Cannot manage to configure SSH+key using putty

  • Hello!


    I've followed this guide in configuring SSH.


    I have generated lots of keys, some in puttygen and some in windows CLI, the pub and the private keys, none of pairs worked.


    The pub keys I export using commands given in the guide:
    ssh-keygen -e -f ~/.ssh/sshremote.pub
    where sshremote.pub is my generated key.


    I copy the output and put it in OMV web in users > edit > public key > add, and the keys follows the same pattern:


    ---- BEGIN SSH2 PUBLIC KEY ----
    Comment: "rsa-key-20191115"
    AAAAB3NzaC1yc2EAAAABJQAAAQEAxRmx+tAb6YqwVo9uYOdplmm775HHoNF3FPFx
    fig35x6biVaPLkrOlAntgm4BhkmJ4ilnv6yBPvtPU/3H50VuBTy9CT70Q0QnSUWJ
    ew7Io8YQS0xDMDS/aJu3uKP0rWY9f0lFPUO9D+AKsoqNwgvApQ7f3n6ZELxBza5d
    uf0d+SOhRi0UEaR+FlgfVNXCUHiacP9jsp9BqMbnsSLEwmsSMQmTcmhS0mZLUYxC
    FEFCU0u9WTHy2CHmRuRQIJJ5kwKZXj73grUJnJOnfOdJ2sCqc7SZL51zm3LHs2RV
    NfAE7NUQ2ZOXpI7xDTH6Aq60PBnL1DeuWAoZKbbVoxiHkYZ3aw==
    ---- END SSH2 PUBLIC KEY ----


    This one have been generated in putty, saved as public key and is copy to "user public key" in OMV Web.


    I have tried others keys generated in windows CLI and on linux on windows too.


    Then I try to open a connection using putty and the private key pair, and the same message "server refused our key" and fallback to password login if it is enabled.


    I tried with a fresh OMV install, new user, and the user is in ssh group. I can use it without PKA, with just password, but the problem with PKA persists for months and I never found how to solve it, so now I decided to post it here.


    I'm far from knowing linux and I try to not mess with system files or where the keys are stored, so I prefer to use only web interface and minimum work on system files.


    I made an album in imgur showing step-by-step how this happens, I couldnt post here because it shows "must be under 10k characters."


    https://imgur.com/a/2geIch7


    And if I try to use just password it works nicely.


    More info: OMV 4 and my PC is a Windows 10 machine. I did manage to get it working once, but had to reinstall OMV and never managed to make it work again

  • Thanks for helping, this is the output when trying to connect via debian on Windows:


    I'm on the keys folder so I dont put "~/.ssh/key"


    sh -vvv -i sshremote -p 5**** testingssh@myserver.**.**
    Output:
    OpenSSH_7.4p1 Debian-10+deb9u4, OpenSSL 1.0.2l 25 May 2017
    debug1: Reading configuration data /etc/ssh/ssh_config
    debug1: /etc/ssh/ssh_config line 19: Applying options for *
    debug2: resolving "myserver.**.**" port 5****
    debug2: ssh_connect_direct: needpriv 0
    debug1: Connecting to myserver.**.** [**.**.**.**] port 5****.
    debug1: Connection established.
    debug1: identity file sshremote type 1
    debug1: key_load_public: No such file or directory
    debug1: identity file sshremote-cert type -1
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u4
    debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4p1 Debian-10+deb9u7
    debug1: match: OpenSSH_7.4p1 Debian-10+deb9u7 pat OpenSSH* compat 0x04000000
    debug2: fd 3 setting O_NONBLOCK
    debug1: Authenticating to myserver.**.**:5**** as 'testingssh'
    debug3: put_host_port: [myserver.**.**]:5****
    debug3: hostkeys_foreach: reading file "/home/***/.ssh/known_hosts"
    debug3: record_hostkey: found key type ECDSA in file /home/***/.ssh/known_hosts:1
    debug3: load_hostkeys: loaded 1 keys from [myserver.**.**]:51****
    debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
    debug3: send packet: type 20
    debug1: SSH2_MSG_KEXINIT sent
    debug3: receive packet: type 20
    debug1: SSH2_MSG_KEXINIT received
    debug2: local client KEXINIT proposal
    debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
    debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
    debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
    debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    debug2: compression ctos: none,zlib@openssh.com,zlib
    debug2: compression stoc: none,zlib@openssh.com,zlib
    debug2: languages ctos:
    debug2: languages stoc:
    debug2: first_kex_follows 0
    debug2: reserved 0
    debug2: peer server KEXINIT proposal
    debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
    debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
    debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
    debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
    debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    debug2: compression ctos: none,zlib@openssh.com
    debug2: compression stoc: none,zlib@openssh.com
    debug2: languages ctos:
    debug2: languages stoc:
    debug2: first_kex_follows 0
    debug2: reserved 0
    debug1: kex: algorithm: curve25519-sha256
    debug1: kex: host key algorithm: ecdsa-sha2-nistp256
    debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
    debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
    debug3: send packet: type 30
    debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
    debug3: receive packet: type 31
    debug1: Server host key: ecdsa-sha2-nistp256 SHA256:4pFl8U/fhAtu4tmfGXkhQN4YDPktjIxG5Ih+sH9F9l0
    debug3: put_host_port: [1**.**.**]:5****
    debug3: put_host_port: [myserver.**.**]:5****
    debug3: hostkeys_foreach: reading file "/home/****/.ssh/known_hosts"
    debug3: record_hostkey: found key type ECDSA in file /home/****/.ssh/known_hosts:1
    debug3: load_hostkeys: loaded 1 keys from [myserver.**.**]:5****
    debug3: hostkeys_foreach: reading file "/home/****/.ssh/known_hosts"
    debug3: record_hostkey: found key type ECDSA in file /home/****/.ssh/known_hosts:2
    debug3: load_hostkeys: loaded 1 keys from [**.**.**.**]:5****
    debug1: Host '[myserver.**.**]:5****' is known and matches the ECDSA host key.
    debug1: Found key in /home/****/.ssh/known_hosts:1
    debug3: send packet: type 21
    debug2: set_newkeys: mode 1
    debug1: rekey after 134217728 blocks
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug3: receive packet: type 21
    debug1: SSH2_MSG_NEWKEYS received
    debug2: set_newkeys: mode 0
    debug1: rekey after 134217728 blocks
    debug2: key: sshremote (0x7fffe7ff2b10), explicit
    debug3: send packet: type 5
    debug3: receive packet: type 7
    debug1: SSH2_MSG_EXT_INFO received
    debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
    debug3: receive packet: type 6
    debug2: service_accept: ssh-userauth
    debug1: SSH2_MSG_SERVICE_ACCEPT received
    debug3: send packet: type 50
    debug3: receive packet: type 51
    debug1: Authentications that can continue: publickey
    debug3: start over, passed a different list publickey
    debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
    debug3: authmethod_lookup publickey
    debug3: remaining preferred: keyboard-interactive,password
    debug3: authmethod_is_enabled publickey
    debug1: Next authentication method: publickey
    debug1: Offering RSA public key: sshremote
    debug3: send_pubkey_test
    debug3: send packet: type 50
    debug2: we sent a publickey packet, wait for reply
    debug3: receive packet: type 51
    debug1: Authentications that can continue: publickey
    debug2: we did not send a packet, disable method
    debug1: No more authentication methods to try.
    Permission denied (publickey).

    • Offizieller Beitrag

    Is rejecting says is not matching. All i can think is omv not actually saving the keys
    This folder should have all the public keys by username


    /var/lib/openmediavault/ssh/authorized_keys


    You can check there and see if they match.


    Another option if your username has home folder is to use ssh-copy-id, but you need to have password auth enabled to be able to transfer the key

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!