why multiple password prompts?

why multiple password prompts?

[Paul]

When I do a simple git-pull over SSH, why does it typically prompt me 
for my SSH password two or three times? And no, I am not inputting it 
wrong.

$ git-pull
Password:
Password:
Password:
remote: Generating pack...

Re: why multiple password prompts?

[Daniel Barkalow]

On Sat, 29 Mar 2008, Paul wrote:

> When I do a simple git-pull over SSH, why does it typically prompt me for my
> SSH password two or three times? And no, I am not inputting it wrong.

In some versions of git, it makes separate connections to find out what 
the remote's state is and to fetch the actual data. A third connection 
should only be needed if there are new tags to fetch, and that would be 
after some of the messages.

One of the changes in the upcoming release is to reduce this to one, 
except for an occasional second one.

	-Daniel
*This .sig left intentionally blank*

Re: why multiple password prompts?

[Jakub Narebski]

Daniel Barkalow <barkalow@iabervon.org> writes:

> On Sat, 29 Mar 2008, Paul wrote:

Paul who?

>> When I do a simple git-pull over SSH, why does it typically prompt
>> me for my SSH password two or three times? And no, I am not
>> inputting it wrong.
> 
> In some versions of git, it makes separate connections to find out
> what the remote's state is and to fetch the actual data. A third
> connection should only be needed if there are new tags to fetch, and
> that would be after some of the messages.
> 
> One of the changes in the upcoming release is to reduce this to one,
> except for an occasional second one.

The way to avoid multiple prompt for SSH password is to set up SSH key
infrastructure, so you can login using SSH keys which does not require
you to enter password, with the possible exception of adding key to
keyring if it is protected by password.

See ssh-add(1) and ssh-keygen(1) (and keychain(1) if you want to add
keyonce for all sessions).

-- 
Jakub Narebski
Poland
ShadeHawk on #git

Re: why multiple password prompts?

[Martin Langhoff]

On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow <barkalow@iabervon.org> wrote:
>  One of the changes in the upcoming release is to reduce this to one,
>  except for an occasional second one.

That's cool - didn't know a rework of the ssh interactions had
happened. It would be really good if we could detect if there's an
existing "master" connection and piggyback over that (see options -M
and -O). Reading man ssh_config it looks like we may be able to say
something along the lines of " -o ControlMaster=auto ".

cheers,



martin
-- 
 martin.langhoff@gmail.com
 martin@laptop.org -- School Server Architect
 - ask interesting questions
 - don't get distracted with shiny stuff - working code first
 - http://wiki.laptop.org/go/User:Martinlanghoff

Re: why multiple password prompts?

[Daniel Barkalow]

On Sat, 29 Mar 2008, Martin Langhoff wrote:

> On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow <barkalow@iabervon.org> wrote:
> >  One of the changes in the upcoming release is to reduce this to one,
> >  except for an occasional second one.
> 
> That's cool - didn't know a rework of the ssh interactions had
> happened.

It's not actually anything to do with ssh; it's that the git native 
protocol code tries to do as much as possible in each of its connections.

> It would be really good if we could detect if there's an
> existing "master" connection and piggyback over that (see options -M
> and -O). Reading man ssh_config it looks like we may be able to say
> something along the lines of " -o ControlMaster=auto ".

People who want that will presumably set it in their ssh configuration.

	-Daniel
*This .sig left intentionally blank*

Re: why multiple password prompts?

[Daniel Barkalow]

On Sat, 29 Mar 2008, Jakub Narebski wrote:

> Daniel Barkalow <barkalow@iabervon.org> writes:
> 
> > On Sat, 29 Mar 2008, Paul wrote:
> 
> Paul who?

How should I know?

> >> When I do a simple git-pull over SSH, why does it typically prompt
> >> me for my SSH password two or three times? And no, I am not
> >> inputting it wrong.
> > 
> > In some versions of git, it makes separate connections to find out
> > what the remote's state is and to fetch the actual data. A third
> > connection should only be needed if there are new tags to fetch, and
> > that would be after some of the messages.
> > 
> > One of the changes in the upcoming release is to reduce this to one,
> > except for an occasional second one.
> 
> The way to avoid multiple prompt for SSH password is to set up SSH key
> infrastructure, so you can login using SSH keys which does not require
> you to enter password, with the possible exception of adding key to
> keyring if it is protected by password.

Sure, but it's inconvenient to wrap git-fetch and git-pull in 
ssh-agent/ssh-add/kill if you want to get exactly one password prompt per 
logical remote-using operation. Personally, I like that when I 
do operations involving authorized access to a remote machine, I need to 
enter my password. But once per command is all I want.

	-Daniel
*This .sig left intentionally blank*

Re: why multiple password prompts?

[Jeff King]

On Sat, Mar 29, 2008 at 02:37:00PM -0400, Martin Langhoff wrote:

> That's cool - didn't know a rework of the ssh interactions had
> happened. It would be really good if we could detect if there's an
> existing "master" connection and piggyback over that (see options -M
> and -O). Reading man ssh_config it looks like we may be able to say
> something along the lines of " -o ControlMaster=auto ".

I have been using this for at least a year with git; just put
"ControlMaster auto" into your .ssh/config.

-Peff

Re: why multiple password prompts?

[Jeff King]

On Sat, Mar 29, 2008 at 06:05:43PM -0400, Jeff King wrote:

> > That's cool - didn't know a rework of the ssh interactions had
> > happened. It would be really good if we could detect if there's an
> > existing "master" connection and piggyback over that (see options -M
> > and -O). Reading man ssh_config it looks like we may be able to say
> > something along the lines of " -o ControlMaster=auto ".
> 
> I have been using this for at least a year with git; just put
> "ControlMaster auto" into your .ssh/config.

Oh, and if you are trying to achieve "doing two back-to-back ssh's
should only need one connection because of ControlMaster", that doesn't
work.

The master is closely tied to the first session, so it exits when that
session finishes.

I think more useful semantics for something like git would be
an opportunistic short-lived server. That is, 'ssh foo' would try:

  - if .ssh/cache/foo does not exist, spawn "master"
  - repeatedly try to connect via .ssh/cache/foo (since it
    may take a while for the connection to be made, but
    eventually time out if we can't do it)

The "master" would:
  - listen on .ssh/cache/foo
  - connect to 'foo' via ssh
  - multiplex any incoming connections on .ssh/cache/foo on our session
  - after N seconds of no active connections, close the ssh session

But that is an ssh problem, not a git problem at all.

-Peff

Re: why multiple password prompts?

[Bryan Donlan]

On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow <barkalow@iabervon.org> wrote:
> On Sat, 29 Mar 2008, Paul wrote:
>
>  > When I do a simple git-pull over SSH, why does it typically prompt me for my
>  > SSH password two or three times? And no, I am not inputting it wrong.
>
>  In some versions of git, it makes separate connections to find out what
>  the remote's state is and to fetch the actual data. A third connection
>  should only be needed if there are new tags to fetch, and that would be
>  after some of the messages.
>
>  One of the changes in the upcoming release is to reduce this to one,
>  except for an occasional second one.

git.git's master branch seems to be hitting ssh twice fairly reliably...
[bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull
bd@130.111.246.25's password:
bd@130.111.246.25's password:
remote: Counting objects: 5, done.
remote: Compressing objects: 100% (2/2)remote: , done.
remote: Total 3 (delta 0), reused 0 (delta 0)
Unpacking objects: 100% (3/3), done.
From ssh+git://bd@130.111.246.25/home/bd/git-test
   b0b8450..57a92a7  master     -> origin/master
Updating b0b8450..57a92a7
Fast forward
 fob |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
[bd@shion git-test] ~/src/git/git --version
git version 1.5.5.rc2

The remote's still on 1.5.4.4 if it matters...

Re: why multiple password prompts?

[Daniel Barkalow]

On Sun, 30 Mar 2008, Bryan Donlan wrote:

> git.git's master branch seems to be hitting ssh twice fairly reliably...
> [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull
> bd@130.111.246.25's password:
> bd@130.111.246.25's password:
> remote: Counting objects: 5, done.
> remote: Compressing objects: 100% (2/2)remote: , done.
> remote: Total 3 (delta 0), reused 0 (delta 0)
> Unpacking objects: 100% (3/3), done.
> From ssh+git://bd@130.111.246.25/home/bd/git-test
>    b0b8450..57a92a7  master     -> origin/master
> Updating b0b8450..57a92a7
> Fast forward
>  fob |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
> [bd@shion git-test] ~/src/git/git --version
> git version 1.5.5.rc2
> 
> The remote's still on 1.5.4.4 if it matters...

No, but ~/src/git/git-pull will run the installed git-fetch, not the 
locally built one, IIRC.

	-Daniel
*This .sig left intentionally blank*

Re: why multiple password prompts?

[Bryan Donlan]

On Sun, Mar 30, 2008 at 5:56 PM, Daniel Barkalow <barkalow@iabervon.org> wrote:
> On Sun, 30 Mar 2008, Bryan Donlan wrote:
>
>  > git.git's master branch seems to be hitting ssh twice fairly reliably...
>  > [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull
>  > bd@130.111.246.25's password:
>  > bd@130.111.246.25's password:
>  > remote: Counting objects: 5, done.
>  > remote: Compressing objects: 100% (2/2)remote: , done.
>  > remote: Total 3 (delta 0), reused 0 (delta 0)
>  > Unpacking objects: 100% (3/3), done.
>  > From ssh+git://bd@130.111.246.25/home/bd/git-test
>  >    b0b8450..57a92a7  master     -> origin/master
>  > Updating b0b8450..57a92a7
>  > Fast forward
>  >  fob |    1 +
>  >  1 files changed, 1 insertions(+), 0 deletions(-)
>  > [bd@shion git-test] ~/src/git/git --version
>  > git version 1.5.5.rc2
>  >
>  > The remote's still on 1.5.4.4 if it matters...
>
>  No, but ~/src/git/git-pull will run the installed git-fetch, not the
>  locally built one, IIRC.

Ah, that would be it, thanks.