MaxAuthTries too small, auth fails with more than 2 SSH keys on client

[matthijskooijman]

BorgWarehouse version : 3.1.2
Installation type : Docker

---

Describe the bug
SSH is configured with MaxAuthTries=2, which apparently only means you can try at most 2 SSH keys.

I have three keys in my agent, and am using ssh_command: ssh -i /etc/borgmatic/ssh-key in borgmatic to point borg at the actual key, but it turns out SSH tries the agent keys first. In practice, this means:

matthijs@lurch:/etc/containers/systemd/borgwarehouse$ sudo borgmatic repo-create -e keyfile
Remote: Received disconnect from 127.0.0.1 port 2223:2: Too many authentication failures
Remote: Disconnected from 127.0.0.1 port 2223
Connection closed by remote host. Is borg working on the server?

If I run SSH with -v, it shows:

debug1: Will attempt key: [redacted] agent
debug1: Will attempt key: [redacted] agent
debug1: Will attempt key: [redacted] agent
debug1: Will attempt key: /etc/borgmatic/ssh-key [redacted] explicit
debug1: Offering public key: [redacted] agent
debug1: Authentications that can continue: publickey
debug1: Offering public key: [redacted] agent
Received disconnect from 127.0.0.1 port 2223:2: Too many authentication failures
Disconnected from 127.0.0.1 port 2223

Which confirms this.

I think this might also be the issue underlying #365.

Suggested solution
Raise the the MaxAuthTries config (maybe omit it to get the default value of 6).

[Ravinou]

To strengthen the SSH configuration, I used the recommendations of ANSSI (French National Agency for the Security of Information Systems). I had never seen this type of connection with SSH key rotation before. But it makes sense in specific architectural cases, even if it seems surprising :D.

However, the sshd_config under docker/ directory file remains modifiable and adaptable to each individual. So I'm not sure I want to modify it for this particular case. Because, 2 is too small for your case, but maybe 4 or 6 will be too small for anyone else. What do you think?

[matthijskooijman]

However, the sshd_config under docker/ directory file remains modifiable and adaptable to each individual.

Yeah, so I fixed it already in my install, but it might still be good to prevent others from going through the same debug session I did.

(unrelated note: I'm not sure that having a copy-once sshd configuration like you do now is the best approach, since it is now tricky for you to make further changes to the sshd config in existing installs. I would keep the sshd config outside of the volume, and have an sshd_config.d inside the volume to override just particular settings - I can expand on this idea in a separate issue if you're interested).

So I'm not sure I want to modify it for this particular case. Because, 2 is too small for your case, but maybe 4 or 6 will be too small for anyone else. What do you think?

I would argue that keeping it the same as a default sshd_config would be helpful here - if people have too much keys for 6, then they will have ran into this issue on other servers already. Right now, borgwarehouse behaves differently than most other servers, which leads to surprise. Doing the same as a default ssh server should prevent this surprise.