net-ssh 5.1.0 → 6.1.0

data/.travis.yml

@@ -7,12 +7,12 @@ addon:
     gateway.netssh
 
 rvm:
-  - 2.2.10
-  - 2.3.7
-  - 2.4.5
-  - 2.5.3
-  - 2.6.0-rc2
-  - jruby-9.2.5.0
+  - 2.3.8
+  - 2.4.8
+  - 2.5.7
+  - 2.6.5
+  - 2.7.0
+  - jruby-9.2.11.1
   - rbx-3.107
   - ruby-head
 env:
@@ -21,33 +21,32 @@ env:
 matrix:
   exclude:
     - rvm: rbx-3.107
-    - rvm: jruby-9.2.5.0
   include:
     - rvm: rbx-3.107
       env: NET_SSH_RUN_INTEGRATION_TESTS=
-    - rvm: jruby-9.2.5.0
+    - rvm: jruby-9.2.11.1
       env: JRUBY_OPTS='--client -J-XX:+TieredCompilation -J-XX:TieredStopAtLevel=1 -Xcext.enabled=false -J-Xss2m -Xcompile.invokedynamic=false' NET_SSH_RUN_INTEGRATION_TESTS=
   fast_finish: true
   allow_failures:
     - rvm: rbx-3.107
-    - rvm: jruby-9.2.5.0
+    - rvm: jruby-9.2.11.1
     - rvm: ruby-head
 
 install:
   - export JRUBY_OPTS='--client -J-XX:+TieredCompilation -J-XX:TieredStopAtLevel=1 -Xcext.enabled=false -J-Xss2m -Xcompile.invokedynamic=false'
   - sudo pip install ansible urllib3 pyOpenSSL ndg-httpsclient pyasn1
-  - gem install bundler -v "= 1.16"
+  - gem install bundler -v "= 1.17"
   - gem list bundler
-  - bundle _1.16_ install
-  - bundle _1.16_ -v
-  - BUNDLE_GEMFILE=./Gemfile.noed25519 bundle _1.16_ install
+  - bundle _1.17_ install
+  - bundle _1.17_ -v
+  - BUNDLE_GEMFILE=./Gemfile.noed25519 bundle _1.17_ install
   - sudo ansible-galaxy install rvm.ruby
   - sudo chown -R travis:travis /home/travis/.ansible
   - ansible-playbook ./test/integration/playbook.yml -i "localhost," --become -c local -e 'no_rvm=true' -e 'myuser=travis' -e 'mygroup=travis' -e 'homedir=/home/travis'
 
 script:
   - ssh -V
-  - bundle _1.16_ exec rake test
-  - BUNDLE_GEMFILE=./Gemfile.noed25519 bundle _1.16_ exec rake test
-  - bundle _1.16_ exec rake test_test
-  - bundle _1.16_ exec rubocop
+  - bundle _1.17_ exec rake test
+  - BUNDLE_GEMFILE=./Gemfile.noed25519 bundle _1.17_ exec rake test
+  - bundle _1.17_ exec rake test_test
+  - bundle _1.17_ exec rubocop

data/CHANGES.txt

@@ -1,8 +1,59 @@
+=== 6.1.0
+
+  * adapt to ssh's default bahaviors when no username is provided.
+    When Net::SSH.start user is nil and config has no entry
+    we default to Etc.getpwuid.name() instead of Etc.getlogin(). [#749]
+
+=== 6.1.0.rc1
+
+  * Make sha2-{256,512}-etm@openssh.com MAC default again [#761]
+  * Support algorithm subtraction syntax from ssh_config [#751]
+
+=== 6.0.2
+
+  * Fix corrupted hmac issue in etm hmac [#759]
+
+=== 6.0.1
+
+  * Make sha2-{256,512}-etm@openssh.com MAC opt-in as they seems to have issues [#757]
+
+=== 6.0.0
+
+  * Support empty lines and comments in known_hosts [donoghuc, #742]
+  * Add sha2-{256,512}-etm@openssh.com MAC algorithms [graaff, #714]
+
+=== 6.0.0 beta2
+  
+  * Support :certkeys and CertificateFile configuration option  [Anders Carling, #722]
+
+=== 6.0.0 beta1
+
+  * curve25519sha256 support [Florian Wininger ,#690]
+  * disabled insecure algs [Florian Wininger , #709]
+
+=== 5.2.0
+
+=== 5.2.0.rc3
+
+  * Fix check_host_ip read from config
+  * Support ssh-ed25519 in kown hosts
+
+=== 5.2.0.rc2
+
+  * Read check_host_ip from ssh config files
+
+=== 5.2.0.rc1
+
+  * Interpret * and ? in know_hosts file [Romain Tartière, #660]
+  * New :check_host_ip so ip checking can be disabled in known hosts [Romain Tartière, #656]
+
+=== 5.1.0
+
 === 5.1.0.rc1
 
   * Support new OpenSSH private key format for rsa - bcrypt for rsa (ed25519 already supported) [#646]
   * Support IdentityAgent is ssh config [Frank Groeneveld, #645]
-  * Improve Match processin in ssh config [Aleksandrs Ļedovskis, #642]
+  * Improve Match processing in ssh config [Aleksandrs Ļedovskis, #642]
   * Ignore signature verification when verify_host_key is never [Piotr Kliczewski, #641]
   * Alg preference was changed to prefer stronger encryptions  [Tray, #637]
 

data/Manifest

@@ -33,7 +33,6 @@ lib/net/ssh/proxy/errors.rb
 lib/net/ssh/proxy/http.rb
 lib/net/ssh/proxy/socks4.rb
 lib/net/ssh/proxy/socks5.rb
-lib/net/ssh/ruby_compat.rb
 lib/net/ssh/service/forward.rb
 lib/net/ssh/test.rb
 lib/net/ssh/test/channel.rb

data/README.md

@@ -0,0 +1,287 @@
+[![Gem Version](https://badge.fury.io/rb/net-ssh.svg)](https://badge.fury.io/rb/net-ssh)
+[![Join the chat at https://gitter.im/net-ssh/net-ssh](https://badges.gitter.im/net-ssh/net-ssh.svg)](https://gitter.im/net-ssh/net-ssh?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+[![Build Status](https://travis-ci.org/net-ssh/net-ssh.svg?branch=master)](https://travis-ci.org/net-ssh/net-ssh)
+[![Coverage status](https://codecov.io/gh/net-ssh/net-ssh/branch/master/graph/badge.svg)](https://codecov.io/gh/net-ssh/net-ssh)
+[![Backers on Open Collective](https://opencollective.com/net-ssh/backers/badge.svg)](#backers])
+[![Sponsors on Open Collective](https://opencollective.com/net-ssh/sponsors/badge.svg)](#sponsors)
+
+# Net::SSH 6.x
+
+* Docs: http://net-ssh.github.com/net-ssh
+* Issues: https://github.com/net-ssh/net-ssh/issues
+* Codes: https://github.com/net-ssh/net-ssh
+* Email: net-ssh@solutious.com
+
+*As of v2.6.4, all gem releases are signed. See [INSTALL](#install).*
+
+## DESCRIPTION:
+
+Net::SSH is a pure-Ruby implementation of the SSH2 client protocol.
+It allows you to write programs that invoke and interact with processes on remote servers, via SSH2.
+
+## FEATURES:
+
+* Execute processes on remote servers and capture their output
+* Run multiple processes in parallel over a single SSH connection
+* Support for SSH subsystems
+* Forward local and remote ports via an SSH connection
+
+## Supported Algorithms
+
+Net::SSH 6.0 disables by default the usage of weak algorithms.
+We strongly recommend that you install a servers's version that supports the latest algorithms.
+
+It is possible to return to the previous behavior by adding the option : `append_all_supported_algorithms: true`
+
+Unsecure algoritms will definitely be removed in Net::SSH 7.*.
+
+### Host Keys
+
+| Name                 | Support               | Details  |
+|----------------------|-----------------------|----------|
+| ssh-rsa              | OK                    |          |
+| ssh-ed25519          | OK                    | Require the gem `ed25519` |
+| ecdsa-sha2-nistp521  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdsa-sha2-nistp384  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdsa-sha2-nistp256  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ssh-dss              | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+
+### Key Exchange
+
+| Name                                 | Support               | Details  |
+|--------------------------------------|-----------------------|----------|
+| curve25519-sha256                    | OK                    | Require the gem `x25519` |
+| ecdh-sha2-nistp521                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp384                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp256                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| diffie-hellman-group1-sha1           | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| diffie-hellman-group14-sha1          | OK                    |          |
+| diffie-hellman-group-exchange-sha1   | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| diffie-hellman-group-exchange-sha256 | OK                    |          |
+
+### Encryption algorithms (ciphers)
+
+| Name                                 | Support               | Details  |
+|--------------------------------------|-----------------------|----------|
+| aes256-ctr / aes192-ctr / aes128-ctr | OK                    |          |
+| aes256-cbc / aes192-cbc / aes128-cbc | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| rijndael-cbc@lysator.liu.se          | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| blowfish-ctr blowfish-cbc            | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| cast128-ctr cast128-cbc              | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| 3des-ctr 3des-cbc                    | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| idea-cbc                             | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| none                                 | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+
+### Message Authentication Code algorithms
+
+| Name                 | Support               | Details  |
+|----------------------|-----------------------|----------|
+| hmac-sha2-512-etm    | OK                    |          |
+| hmac-sha2-256-etm    | OK                    |          |
+| hmac-sha2-512        | OK                    |          |
+| hmac-sha2-256        | OK                    |          |
+| hmac-sha2-512-96     | Deprecated in 6.0     | removed from the specification, will be removed in 7.0 |
+| hmac-sha2-256-96     | Deprecated in 6.0     | removed from the specification, will be removed in 7.0 |
+| hmac-sha1            | OK                    | for backward compatibility      |
+| hmac-sha1-96         | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| hmac-ripemd160       | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| hmac-md5             | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| hmac-md5-96          | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+| none                 | Deprecated in 6.0     | unsecure, will be removed in 7.0 |
+
+## SYNOPSIS:
+
+In a nutshell:
+
+```ruby
+require 'net/ssh'
+
+Net::SSH.start('host', 'user', password: "password") do |ssh|
+
+# capture all stderr and stdout output from a remote process
+output = ssh.exec!("hostname")
+puts output
+
+# capture only stdout matching a particular pattern
+stdout = ""
+ssh.exec!("ls -l /home/jamis") do |channel, stream, data|
+  stdout << data if stream == :stdout && /foo/.match(data)
+end
+puts stdout
+
+# run multiple processes in parallel to completion
+ssh.exec "sed ..."
+ssh.exec "awk ..."
+ssh.exec "rm -rf ..."
+ssh.loop
+
+# open a new channel and configure a minimal set of callbacks, then run
+# the event loop until the channel finishes (closes)
+channel = ssh.open_channel do |ch|
+  ch.exec "/usr/local/bin/ruby /path/to/file.rb" do |ch, success|
+    raise "could not execute command" unless success
+
+    # "on_data" is called when the process writes something to stdout
+    ch.on_data do |c, data|
+      $stdout.print data
+    end
+
+    # "on_extended_data" is called when the process writes something to stderr
+    ch.on_extended_data do |c, type, data|
+      $stderr.print data
+    end
+
+    ch.on_close { puts "done!" }
+  end
+end
+
+channel.wait
+
+# forward connections on local port 1234 to port 80 of www.capify.org
+ssh.forward.local(1234, "www.capify.org", 80)
+ssh.loop { true }
+end
+```
+
+See Net::SSH for more documentation, and links to further information.
+
+## REQUIREMENTS:
+
+The only requirement you might be missing is the OpenSSL bindings for Ruby with a version greather than `1.0.1`.
+These are built by default on most platforms, but you can verify that they're built and installed on your system by running the following command line:
+
+```sh
+ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
+```
+
+If that spits out something like `OpenSSL 1.0.1 14 Mar 2012`, then you're set.
+If you get an error, then you'll need to see about rebuilding ruby with OpenSSL support,
+or (if your platform supports it) installing the OpenSSL bindings separately.
+
+## INSTALL:
+
+```sh
+gem install net-ssh # might need sudo privileges
+```
+
+NOTE: If you are running on jruby on windows you need to install `jruby-pageant` manually
+(gemspec doesn't allow for platform specific dependencies at gem installation time).
+
+However, in order to be sure the code you're installing hasn't been tampered with,
+it's recommended that you verify the [signature](http://docs.rubygems.org/read/chapter/21).
+ To do this, you need to add my public key as a trusted certificate (you only need to do this once):
+
+```sh
+# Add the public key as a trusted certificate
+# (You only need to do this once)
+curl -O https://raw.githubusercontent.com/net-ssh/net-ssh/master/net-ssh-public_cert.pem
+gem cert --add net-ssh-public_cert.pem
+```
+
+Then, when install the gem, do so with high security:
+
+```sh
+gem install net-ssh -P HighSecurity
+```
+
+If you don't add the public key, you'll see an error like "Couldn't verify data signature".
+If you're still having trouble let me know and I'll give you a hand.
+
+For ed25519 public key auth support your bundle file should contain `ed25519`, `bcrypt_pbkdf` dependencies.
+
+```sh
+gem install ed25519
+gem install bcrypt_pbkdf
+```
+
+For curve25519-sha256 kex exchange support your bundle file should contain `x25519` dependency.
+
+## RUBY SUPPORT
+
+* See [net-ssh.gemspec](https://github.com/net-ssh/net-ssh/blob/master/net-ssh.gemspec) for current versions ruby requirements
+
+## RUNNING TESTS
+
+If you want to run the tests or use any of the Rake tasks, you'll need Mocha and
+other dependencies listed in Gemfile
+
+Run the test suite from the net-ssh directory with the following command:
+
+```sh
+bundle exec rake test
+```
+
+Run a single test file like this:
+
+```sh
+ruby -Ilib -Itest test/transport/test_server_version.rb
+```
+
+To run integration tests see test/integration/README.txt
+
+### BUILDING GEM
+
+```sh
+rake build
+```
+
+### GEM SIGNING (for maintainers)
+
+If you have the net-ssh private signing key, you will be able to create signed release builds. Make sure the private key path matches the `signing_key` path set in `net-ssh.gemspec` and tell rake to sign the gem by setting the `NET_SSH_BUILDGEM_SIGNED` flag:
+
+```sh
+NET_SSH_BUILDGEM_SIGNED=true rake build
+```
+
+For time to time, the public certificate associated to the private key needs to be renewed. You can do this with the following command:
+
+```sh
+gem cert --build netssh@solutious.com --private-key path/2/net-ssh-private_key.pem
+mv gem-public_cert.pem net-ssh-public_cert.pem
+gem cert --add net-ssh-public_cert.pem
+```
+
+## CREDITS
+
+### Contributors
+
+This project exists thanks to all the people who contribute.
+
+[![contributors](https://opencollective.com/net-ssh/contributors.svg?width=890&button=false)](graphs/contributors)
+
+### Backers
+
+Thank you to all our backers! 🙏 [Become a backer](https://opencollective.com/net-ssh#backer)
+
+[![backers](https://opencollective.com/net-ssh/backers.svg?width=890)](https://opencollective.com/net-ssh#backers)
+
+### Sponsors
+
+Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor](https://opencollective.com/net-ssh#sponsor)
+
+[![Sponsor](https://opencollective.com/net-ssh/sponsor/0/avatar.svg)](https://opencollective.com/net-ssh/sponsor/0/website)
+
+## LICENSE:
+
+(The MIT License)
+
+Copyright (c) 2008 Jamis Buck
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/Rakefile

@@ -1,4 +1,3 @@
-
 #
 # Also in your terminal environment run:
 #   $ export LANG=en_US.UTF-8
@@ -32,7 +31,7 @@ RDoc::Task.new do |rdoc|
   rdoc.rdoc_dir = "rdoc"
   rdoc.title = "#{name} #{version}"
   rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.rdoc'
+  rdoc.main = 'README.md'
   rdoc.rdoc_files.include("README*")
   rdoc.rdoc_files.include("bin/*.rb")
   rdoc.rdoc_files.include("lib/**/*.rb")

data/appveyor.yml

@@ -5,9 +5,11 @@ skip_tags: true
 environment:
   matrix:
     - ruby_version: "jruby-9.1.2.0"
+    - ruby_version: "26-x64"
+    - ruby_version: "25-x64"
+    - ruby_version: "24-x64"
     - ruby_version: "23"
     - ruby_version: "23-x64"
-    - ruby_version: "22-x64"
 
 matrix:
   allow_failures:
@@ -29,7 +31,7 @@ install:
   - if "%ruby_version%" == "jruby-9.1.2.0" ( cinst jruby --version 9.1.2.0 -i --allow-empty-checksums )
   - if "%ruby_version%" == "jruby-9.1.2.0" ( SET "PATH=C:\jruby-9.1.2.0\bin\;%PATH%" )
   - ruby --version
-  - gem install bundler --no-document --user-install -v 1.16
+  - gem install bundler --no-document --user-install -v 1.17
   - SET BUNDLE_GEMFILE=Gemfile.noed25519
   - bundle install --retry=3
   - cinst freesshd

data/lib/net/ssh/authentication/certificate.rb

@@ -31,7 +31,16 @@ module Net
           cert.key_id = buffer.read_string
           cert.valid_principals = buffer.read_buffer.read_all(&:read_string)
           cert.valid_after = Time.at(buffer.read_int64)
-          cert.valid_before = Time.at(buffer.read_int64)
+          
+          cert.valid_before = if RUBY_PLATFORM == "java"
+                                # 0x20c49ba5e353f7 = 0x7fffffffffffffff/1000, the largest value possible for JRuby
+                                # JRuby Time.at multiplies the arg by 1000, and then stores it in a signed long.
+                                # 0x20c49ba5e353f7 = 292278994-08-17 01:12:55 -0600
+                                Time.at([0x20c49ba5e353f7, buffer.read_int64].min)
+                              else
+                                Time.at(buffer.read_int64)
+                              end
+
           cert.critical_options = read_options(buffer)
           cert.extensions = read_options(buffer)
           cert.reserved = buffer.read_string

data/lib/net/ssh/authentication/ed25519.rb

@@ -26,10 +26,22 @@ module Net
           CipherFactory = Net::SSH::Transport::CipherFactory
 
           MBEGIN = "-----BEGIN OPENSSH PRIVATE KEY-----\n"
-          MEND = "-----END OPENSSH PRIVATE KEY-----\n"
+          MEND = "-----END OPENSSH PRIVATE KEY-----"
           MAGIC = "openssh-key-v1"
 
+          class DecryptError < ArgumentError
+            def initialize(message, encrypted_key: false)
+              super(message)
+              @encrypted_key = encrypted_key
+            end
+
+            def encrypted_key?
+              return @encrypted_key
+            end
+          end
+
           def self.read(datafull, password)
+            datafull = datafull.strip
             raise ArgumentError.new("Expected #{MBEGIN} at start of private key") unless datafull.start_with?(MBEGIN)
             raise ArgumentError.new("Expected #{MEND} at end of private key") unless datafull.end_with?(MEND)
             datab64 = datafull[MBEGIN.size...-MEND.size]
@@ -74,7 +86,7 @@ module Net
             check1 = decoded.read_long
             check2 = decoded.read_long
 
-            raise ArgumentError, "Decrypt failed on private key" if (check1 != check2)
+            raise DecryptError.new("Decrypt failed on private key", encrypted_key: kdfname == 'bcrypt') if (check1 != check2)
 
             type_name = decoded.read_string
             case type_name

data/lib/net/ssh/authentication/ed25519_loader.rb

@@ -3,7 +3,7 @@ module Net
     module Authentication
 
       # Loads ED25519 support which requires optinal dependecies like
-      # rbnacl, bcrypt_pbkdf
+      # ed25519, bcrypt_pbkdf
       module ED25519Loader
       
         begin

data/lib/net/ssh/authentication/key_manager.rb

@@ -30,6 +30,9 @@ module Net
         # The list of user key data that will be examined
         attr_reader :key_data
 
+        # The list of user key certificate files that will be examined
+        attr_reader :keycert_files
+
         # The map of loaded identities
         attr_reader :known_identities
 
@@ -43,6 +46,7 @@ module Net
           self.logger = logger
           @key_files = []
           @key_data = []
+          @keycert_files = []
           @use_agent = options[:use_agent] != false
           @known_identities = {}
           @agent = nil
@@ -66,6 +70,12 @@ module Net
           self
         end
 
+        # Add the given keycert_file to the list of keycert files that will be used.
+        def add_keycert(keycert_file)
+          keycert_files.push(File.expand_path(keycert_file)).uniq!
+          self
+        end
+
         # Add the given key_file to the list of keys that will be used.
         def add_key_data(key_data_)
           key_data.push(key_data_).uniq!
@@ -108,7 +118,7 @@ module Net
               user_identities.delete(corresponding_user_identity) if corresponding_user_identity
 
               if !options[:keys_only] || corresponding_user_identity
-                known_identities[key] = { from: :agent }
+                known_identities[key] = { from: :agent, identity: key }
                 yield key
               end
             end
@@ -122,6 +132,21 @@ module Net
             yield key
           end
 
+          known_identity_blobs = known_identities.keys.map(&:to_blob)
+          keycert_files.each do |keycert_file|
+            keycert = KeyFactory.load_public_key(keycert_file)
+            next if known_identity_blobs.include?(keycert.to_blob)
+
+            (_, corresponding_identity) = known_identities.detect { |public_key, _|
+              public_key.to_pem == keycert.to_pem
+            }
+
+            if corresponding_identity
+              known_identities[keycert] = corresponding_identity
+              yield keycert
+            end
+          end
+
           self
         end
 
@@ -139,7 +164,7 @@ module Net
 
           if info[:key].nil? && info[:from] == :file
             begin
-              info[:key] = KeyFactory.load_private_key(info[:file], options[:passphrase], !options[:non_interactive])
+              info[:key] = KeyFactory.load_private_key(info[:file], options[:passphrase], !options[:non_interactive], options[:password_prompt])
             rescue OpenSSL::OpenSSLError, Exception => e
               raise KeyManagerError, "the given identity is known, but the private key could not be loaded: #{e.class} (#{e.message})"
             end
@@ -152,7 +177,7 @@ module Net
 
           if info[:from] == :agent
             raise KeyManagerError, "the agent is no longer available" unless agent
-            return agent.sign(identity, data.to_s)
+            return agent.sign(info[:identity], data.to_s)
           end
 
           raise KeyManagerError, "[BUG] can't determine identity origin (#{info.inspect})"
@@ -229,11 +254,15 @@ module Net
                 key = KeyFactory.load_public_key(identity[:pubkey_file])
                 { public_key: key, from: :file, file: identity[:privkey_file] }
               when :privkey_file
-                private_key = KeyFactory.load_private_key(identity[:privkey_file], options[:passphrase], ask_passphrase, options[:password_prompt])
+                private_key = KeyFactory.load_private_key(
+                  identity[:privkey_file], options[:passphrase], ask_passphrase, options[:password_prompt]
+                )
                 key = private_key.send(:public_key)
                 { public_key: key, from: :file, file: identity[:privkey_file], key: private_key }
               when :data
-                private_key = KeyFactory.load_data_private_key(identity[:data], options[:passphrase], ask_passphrase, "<key in memory>", options[:password_prompt])
+                private_key = KeyFactory.load_data_private_key(
+                  identity[:data], options[:passphrase], ask_passphrase, "<key in memory>", options[:password_prompt]
+                )
                 key = private_key.send(:public_key)
                 { public_key: key, from: :key_data, data: identity[:data], key: private_key }
               else

data/lib/net/ssh/authentication/methods/keyboard_interactive.rb

@@ -40,7 +40,9 @@ module Net
                 instruction = message.read_string
                 debug { "keyboard-interactive info request" }
 
-                prompter = prompt.start(type: 'keyboard-interactive', name: name, instruction: instruction) if password.nil? && interactive? && prompter.nil?
+                if password.nil? && interactive? && prompter.nil?
+                  prompter = prompt.start(type: 'keyboard-interactive', name: name, instruction: instruction)
+                end
 
                 _ = message.read_string # lang_tag
                 responses = []

data/lib/net/ssh/authentication/pub_key_fingerprint.rb

@@ -1,4 +1,3 @@
-
 require 'openssl'
 
 module Net

data/lib/net/ssh/authentication/session.rb

@@ -63,6 +63,7 @@ module Net
 
           key_manager = KeyManager.new(logger, options)
           keys.each { |key| key_manager.add(key) } unless keys.empty?
+          keycerts.each { |keycert| key_manager.add_keycert(keycert) } unless keycerts.empty?
           key_data.each { |key2| key_manager.add_key_data(key2) } unless key_data.empty?
           default_keys.each { |key| key_manager.add(key) } unless options.key?(:keys) || options.key?(:key_data)
 
@@ -136,12 +137,8 @@ module Net
         # Returns an array of paths to the key files usually defined
         # by system default.
         def default_keys
-          if defined?(OpenSSL::PKey::EC)
-            %w[~/.ssh/id_ed25519 ~/.ssh/id_rsa ~/.ssh/id_dsa ~/.ssh/id_ecdsa
-               ~/.ssh2/id_ed25519 ~/.ssh2/id_rsa ~/.ssh2/id_dsa ~/.ssh2/id_ecdsa]
-          else
-            %w[~/.ssh/id_dsa ~/.ssh/id_rsa ~/.ssh2/id_dsa ~/.ssh2/id_rsa]
-          end
+          %w[~/.ssh/id_ed25519 ~/.ssh/id_rsa ~/.ssh/id_dsa ~/.ssh/id_ecdsa
+             ~/.ssh2/id_ed25519 ~/.ssh2/id_rsa ~/.ssh2/id_dsa ~/.ssh2/id_ecdsa]
         end
 
         # Returns an array of paths to the key files that should be used when
@@ -150,6 +147,12 @@ module Net
           Array(options[:keys])
         end
 
+        # Returns an array of paths to the keycert files that should be used when
+        # attempting any key-based authentication mechanism.
+        def keycerts
+          Array(options[:keycerts])
+        end
+
         # Returns an array of the key data that should be used when
         # attempting any key-based authentication mechanism.
         def key_data