php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #52804 ssh2_auth_pubkey_file() requires both public and private keys
Submitted: 2010-09-09 19:21 UTC Modified: 2010-09-09 20:19 UTC
From: ron at roncemer dot com Assigned:
Status: Not a bug Package: *General Issues
PHP Version: 5.3.3 OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: ron at roncemer dot com
New email:
PHP Version: OS:

 

 [2010-09-09 19:21 UTC] ron at roncemer dot com
Description:
------------
Every other ssh client I've ever dealt with, only requires the private key to 
authenticate to a remote server with ssh2.

Have a look at the ganymed Java SSH2 library, class name 
ch.ethz.ssh2.Connection, function signature "boolean 
authenticateWithPublicKey(java.lang.String user, java.io.File pemFile, 
java.lang.String password)".  All that is needed is the private-key pem file in 
order to authenticate.  I've been using this library for years in Java, and it 
works great.

What is the reason for requiring both the public and private keys for 
authenticating, when in reality only the private key is required?  The public 
key should be easily extracted from private key, and should be handled silently 
by PHP.

Also, have a look at function signature "boolean	
authenticateWithPublicKey(java.lang.String user, char[] pemPrivateKey, 
java.lang.String password)".  This provides a way to pass in the private key as 
an array of char.  In PHP, this would be really useful.  You could store your 
private keys in a secured database and use it for all kinds of server 
authentication.  The absence of this functionality in PHP actually presents a 
security risk, because to get it to work, you'd actually have to write your 
private key to a temp file, then delete the temp file when done.  Not as secure 
as reading it from a string which came from a secure database.


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-09-09 20:19 UTC] pajoye@php.net
-Status: Open +Status: Bogus
 [2010-09-09 20:19 UTC] pajoye@php.net
Please report ssh2 at pecl, http://pecl.php.net/ssh2
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Mon Jul 14 15:01:31 2025 UTC