mjhjmtu

I'm trying to download a file from a Centos 6 server using another Centos 6 server as client and curl with the scp protocol and I'm getting this error output:

$ curl -v -O scp://cz/path/to/file
* About to connect() to cz port 22 (#0)
* Trying 1.2.3.4... connected
* Connected to cz (1.2.3.4) port 22 (#0)
* Failed to read known hosts from /home/cpn/.ssh/known_hosts
* SSH host check: 0, key: AAAAB3NzaC1yc2EAAAABIwAAAQEAyeeDgYFsHi3Ks3PxCXt69IHBr7yNII720sXOm9WKIdGnwPf7QHbLsMf41mctcGRSJ2yO2EXpNEbZQhdUqs3oImdTn2OHF/K8STK1GXMVseusgmPuQWBt36AVPon7h9lSCjtxt+1UpFJoireXvhUDlgg9i1C9QbE04GAmA7vMOmtcVt3/3F6X/hKhOZvHj1gu5+RzCO8fXo2R8XeRoN0GcU2jVOhug0G+hXAiHymh5JzVm4YlCzsNIv3mDOF2lZRLdkor5FDKjBY8/o/5O8U0lWm4ie2S7qDppqCJP2SnNTWlaM3k5HDmdyEKKZ0lV+qG33q3ADZxjBeIKQtWLZfC3w==
* SSH authentication methods available: publickey,gssapi-keyex,gssapi-with-mic,password
* Using ssh public key file /home/cpn/.ssh/id_dsa.pub
* Using ssh private key file /home/cpn/.ssh/id_dsa
* SSH public key authentication failed: Username/PublicKey combination invalid
* Authentication failure
* Closing connection #0

I can download the file using scp no questions asked:

$ scp cz:/path/to/file .

I can log in to the server with ssh again no questions asked

$ ssh cz

There are both ssh-rsa and ssh-dss keys at the server's authorized_keys file

What is exactly curl complaining about? My only guess is that curl wants a dsa key in the client's known_hosts file. If that is the case how to generate it? Or how to make curl look for the rsa key instead in that file?

Update

At the client:

$ ls -l /home/cpn/.ssh/known_hosts
-rw-r--r--. 1 cpn cpn 1970 Nov 12 16:12 /home/cpn/.ssh/known_hosts

I can at least explain what's probably going on: the . after the permissions in the output of ls -l indicates the presence of an SELinux policy, which overrides file permissions based on which program is accessing the file. Use ls -Z ~/.ssh/known_hosts to display the file's policy.

Presumably /usr/bin/ssh and its companion programs (ssh-keygen, scp, etc.) are the only programs who are allowed to access that file. I'm skeptical about this policy: it is useful to edit ~/.ssh/known_hosts manually sometimes. However I don't understand why curl would want to read that file instead of letting ssh and friends do it.

You can use the chcon command to edit the policy for that file, and restorecon to restore the default policy. See the CentOS wiki for more information about SELinux.

For people who find this page via google:

It looks like old versions of cURL choke on known_hosts files with unrecognized keytypes, and sufficiently old versions of cURL don't recognize any keytype but ssh-rsa.

For example, my cURL is version 7.29.0 (6 years old, and the latest available in CentOS 7 as of this writing), and will cease reading keys after the first ecdsa-sha2-nistp256, which is the majority of the keys in my known_hosts file.