[Bug 4002] New: ssh-copy-id: -o IdentityFile causes duplicate-key probe to falsely skip installing keys

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4002

            Bug ID: 4002
           Summary: ssh-copy-id: -o IdentityFile causes duplicate-key
                    probe to falsely skip installing keys
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh-copy-id
          Assignee: unassigned-bugs at mindrot.org
          Reporter: w.paszajew at gmail.com

Created attachment 3986
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3986&action=edit
Filter out -o IdentityFile during duplicate key probe

When attempting to install a new key on a remote host using an existing
key for authentication:

  ssh-copy-id -i ~/.ssh/new_key.pub -o IdentityFile=~/.ssh/old_key
user at host

The script incorrectly aborts with:
  "WARNING: All keys were skipped because they already exist on the
remote system."
and the new key is never installed.

Root cause:
In filter_ids(), ssh-copy-id probes whether the key is already
authorized:
  ssh -i "$PRIV_ID_FILE" -o PreferredAuthentications=publickey -o
IdentitiesOnly=yes "$@" exit

While IdentitiesOnly=yes prevents ssh from querying ssh-agent, per
ssh_config(5) it still honors any explicit IdentityFile passed in "$@".
Because ssh treats IdentityFile as additive, the probe successfully
authenticates using the old key from -o IdentityFile=~/.ssh/old_key,
exits 0, and filter_ids() falsely concludes the new key is already
installed.

The attached patch fixes this by:
1. Parsing and excluding -o IdentityFile options (case-insensitive,
supporting both '=' and space syntax) from the filter probe
($SSH_FILTER_OPTS) and final login recommendation.
2. Preserving SUGGEST_PRIV_ID_FILE when -f (force) is used so the final
hint doesn't leave a trailing "-i ".
3. Correctly placing the login hint command construction outside the
heredoc block.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.