RE: Publick key authentication problem



My experience with OpenSSH is limited to getting OpenSSH clients to work
with our commercial SSH server, so more experienced OpenSSH admins can
confirm or correct my thoughts here.

These lines from your attachment, ssh.log, look to me like your key file
has been converted to be compatible with ssh.com's commercial product:
debug2: key_type_from_name: unknown key type '-----BEGIN'
....
debug2: key_type_from_name: unknown key type '-----END'
But I believe you said that these same keys work on a different SSH
Server. Might that server be running the commercial SSH server from
ssh.com instead of OpenSSH? That would explain this key file working
there but not on this server.

You also do not have an identity file in your .ssh directory. This file
should have an entry that looks like "IDKey id_dsa". I can't explain
why your connection works to any server without this file.

Tom Pfister
UITS - Enterprise System Administration

-----Original Message-----
From: Frans Englich [mailto:frans.englich@xxxxxxxxx]
Sent: Friday, May 26, 2006 6:22 AM
To: secureshell@xxxxxxxxxxxxxxxxx
Subject: Publick key authentication problem


Hi everyone,

I have trouble connection to a server with ssh. I've tried solving this
before, but failed. I won't stop this time until this works.

These are the commands I execute:

--------------------------------
bash-2.05b$ exec ssh-agent bash
bash-2.05b$ export CVS_RSH=`which ssh`
bash-2.05b$ ssh-add
Enter passphrase for /home/frans/.ssh/id_dsa:
Identity added: /home/frans/.ssh/id_dsa (/home/frans/.ssh/id_dsa)
--------------------------------

Running `ssh-add -l' in the current shell gives:

--------------------------------
2048 2e:f5:49:d6:21:a0:50:83:1e:a4:fd:90:66:5a:f5:76
/home/frans/.ssh/id_dsa
(DSA)
--------------------------------

Now, running `ssh -vvv englich@HOSTNAME 2> ssh.log' gives "Permission
denied
(publickey)." The full output is attached, ssh.log.


This is how my .ssh/ directory looks:

--------------------------------
bash-2.05b$ ls -alFh .ssh/
total 30K
drwx------ 2 frans users 136 May 17 19:38 ./
drwx------ 81 frans users 5.0K May 26 10:00 ../
-rw------- 1 frans users 1.3K May 17 18:28 id_dsa
-rw-r--r-- 1 frans users 1.1K May 17 18:28 id_dsa.pub
-rw-r--r-- 1 frans users 15K May 26 09:49 known_hosts

--------------------------------

Before identifying any problems, you should know that I manage to
*commit*
with CVS over ssh to another server, so something with my ssh setup
seems to
be right.

In my .ssh/known_hosts file, the server I'm having trouble connecting to
has
"ssh-rsa", while my files are "DSA" -- could this have to do with it?
However, the server I can connect to is also "ssh-rsa", so that seems to
rule
it out.

What is wrong?

One might argue that my public key is corrupt on the server side, but I
sent
it as an email attachment(with the same MUA) in the same way to the
admins of
both servers.

I would really appreciate help on this, I've run out of ideas. Let me
know if
I can supply anymore info.


Cheers,

Frans



Relevant Pages

  • Re: two SSH compatibility scenarios: can it work?
    ... We are required to use SSH to log into the Engineering lab machines. ... > server software displays this header upon telnet connection to port 22. ... I still use Windows on my notebook for application compatibility. ... > running OpenSSH 3.4p1. ...
    (comp.security.ssh)
  • Re: SSH
    ... >> OpenSSH client, SSH server will report at least one or more implementation ... When using an SSH client to ...
    (comp.unix.solaris)
  • RE: ssh.com sshd 3.2.x, really enforcing sftp-only
    ... With plink/putty, this doesn't work, but with openssh it does (my tests ... ssh user@host cmd ... so locking down the permissions on the server itself should be ... involves making a "dummy" /etc/passwd file for cygwin programs to check. ...
    (SSH)
  • Re: Apache Software Foundation Server compromised, resecured. (fwd)
    ... this was one "result" of the comromised ssh binary at sourceforge. ... a public server of the Apache Software Foundation ... > (ASF) was illegally accessed by unknown crackers. ... > exhaustive audit of all Apache source code and binary distributions ...
    (FreeBSD-Security)
  • Re: FreeBSD Crash without Errors, Warnings, or Panics
    ... I suppose I could run on stable until the driver is fixed in a release branch, but I need this box up and online, and I've always read that the stable branch is not the place for production servers. ... I'm running 6.0-RELEASE-p5 on a Toshiba built server: dual Xeon Intel motherboard with a LSILogic MegaRAID controller. ... Also, some network ports still respond, like a telnet to port 22 to test SSH will yield an SSH banner, but trying to connect with SSH just hangs. ... The box runs a web-based app and connects to a local Postgres DB which seemed to be unable to start new connections being requested by the PHP scripts. ...
    (freebsd-hackers)