why multiple password prompts?

When I do a simple git-pull over SSH, why does it typically prompt me 
for my SSH password two or three times? And no, I am not inputting it 
wrong.

$ git-pull
Password:
Password:
Password:
remote: Generating pack...

On Sat, 29 Mar 2008, Paul wrote:

When I do a simple git-pull over SSH, why does it typically prompt me for my
SSH password two or three times? And no, I am not inputting it wrong.

In some versions of git, it makes separate connections to find out what 
the remote's state is and to fetch the actual data. A third connection 
should only be needed if there are new tags to fetch, and that would be 
after some of the messages.

One of the changes in the upcoming release is to reduce this to one, 
except for an occasional second one.

	-Daniel
*This .sig left intentionally blank*

Daniel Barkalow [off-list ref] writes:

On Sat, 29 Mar 2008, Paul wrote:

Paul who?

quoted

When I do a simple git-pull over SSH, why does it typically prompt
me for my SSH password two or three times? And no, I am not
inputting it wrong.

In some versions of git, it makes separate connections to find out
what the remote's state is and to fetch the actual data. A third
connection should only be needed if there are new tags to fetch, and
that would be after some of the messages.

One of the changes in the upcoming release is to reduce this to one,
except for an occasional second one.

The way to avoid multiple prompt for SSH password is to set up SSH key
infrastructure, so you can login using SSH keys which does not require
you to enter password, with the possible exception of adding key to
keyring if it is protected by password.

See ssh-add(1) and ssh-keygen(1) (and keychain(1) if you want to add
keyonce for all sessions).

-- 
Jakub Narebski
Poland
ShadeHawk on #git

On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow [off-list ref] wrote:

 One of the changes in the upcoming release is to reduce this to one,
 except for an occasional second one.

That's cool - didn't know a rework of the ssh interactions had
happened. It would be really good if we could detect if there's an
existing "master" connection and piggyback over that (see options -M
and -O). Reading man ssh_config it looks like we may be able to say
something along the lines of " -o ControlMaster=auto ".

cheers,



martin
-- 
 martin.langhoff@gmail.com
 martin@laptop.org -- School Server Architect
 - ask interesting questions
 - don't get distracted with shiny stuff - working code first
 - http://wiki.laptop.org/go/User:Martinlanghoff

On Sat, 29 Mar 2008, Martin Langhoff wrote:

On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow [off-list ref] wrote:

quoted

 One of the changes in the upcoming release is to reduce this to one,
 except for an occasional second one.

That's cool - didn't know a rework of the ssh interactions had
happened.

It's not actually anything to do with ssh; it's that the git native 
protocol code tries to do as much as possible in each of its connections.

It would be really good if we could detect if there's an
existing "master" connection and piggyback over that (see options -M
and -O). Reading man ssh_config it looks like we may be able to say
something along the lines of " -o ControlMaster=auto ".

People who want that will presumably set it in their ssh configuration.

	-Daniel
*This .sig left intentionally blank*

On Sat, 29 Mar 2008, Jakub Narebski wrote:

Daniel Barkalow [off-list ref] writes:

quoted

On Sat, 29 Mar 2008, Paul wrote:

Paul who?

How should I know?

quoted

quoted

When I do a simple git-pull over SSH, why does it typically prompt
me for my SSH password two or three times? And no, I am not
inputting it wrong.

In some versions of git, it makes separate connections to find out
what the remote's state is and to fetch the actual data. A third
connection should only be needed if there are new tags to fetch, and
that would be after some of the messages.

One of the changes in the upcoming release is to reduce this to one,
except for an occasional second one.

The way to avoid multiple prompt for SSH password is to set up SSH key
infrastructure, so you can login using SSH keys which does not require
you to enter password, with the possible exception of adding key to
keyring if it is protected by password.

Sure, but it's inconvenient to wrap git-fetch and git-pull in 
ssh-agent/ssh-add/kill if you want to get exactly one password prompt per 
logical remote-using operation. Personally, I like that when I 
do operations involving authorized access to a remote machine, I need to 
enter my password. But once per command is all I want.

	-Daniel
*This .sig left intentionally blank*

On Sat, Mar 29, 2008 at 02:37:00PM -0400, Martin Langhoff wrote:

That's cool - didn't know a rework of the ssh interactions had
happened. It would be really good if we could detect if there's an
existing "master" connection and piggyback over that (see options -M
and -O). Reading man ssh_config it looks like we may be able to say
something along the lines of " -o ControlMaster=auto ".

I have been using this for at least a year with git; just put
"ControlMaster auto" into your .ssh/config.

-Peff

On Sat, Mar 29, 2008 at 06:05:43PM -0400, Jeff King wrote:

quoted

That's cool - didn't know a rework of the ssh interactions had
happened. It would be really good if we could detect if there's an
existing "master" connection and piggyback over that (see options -M
and -O). Reading man ssh_config it looks like we may be able to say
something along the lines of " -o ControlMaster=auto ".

I have been using this for at least a year with git; just put
"ControlMaster auto" into your .ssh/config.

Oh, and if you are trying to achieve "doing two back-to-back ssh's
should only need one connection because of ControlMaster", that doesn't
work.

The master is closely tied to the first session, so it exits when that
session finishes.

I think more useful semantics for something like git would be
an opportunistic short-lived server. That is, 'ssh foo' would try:

  - if .ssh/cache/foo does not exist, spawn "master"
  - repeatedly try to connect via .ssh/cache/foo (since it
    may take a while for the connection to be made, but
    eventually time out if we can't do it)

The "master" would:
  - listen on .ssh/cache/foo
  - connect to 'foo' via ssh
  - multiplex any incoming connections on .ssh/cache/foo on our session
  - after N seconds of no active connections, close the ssh session

But that is an ssh problem, not a git problem at all.

-Peff

On Sat, Mar 29, 2008 at 12:48 PM, Daniel Barkalow [off-list ref] wrote:

On Sat, 29 Mar 2008, Paul wrote:

 > When I do a simple git-pull over SSH, why does it typically prompt me for my
 > SSH password two or three times? And no, I am not inputting it wrong.

 In some versions of git, it makes separate connections to find out what
 the remote's state is and to fetch the actual data. A third connection
 should only be needed if there are new tags to fetch, and that would be
 after some of the messages.

 One of the changes in the upcoming release is to reduce this to one,
 except for an occasional second one.

git.git's master branch seems to be hitting ssh twice fairly reliably...
[bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull
bd@130.111.246.25's password:
bd@130.111.246.25's password:
remote: Counting objects: 5, done.
remote: Compressing objects: 100% (2/2)remote: , done.
remote: Total 3 (delta 0), reused 0 (delta 0)
Unpacking objects: 100% (3/3), done.
From ssh+git://bd@130.111.246.25/home/bd/git-test
   b0b8450..57a92a7  master     -> origin/master
Updating b0b8450..57a92a7
Fast forward
 fob |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
[bd@shion git-test] ~/src/git/git --version
git version 1.5.5.rc2

The remote's still on 1.5.4.4 if it matters...

On Sun, 30 Mar 2008, Bryan Donlan wrote:

git.git's master branch seems to be hitting ssh twice fairly reliably...
[bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull
bd@130.111.246.25's password:
bd@130.111.246.25's password:
remote: Counting objects: 5, done.
remote: Compressing objects: 100% (2/2)remote: , done.
remote: Total 3 (delta 0), reused 0 (delta 0)
Unpacking objects: 100% (3/3), done.
From ssh+git://bd@130.111.246.25/home/bd/git-test
   b0b8450..57a92a7  master     -> origin/master
Updating b0b8450..57a92a7
Fast forward
 fob |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
[bd@shion git-test] ~/src/git/git --version
git version 1.5.5.rc2

The remote's still on 1.5.4.4 if it matters...

No, but ~/src/git/git-pull will run the installed git-fetch, not the 
locally built one, IIRC.

	-Daniel
*This .sig left intentionally blank*

On Sun, Mar 30, 2008 at 5:56 PM, Daniel Barkalow [off-list ref] wrote:

On Sun, 30 Mar 2008, Bryan Donlan wrote:

 > git.git's master branch seems to be hitting ssh twice fairly reliably...
 > [bd@shion git-test] SSH_AUTH_SOCK= ~/src/git/git-pull
 > bd@130.111.246.25's password:
 > bd@130.111.246.25's password:
 > remote: Counting objects: 5, done.
 > remote: Compressing objects: 100% (2/2)remote: , done.
 > remote: Total 3 (delta 0), reused 0 (delta 0)
 > Unpacking objects: 100% (3/3), done.
 > From ssh+git://bd@130.111.246.25/home/bd/git-test
 >    b0b8450..57a92a7  master     -> origin/master
 > Updating b0b8450..57a92a7
 > Fast forward
 >  fob |    1 +
 >  1 files changed, 1 insertions(+), 0 deletions(-)
 > [bd@shion git-test] ~/src/git/git --version
 > git version 1.5.5.rc2
 >
 > The remote's still on 1.5.4.4 if it matters...

 No, but ~/src/git/git-pull will run the installed git-fetch, not the
 locally built one, IIRC.

Ah, that would be it, thanks.