84

I would like run deploy script with gitlab-ci, but step ssh-add $SSH_PRIVATE_KEY return an error :

echo "$SSH_PRIVATE_KEY" | ssh-add -
Error loading key "(stdin)": invalid format

You can see my .gitlab-ci.yml :

deploy:
  image: node:9.11.1-alpine
  stage: deploy
  before_script:
    # Install ssh-agent if not already installed, it is required by Docker.
    # (change apt-get to yum if you use a CentOS-based image)
    - 'which ssh-agent || ( apk add --update openssh )'

    # Add bash
    - apk add --update bash

    # Add git
    - apk add --update git

    # Run ssh-agent (inside the build environment)
    - eval $(ssh-agent -s)

    # Add the SSH key stored in SSH_PRIVATE_KEY variable to the agent store
    - echo "$SSH_PRIVATE_KEY"
    - echo "$SSH_PRIVATE_KEY" | ssh-add -

    # For Docker builds disable host key checking. Be aware that by adding that
    # you are suspectible to man-in-the-middle attacks.
    # WARNING: Use this only with the Docker executor, if you use it with shell
    # you will overwrite your user's SSH config.
    - mkdir -p ~/.ssh
    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
    # In order to properly check the server's host key, assuming you created the
    # SSH_SERVER_HOSTKEYS variable previously, uncomment the following two lines
    # instead.
    # - mkdir -p ~/.ssh
    # - '[[ -f /.dockerenv ]] && echo "$SSH_SERVER_HOSTKEYS" > ~/.ssh/known_hosts'
  script:
    - npm i -g pm2
    - pm2 deploy ecosystem.config.js production
  # only:
  # - master

On my project setting, i've been add SSH_PRIVATE_KEY variable, with the id_rsa from my production server cat ~/.ssh/id_rsa.pub.

Anyone can help me ?

2
  • 13
    it is the SSH public key in ~/.ssh/id_rsa.pub while the private key is contained in ~/.ssh/id_rsa
    – pfctgeorge
    Commented Aug 31, 2018 at 6:53
  • @pfctgeorge I dumbly copied the wrong file as well :P You should move your comment into an answer. I will come back and upvote it.
    – joshmcode
    Commented Jun 11, 2019 at 16:01

19 Answers 19

101

In my case, it was because I had made my SSH_PRIVATE_KEY variable protected. When I disabled the Protected state, it worked without any error.

enter image description here

4
  • 11
    Also make sure to set the variable as type VARIABLE, not FILE Commented Feb 16, 2020 at 23:45
  • It solved it for me even though my target branch was protected. Any idea why?
    – J.Kirk.
    Commented Aug 1, 2020 at 18:43
  • 1
    this did not work for me, also its a workaround and should be considered as a bug (which they maybe have solved by now?) Commented Aug 3, 2020 at 8:34
  • 3
    Or you could make the branch protected. In that case the variable can remain protected as well! Commented Feb 3, 2022 at 16:23
72

In my case I had to put a new line at the end of the SSH_PRIVATE_KEY variable

4
37

I made a stupid mistake and added the key without -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- clauses.

Summing up, you should add:

-----BEGIN RSA PRIVATE KEY-----
<< the key itself goes here >>
-----END RSA PRIVATE KEY-----

Also, ensure the newline after the closing is present.

1
  • even you could get the value using below code 'cat ~/.ssh/id_rsa | xclip -selection c' Commented May 8 at 1:35
17

for all people reaching this post not finding a solution yet.

Try to make the branch protected, because its a must for protected variables.

Protected: Only exposed to protected branches or protected tags.

Add a CI/CD variable to a project

9

It works with variable expansion (curly brackets in double string quotation):

  - echo "${SSH_PRIVATE_KEY}" | ssh-add -

While keeping the SSH_PRIVATE_KEY variable protected!

This approach is simply a less ambiguous method for printing variables; in this case it prevents trimming of the last line break.

2
  • 1
    Do you have an idea about what the "-" means after ssh-add ? Commented Sep 13, 2022 at 15:10
  • 2
    great question @ZemmouriTarek; this is how bash pipelines work; the dash "-" simply says that there are no more options and should input the output from the first part Commented Sep 14, 2022 at 8:41
8

Make sure that the newline after the end of the file variable is present. If not, the following error would have appeared:

Load key "/home/.../....tmp/ID_RSA": invalid format
 [MASKED]@...: Permission denied (publickey).

The ID_RSA was my file variable in this example.

6

I got it working with a protected variable.

If the variable is file, echo won't work anymore:

cat "$SSH_PRIVATE_KEY" | ssh-add -

Otherwise; if variable is NOT file, use the following:

echo "$SSH_PRIVATE_KEY" | ssh-add -
5

If you export key from PuTTYgen, to get key content use its command Conversations - Export OpenSSH key (force new file format)

And trim last spaces and add new line.

3

It is the SSH public key in ~/.ssh/id_rsa.pub by default.

The private key is contained in ~/.ssh/id_rsa

2

You must copy the entire contents of the file(id_rsa), including the final blank line. I solve the problem this way.

2

I had the same problem and after spending some hours trying to understand what was wrong I found that my private key was encrypted (and my computer had the password in cache for so long that I had forgotten that it was encrypted). It's not so easy to understand if it's encrypted or not by just looking at the key. You should decrypt the key (set an empty password) and then paste it on a GitLab variable. Then in your .gitlab-ci.yml you can have a similar configuration:

before_script:
    - 'which ssh-agent || ( apt-get install -qq openssh-client )'
    - mkdir -p ~/.ssh
    - touch ~/.ssh/id_rsa
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' > ~/.ssh/id_rsa
    - chmod 600 ~/.ssh/id_rsa
    - echo -e "Host *\nStrictHostKeyChecking no\n" > ~/.ssh/config
    - eval "$(ssh-agent -s)"
    - ssh-add ~/.ssh/id_rsa

*** Note that if you don't want to write the key in a file, you can just put it inside the ssh agent with:

- echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add - > /dev/null 

*** Note 2: In the Gitlab panel, make sure you have created a variable (and not a file); normally, it should be protected if you want to make it visible in the main branch.

*** Important: For security reasons change the following line:

- echo -e "Host *\nStrictHostKeyChecking no\n" > ~/.ssh/config

putting only your host/s (and don't permit all connections like this). If you put:

StrictHostKeyChecking no

when connecting to any host, the ssh-agent will not check the signature and this can be a big vulnerability!

1

I had this issue on gitlab and bitbucket, both were solved adding a \n by the end of the key file.

echo $'' >> ~/.ssh/id_rsa
1

Keeping SSH_PRIVATE_KEY protected

Making my tags protected fixed the issue for me. Here is how to do it: https://docs.gitlab.com/ee/user/project/protected_tags.html

Note the definition of Protect variable:

Export variable to pipelines running on protected branches and tags only.

Whether or not tags were created on commits on a protected branch did not matter apparently. GitLab has an independent notion of protected tags which disregards what branch the underlying commit is in.

Otherwise, if you are running the pipeline on branch commits, make sure that branch is a protected one.

0

In my case, it was because I had made my SSH_PRIVATE_KEY variable available in a specific enviroment. I changed it to the one I was using (or you can change it to All, depending on your setup).

0

it possible you didn't copy the content of the public key to the authorized_keys

$ cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
0

In my case, the stupid me was using inconsistent variable name.

I defined SSH_PRIVATE_KEY in GitLab's variables and was using OWNER_PRIVATE_KEY in .gitlab-ci.yml.

That's why I hate working straight after lunch..

0

What worked for me was to put '\n' on every line break and storing the key as ONE LINE in my variables and then using '-e' switch in echo:

echo -e $SECRET_KEY > key.pem

This worked and it also helped me to add the identity to ssh-add directly like this:

echo -e "$SSH_PRIVATE_KEY" | ssh-add -

hope this helps someone.

0

This can be helpful

  • Setup the ssh private key from the pipeline:
    .setupssh: &setupssh
        - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client git -y )'
        - eval $(ssh-agent -s)
        - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
        - mkdir -p ~/.ssh
        - chmod 700 ~/.ssh
        - ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
        - chmod 644 ~/.ssh/known_hosts
  • When you create a new branch from the master branch, the pipeline fails with this error:

     Error loading key "(stdin)": error in libcrypto 

This happened because your $SSH_PRIVATE_KEY is protected.

Solution :

Go to : Settings > CI/CD > Variables and edit the $SSH_PRIVATE_KEY, Uncheck Protect Variable if is checked.

0
  • first be sure that your variable $SSH_PRIVATE_KEY is not projected

  • then encode your private key to base64 for keeping the good format

  • final add this line.

    -echo "$DEV_NODE_ONE_SSH_KEY" | tr -d '' | base64 --decode | ssh-add -

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.