Emacs/Tramp fails to connect with ssh key equiped with a passphrase

Question

I have problem connecting via ssh using Tramp in Emacs on MS-Windows whenever the private ssh key I use is configured with a passphrase.

Here's the problem :

I. What works :

1. On the command line ssh -i path/to/shh_key_WITH_NO_passphrase login@hostname, works just fine and I'm connected to remote server.
2. On the command line ssh -i path/to/shh_key_WITH_passphrase login@hostname, I've got a prompt asking for my passphrase for this key :

And then I'm connected to the remote server.

3. In Emacs : C-x C-f RET /sshx: RET ssh_key_WITH_NO_passphrase, the connection succeed and I'm able to go through files and open them :

II. What don't works :

1. In Emacs : C-x C-f RET /sshx: RET ssh_key_WITH_passphrase

What happens with previous point 1. :

I get a Opening connection nil for ssh_key_WITH_passphrase using ssh... and it just hang there and I have to hit C-g like continously to get it out of there :

III. How to reproduce the bug :

1. Get GNU Emacs 28.2 running on MS-Windows 10
2. Create two ssh key to connect to a remote server, one with a passphrase and one without, see gitlab's help page for that.
3. Set tramp-default-method to "ssh" or "sshx" (either don't work on my side) with for example M-: RET (setq tramp-default-method "sshx")
4. Try to connect with one of the 2 keys, the one with a passphrase should not work, for that I've configure a config file in the .ssh/ in which I describe how OpenSSH should connect with remote server :

Host Co_No_Phrase
     HostName hostname
     Port 22
     User login
          IdentityFile HOME/.ssh/id_rsa
          IdentitiesOnly yes

Host Co_Phrase
     HostName hostname
     Port 22
     User login
          IdentityFile HOME/.ssh/id_rsa_phrase
          IdentitiesOnly yes

Then :

_ C-x C-f RET /sshx: RET Co_No_Phrase should tell Emacs to use Tramp to connect to hostname with the key that has no passphrase.

_ C-x C-f RET /sshx: RET Co_Phrase should tell Emacs to use Tramp to connect to hostname with the key that has a passphrase.

I love using Emacs for coding remotly on clusters, and never had any problem when I was on Linux, but for professionnal reasons I have to be on Windows now, poor me... It's awful, pls help me ?

Thanks a lot to the community

Answer 1

Thanks for the precise recipe. I could reproduce it on my Windows 10 VM, running Emacs 30.0.50 and OpenSSH_for_Windows_8.1p1. After instrumenting the ssh call in Tramp with -v, there is

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering public key: C:\\Users\\albinus/tmp/key_with_passphrase RSA SHA256:hqITNMbzDAJmafsNVNJLBffCiqGJ0Eoux3y+H8TfZZw explicit
debug1: Server accepts key: C:\\Users\\albinus/tmp/key_with_passphrase RSA SHA256:hqITNMbzDAJmafsNVNJLBffCiqGJ0Eoux3y+H8TfZZw explicit
debug1: read_passphrase: can't open /dev/tty: No such file or directory

So Tramp (Emacs) cannot read the passphrase. As solution, I've started ssh-agent as described in Key-based authentication in OpenSSH for Windows. Note, that you must run powershell as administrator. And then, apply

PS C:\Windows\system32> Get-Service ssh-agent | Set-Service -StartupType Manual
PS C:\Windows\system32> Start-Service ssh-agent
PS C:\Windows\system32> ssh-add C:\Users\albinus\tmp\key_with_passphrase
Enter passphrase for C:\Users\albinus\tmp\key_with_passphrase:
Identity added: C:\Users\albinus\tmp\key_with_passphrase (albinus@win10)

And indeed, the remote connection /sshx:co_phrase: opens then as expected.