n> Fast forward\n> fob | 1 +\n> 1 files changed, 1 insertions(+), 0 deletions(-)\n> [bd@shion git-test] ~/src/git/git --version\n> git version 1.5.5.rc2\n> \n> The remote's still on 1.5.4.4 if it matters...\n\nNo, but ~/src/git/git-pull will run the installed git-fetch, not the \nlocally built one, IIRC.\n\n\t-Daniel\n*This .sig left intentionally blank*\n"},{"id":"73371","messageId":"3e8340490803301505y7df70787wad4449b1821e0d05@mail.gmail.com","threadId":"12912","inReplyTo":"alpine.LNX.1.00.0803301755200.19665@iabervon.org","subject":"Re: why multiple password prompts?","fromName":"Bryan Donlan","fromEmail":"bdonlan@gmail.com","sentAt":"2008-03-30T22:05:05Z","receivedAt":"2008-03-30T22:05:05Z","isPatch":false,"sender":{"key":"bdonlan@gmail.com","avatar":null},"body":"On Sun, Mar 30, 2008 at 5:56 PM, Daniel Barkalow wrote:\n> On Sun, 30 Mar 2008, Bryan Donlan wrote:\n>\n> > git.git's master branch seems to be hitting ssh twice fairly reliably...\n> > [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull\n> > bd@130.111.246.25's password:\n> > bd@130.111.246.25's password:\n> > remote: Counting objects: 5, done.\n> > remote: Compressing objects: 100% (2/2)remote: , done.\n> > remote: Total 3 (delta 0), reused 0 (delta 0)\n> > Unpacking objects: 100% (3/3), done.\n> > From ssh+git://bd@130.111.246.25/home/bd/git-test\n> > b0b8450..57a92a7 master -> origin/master\n> > Updating b0b8450..57a92a7\n> > Fast forward\n> > fob | 1 +\n> > 1 files changed, 1 insertions(+), 0 deletions(-)\n> > [bd@shion git-test] ~/src/git/git --version\n> > git version 1.5.5.rc2\n> >\n> > The remote's still on 1.5.4.4 if it matters...\n>\n> No, but ~/src/git/git-pull will run the installed git-fetch, not the\n> locally built one, IIRC.\n\nAh, that would be it, thanks.\n"}]}