When I do a simple git-pull over SSH, why does it typically prompt me for my SSH password two or three times? And no, I am not inputting it wrong.
$ git-pull Password: Password: Password: remote: Generating pack...
Daniel BarkalowRe: why multiple password prompts?
On Sat, 29 Mar 2008, Paul wrote:
> When I do a simple git-pull over SSH, why does it typically prompt me for my > SSH password two or three times? And no, I am not inputting it wrong.
In some versions of git, it makes separate connections to find out what the remote's state is and to fetch the actual data. A third connection should only be needed if there are new tags to fetch, and that would be after some of the messages.
One of the changes in the upcoming release is to reduce this to one, except for an occasional second one.
-Daniel *This .sig left intentionally blank*
Jakub NarebskiRe: why multiple password prompts?
Daniel Barkalow <barkalow@iabervon.org> writes:
> On Sat, 29 Mar 2008, Paul wrote:
Paul who?
Show 11 quoted lines
>> When I do a simple git-pull over SSH, why does it typically prompt >> me for my SSH password two or three times? And no, I am not >> inputting it wrong. > > In some versions of git, it makes separate connections to find out > what the remote's state is and to fetch the actual data. A third > connection should only be needed if there are new tags to fetch, and > that would be after some of the messages. > > One of the changes in the upcoming release is to reduce this to one, > except for an occasional second one.
The way to avoid multiple prompt for SSH password is to set up SSH key infrastructure, so you can login using SSH keys which does not require you to enter password, with the possible exception of adding key to keyring if it is protected by password.
See ssh-add(1) and ssh-keygen(1) (and keychain(1) if you want to add keyonce for all sessions).
-- Jakub Narebski Poland ShadeHawk on #git
Daniel BarkalowRe: why multiple password prompts?
On Sat, 29 Mar 2008, Jakub Narebski wrote:
Show 5 quoted lines
> Daniel Barkalow <barkalow@iabervon.org> writes: > > > On Sat, 29 Mar 2008, Paul wrote: > > Paul who?
How should I know?
Show 16 quoted lines
> >> When I do a simple git-pull over SSH, why does it typically prompt > >> me for my SSH password two or three times? And no, I am not > >> inputting it wrong. > > > > In some versions of git, it makes separate connections to find out > > what the remote's state is and to fetch the actual data. A third > > connection should only be needed if there are new tags to fetch, and > > that would be after some of the messages. > > > > One of the changes in the upcoming release is to reduce this to one, > > except for an occasional second one. > > The way to avoid multiple prompt for SSH password is to set up SSH key > infrastructure, so you can login using SSH keys which does not require > you to enter password, with the possible exception of adding key to > keyring if it is protected by password.
Sure, but it's inconvenient to wrap git-fetch and git-pull in ssh-agent/ssh-add/kill if you want to get exactly one password prompt per logical remote-using operation. Personally, I like that when I do operations involving authorized access to a remote machine, I need to enter my password. But once per command is all I want.
-Daniel *This .sig left intentionally blank*
Martin LanghoffRe: why multiple password prompts?
On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow <barkalow@iabervon.org> wrote:
> One of the changes in the upcoming release is to reduce this to one, > except for an occasional second one.
That's cool - didn't know a rework of the ssh interactions had happened. It would be really good if we could detect if there's an existing "master" connection and piggyback over that (see options -M and -O). Reading man ssh_config it looks like we may be able to say something along the lines of " -o ControlMaster=auto ".
cheers,
martin
-- martin.langhoff@gmail.com martin@laptop.org -- School Server Architect - ask interesting questions - don't get distracted with shiny stuff - working code first - http://wiki.laptop.org/go/User:Martinlanghoff
Daniel BarkalowRe: why multiple password prompts?
On Sat, 29 Mar 2008, Martin Langhoff wrote:
Show 6 quoted lines
> On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow <barkalow@iabervon.org> wrote: > > One of the changes in the upcoming release is to reduce this to one, > > except for an occasional second one. > > That's cool - didn't know a rework of the ssh interactions had > happened.
It's not actually anything to do with ssh; it's that the git native protocol code tries to do as much as possible in each of its connections.
> It would be really good if we could detect if there's an > existing "master" connection and piggyback over that (see options -M > and -O). Reading man ssh_config it looks like we may be able to say > something along the lines of " -o ControlMaster=auto ".
People who want that will presumably set it in their ssh configuration.
-Daniel *This .sig left intentionally blank*
Jeff KingRe: why multiple password prompts?
On Sat, Mar 29, 2008 at 02:37:00PM -0400, Martin Langhoff wrote:
Show 5 quoted lines
> That's cool - didn't know a rework of the ssh interactions had > happened. It would be really good if we could detect if there's an > existing "master" connection and piggyback over that (see options -M > and -O). Reading man ssh_config it looks like we may be able to say > something along the lines of " -o ControlMaster=auto ".
I have been using this for at least a year with git; just put "ControlMaster auto" into your .ssh/config.
-Peff
Jeff KingRe: why multiple password prompts?
On Sat, Mar 29, 2008 at 06:05:43PM -0400, Jeff King wrote:
Show 8 quoted lines
> > That's cool - didn't know a rework of the ssh interactions had > > happened. It would be really good if we could detect if there's an > > existing "master" connection and piggyback over that (see options -M > > and -O). Reading man ssh_config it looks like we may be able to say > > something along the lines of " -o ControlMaster=auto ". > > I have been using this for at least a year with git; just put > "ControlMaster auto" into your .ssh/config.
Oh, and if you are trying to achieve "doing two back-to-back ssh's should only need one connection because of ControlMaster", that doesn't work.
The master is closely tied to the first session, so it exits when that session finishes.
I think more useful semantics for something like git would be an opportunistic short-lived server. That is, 'ssh foo' would try:
- if .ssh/cache/foo does not exist, spawn "master"
- repeatedly try to connect via .ssh/cache/foo (since it
may take a while for the connection to be made, but
eventually time out if we can't do it)The "master" would: - listen on .ssh/cache/foo - connect to 'foo' via ssh - multiplex any incoming connections on .ssh/cache/foo on our session - after N seconds of no active connections, close the ssh session
But that is an ssh problem, not a git problem at all.
-Peff
Re: why multiple password prompts?
On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow <barkalow@iabervon.org> wrote:
Show 12 quoted lines
> On Sat, 29 Mar 2008, Paul wrote: > > > When I do a simple git-pull over SSH, why does it typically prompt me for my > > SSH password two or three times? And no, I am not inputting it wrong. > > In some versions of git, it makes separate connections to find out what > the remote's state is and to fetch the actual data. A third connection > should only be needed if there are new tags to fetch, and that would be > after some of the messages. > > One of the changes in the upcoming release is to reduce this to one, > except for an occasional second one.
git.git's master branch seems to be hitting ssh twice fairly reliably... [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull bd@130.111.246.25's password: bd@130.111.246.25's password: remote: Counting objects: 5, done. remote: Compressing objects: 100% (2/2)remote: , done. remote: Total 3 (delta 0), reused 0 (delta 0) Unpacking objects: 100% (3/3), done. From ssh+git://bd@130.111.246.25/home/bd/git-test b0b8450..57a92a7 master -> origin/master Updating b0b8450..57a92a7 Fast forward fob | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) [bd@shion git-test] ~/src/git/git --version git version 1.5.5.rc2
The remote's still on 1.5.4.4 if it matters...
Daniel BarkalowRe: why multiple password prompts?
On Sun, 30 Mar 2008, Bryan Donlan wrote:
Show 18 quoted lines
> git.git's master branch seems to be hitting ssh twice fairly reliably... > [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull > bd@130.111.246.25's password: > bd@130.111.246.25's password: > remote: Counting objects: 5, done. > remote: Compressing objects: 100% (2/2)remote: , done. > remote: Total 3 (delta 0), reused 0 (delta 0) > Unpacking objects: 100% (3/3), done. > From ssh+git://bd@130.111.246.25/home/bd/git-test > b0b8450..57a92a7 master -> origin/master > Updating b0b8450..57a92a7 > Fast forward > fob | 1 + > 1 files changed, 1 insertions(+), 0 deletions(-) > [bd@shion git-test] ~/src/git/git --version > git version 1.5.5.rc2 > > The remote's still on 1.5.4.4 if it matters...
No, but ~/src/git/git-pull will run the installed git-fetch, not the locally built one, IIRC.
-Daniel *This .sig left intentionally blank*
Re: why multiple password prompts?
On Sun, Mar 30, 2008 at 5:56 PM, Daniel Barkalow <barkalow@iabervon.org> wrote:
Show 23 quoted lines
> On Sun, 30 Mar 2008, Bryan Donlan wrote: > > > git.git's master branch seems to be hitting ssh twice fairly reliably... > > [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull > > bd@130.111.246.25's password: > > bd@130.111.246.25's password: > > remote: Counting objects: 5, done. > > remote: Compressing objects: 100% (2/2)remote: , done. > > remote: Total 3 (delta 0), reused 0 (delta 0) > > Unpacking objects: 100% (3/3), done. > > From ssh+git://bd@130.111.246.25/home/bd/git-test > > b0b8450..57a92a7 master -> origin/master > > Updating b0b8450..57a92a7 > > Fast forward > > fob | 1 + > > 1 files changed, 1 insertions(+), 0 deletions(-) > > [bd@shion git-test] ~/src/git/git --version > > git version 1.5.5.rc2 > > > > The remote's still on 1.5.4.4 if it matters... > > No, but ~/src/git/git-pull will run the installed git-fetch, not the > locally built one, IIRC.
Ah, that would be it, thanks.