# why multiple password prompts? 11 messages from 2008-03-29 to 2008-03-30. Participants: Paul, Daniel Barkalow, Jakub Narebski, Martin Langhoff, Jeff King, Bryan Donlan. Thread: https://gitlist.dev/t/12912 ## Paul, 2008-03-29 15:44 Subject: why multiple password prompts? Message-ID: URL: https://gitlist.dev/e/alpine.WNT.1.10.0803291141550.11992%40znlsyl ``` When I do a simple git-pull over SSH, why does it typically prompt me for my SSH password two or three times? And no, I am not inputting it wrong. $ git-pull Password: Password: Password: remote: Generating pack... ``` ## Daniel Barkalow, 2008-03-29 16:48 Subject: Re: why multiple password prompts? Message-ID: URL: https://gitlist.dev/e/alpine.LNX.1.00.0803291241020.19665%40iabervon.org In-Reply-To: ``` On Sat, 29 Mar 2008, Paul wrote: > When I do a simple git-pull over SSH, why does it typically prompt me for my > SSH password two or three times? And no, I am not inputting it wrong. In some versions of git, it makes separate connections to find out what the remote's state is and to fetch the actual data. A third connection should only be needed if there are new tags to fetch, and that would be after some of the messages. One of the changes in the upcoming release is to reduce this to one, except for an occasional second one. -Daniel *This .sig left intentionally blank* ``` ## Jakub Narebski, 2008-03-29 16:59 Subject: Re: why multiple password prompts? Message-ID: URL: https://gitlist.dev/e/m37iflv54l.fsf%40localhost.localdomain In-Reply-To: ``` Daniel Barkalow writes: > On Sat, 29 Mar 2008, Paul wrote: Paul who? >> When I do a simple git-pull over SSH, why does it typically prompt >> me for my SSH password two or three times? And no, I am not >> inputting it wrong. > > In some versions of git, it makes separate connections to find out > what the remote's state is and to fetch the actual data. A third > connection should only be needed if there are new tags to fetch, and > that would be after some of the messages. > > One of the changes in the upcoming release is to reduce this to one, > except for an occasional second one. The way to avoid multiple prompt for SSH password is to set up SSH key infrastructure, so you can login using SSH keys which does not require you to enter password, with the possible exception of adding key to keyring if it is protected by password. See ssh-add(1) and ssh-keygen(1) (and keychain(1) if you want to add keyonce for all sessions). -- Jakub Narebski Poland ShadeHawk on #git ``` ## Martin Langhoff, 2008-03-29 18:37 Subject: Re: why multiple password prompts? Message-ID: <46a038f90803291137l20244abcke54941dc92c2c8b4@mail.gmail.com> URL: https://gitlist.dev/e/46a038f90803291137l20244abcke54941dc92c2c8b4%40mail.gmail.com In-Reply-To: ``` On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow wrote: > One of the changes in the upcoming release is to reduce this to one, > except for an occasional second one. That's cool - didn't know a rework of the ssh interactions had happened. It would be really good if we could detect if there's an existing "master" connection and piggyback over that (see options -M and -O). Reading man ssh_config it looks like we may be able to say something along the lines of " -o ControlMaster=auto ". cheers, martin -- martin.langhoff@gmail.com martin@laptop.org -- School Server Architect - ask interesting questions - don't get distracted with shiny stuff - working code first - http://wiki.laptop.org/go/User:Martinlanghoff ``` ## Daniel Barkalow, 2008-03-29 18:49 Subject: Re: why multiple password prompts? Message-ID: URL: https://gitlist.dev/e/alpine.LNX.1.00.0803291439450.19665%40iabervon.org In-Reply-To: <46a038f90803291137l20244abcke54941dc92c2c8b4@mail.gmail.com> ``` On Sat, 29 Mar 2008, Martin Langhoff wrote: > On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow wrote: > > One of the changes in the upcoming release is to reduce this to one, > > except for an occasional second one. > > That's cool - didn't know a rework of the ssh interactions had > happened. It's not actually anything to do with ssh; it's that the git native protocol code tries to do as much as possible in each of its connections. > It would be really good if we could detect if there's an > existing "master" connection and piggyback over that (see options -M > and -O). Reading man ssh_config it looks like we may be able to say > something along the lines of " -o ControlMaster=auto ". People who want that will presumably set it in their ssh configuration. -Daniel *This .sig left intentionally blank* ``` ## Daniel Barkalow, 2008-03-29 19:05 Subject: Re: why multiple password prompts? Message-ID: URL: https://gitlist.dev/e/alpine.LNX.1.00.0803291418120.19665%40iabervon.org In-Reply-To: ``` On Sat, 29 Mar 2008, Jakub Narebski wrote: > Daniel Barkalow writes: > > > On Sat, 29 Mar 2008, Paul wrote: > > Paul who? How should I know? > >> When I do a simple git-pull over SSH, why does it typically prompt > >> me for my SSH password two or three times? And no, I am not > >> inputting it wrong. > > > > In some versions of git, it makes separate connections to find out > > what the remote's state is and to fetch the actual data. A third > > connection should only be needed if there are new tags to fetch, and > > that would be after some of the messages. > > > > One of the changes in the upcoming release is to reduce this to one, > > except for an occasional second one. > > The way to avoid multiple prompt for SSH password is to set up SSH key > infrastructure, so you can login using SSH keys which does not require > you to enter password, with the possible exception of adding key to > keyring if it is protected by password. Sure, but it's inconvenient to wrap git-fetch and git-pull in ssh-agent/ssh-add/kill if you want to get exactly one password prompt per logical remote-using operation. Personally, I like that when I do operations involving authorized access to a remote machine, I need to enter my password. But once per command is all I want. -Daniel *This .sig left intentionally blank* ``` ## Jeff King, 2008-03-29 22:05 Subject: Re: why multiple password prompts? Message-ID: <20080329220543.GD30851@coredump.intra.peff.net> URL: https://gitlist.dev/e/20080329220543.GD30851%40coredump.intra.peff.net In-Reply-To: <46a038f90803291137l20244abcke54941dc92c2c8b4@mail.gmail.com> ``` On Sat, Mar 29, 2008 at 02:37:00PM -0400, Martin Langhoff wrote: > That's cool - didn't know a rework of the ssh interactions had > happened. It would be really good if we could detect if there's an > existing "master" connection and piggyback over that (see options -M > and -O). Reading man ssh_config it looks like we may be able to say > something along the lines of " -o ControlMaster=auto ". I have been using this for at least a year with git; just put "ControlMaster auto" into your .ssh/config. -Peff ``` ## Jeff King, 2008-03-29 22:11 Subject: Re: why multiple password prompts? Message-ID: <20080329221156.GE30851@coredump.intra.peff.net> URL: https://gitlist.dev/e/20080329221156.GE30851%40coredump.intra.peff.net In-Reply-To: <20080329220543.GD30851@coredump.intra.peff.net> ``` On Sat, Mar 29, 2008 at 06:05:43PM -0400, Jeff King wrote: > > That's cool - didn't know a rework of the ssh interactions had > > happened. It would be really good if we could detect if there's an > > existing "master" connection and piggyback over that (see options -M > > and -O). Reading man ssh_config it looks like we may be able to say > > something along the lines of " -o ControlMaster=auto ". > > I have been using this for at least a year with git; just put > "ControlMaster auto" into your .ssh/config. Oh, and if you are trying to achieve "doing two back-to-back ssh's should only need one connection because of ControlMaster", that doesn't work. The master is closely tied to the first session, so it exits when that session finishes. I think more useful semantics for something like git would be an opportunistic short-lived server. That is, 'ssh foo' would try: - if .ssh/cache/foo does not exist, spawn "master" - repeatedly try to connect via .ssh/cache/foo (since it may take a while for the connection to be made, but eventually time out if we can't do it) The "master" would: - listen on .ssh/cache/foo - connect to 'foo' via ssh - multiplex any incoming connections on .ssh/cache/foo on our session - after N seconds of no active connections, close the ssh session But that is an ssh problem, not a git problem at all. -Peff ``` ## Bryan Donlan, 2008-03-30 20:34 Subject: Re: why multiple password prompts? Message-ID: <3e8340490803301334g2127451cu6e9dc71eefa6241c@mail.gmail.com> URL: https://gitlist.dev/e/3e8340490803301334g2127451cu6e9dc71eefa6241c%40mail.gmail.com In-Reply-To: ``` On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow wrote: > On Sat, 29 Mar 2008, Paul wrote: > > > When I do a simple git-pull over SSH, why does it typically prompt me for my > > SSH password two or three times? And no, I am not inputting it wrong. > > In some versions of git, it makes separate connections to find out what > the remote's state is and to fetch the actual data. A third connection > should only be needed if there are new tags to fetch, and that would be > after some of the messages. > > One of the changes in the upcoming release is to reduce this to one, > except for an occasional second one. git.git's master branch seems to be hitting ssh twice fairly reliably... [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull bd@130.111.246.25's password: bd@130.111.246.25's password: remote: Counting objects: 5, done. remote: Compressing objects: 100% (2/2)remote: , done. remote: Total 3 (delta 0), reused 0 (delta 0) Unpacking objects: 100% (3/3), done. From ssh+git://bd@130.111.246.25/home/bd/git-test b0b8450..57a92a7 master -> origin/master Updating b0b8450..57a92a7 Fast forward fob | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) [bd@shion git-test] ~/src/git/git --version git version 1.5.5.rc2 The remote's still on 1.5.4.4 if it matters... ``` ## Daniel Barkalow, 2008-03-30 21:56 Subject: Re: why multiple password prompts? Message-ID: URL: https://gitlist.dev/e/alpine.LNX.1.00.0803301755200.19665%40iabervon.org In-Reply-To: <3e8340490803301334g2127451cu6e9dc71eefa6241c@mail.gmail.com> ``` On Sun, 30 Mar 2008, Bryan Donlan wrote: > git.git's master branch seems to be hitting ssh twice fairly reliably... > [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull > bd@130.111.246.25's password: > bd@130.111.246.25's password: > remote: Counting objects: 5, done. > remote: Compressing objects: 100% (2/2)remote: , done. > remote: Total 3 (delta 0), reused 0 (delta 0) > Unpacking objects: 100% (3/3), done. > From ssh+git://bd@130.111.246.25/home/bd/git-test > b0b8450..57a92a7 master -> origin/master > Updating b0b8450..57a92a7 > Fast forward > fob | 1 + > 1 files changed, 1 insertions(+), 0 deletions(-) > [bd@shion git-test] ~/src/git/git --version > git version 1.5.5.rc2 > > The remote's still on 1.5.4.4 if it matters... No, but ~/src/git/git-pull will run the installed git-fetch, not the locally built one, IIRC. -Daniel *This .sig left intentionally blank* ``` ## Bryan Donlan, 2008-03-30 22:05 Subject: Re: why multiple password prompts? Message-ID: <3e8340490803301505y7df70787wad4449b1821e0d05@mail.gmail.com> URL: https://gitlist.dev/e/3e8340490803301505y7df70787wad4449b1821e0d05%40mail.gmail.com In-Reply-To: ``` On Sun, Mar 30, 2008 at 5:56 PM, Daniel Barkalow wrote: > On Sun, 30 Mar 2008, Bryan Donlan wrote: > > > git.git's master branch seems to be hitting ssh twice fairly reliably... > > [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull > > bd@130.111.246.25's password: > > bd@130.111.246.25's password: > > remote: Counting objects: 5, done. > > remote: Compressing objects: 100% (2/2)remote: , done. > > remote: Total 3 (delta 0), reused 0 (delta 0) > > Unpacking objects: 100% (3/3), done. > > From ssh+git://bd@130.111.246.25/home/bd/git-test > > b0b8450..57a92a7 master -> origin/master > > Updating b0b8450..57a92a7 > > Fast forward > > fob | 1 + > > 1 files changed, 1 insertions(+), 0 deletions(-) > > [bd@shion git-test] ~/src/git/git --version > > git version 1.5.5.rc2 > > > > The remote's still on 1.5.4.4 if it matters... > > No, but ~/src/git/git-pull will run the installed git-fetch, not the > locally built one, IIRC. Ah, that would be it, thanks. ```