Tired of Trial and Error: OpenSSH v3.8.1p1-1 on w2k server and XP Pro client

From: Allen (wqhurjgtzbsi_at_spammotel.com)
Date: 08/25/04

  • Next message: The other Thomas Gardner: "Public key authentication defeats passwd age warning." 
    Date: 25 Aug 2004 13:42:01 -0700

    I can't get public/private key system to work, but the password
    authentification does. I have installed OpenSSH v3.8.1p1-1 (OSSH) on
    both a win2k server box and XP Pro. I'm just trying to see a positive
    by using OpenSSH on both. I'd like to use WinSCP3 on the client. I
    found OSSH at sshwindows.sourceforge.net.

    I believe I've set everything up correctly. There are oddities running
    on Windows on the same domain. The biggest oddity is that the client's
    (My) home directory S: in this case is on the Domain Controller as
    configured in Active Directory. So when I generate my keys using OSSH
    on the client the default location that they're saved to is the
    S:\.ssh directory which is on the server. This the same directory that
    I place the authorized_keys file. Because they're on the another
    machine that doesn't have OSSH installed, I can't change the
    permission. So I copied the private key back to my machine and ran
    chmod and issued the command "ssh -i id_dsa" or "ssh -i id_rsa" (I
    currently have both public keys in my authorized_keys file).

    Keys were generated with "ssh-keygen -t dsa" and "ssh-keygen -t rsa"
    commands.

    D:\Program Files\OpenSSH\bin>ssh-keygen -t rsa -b 1024
    Generating public/private rsa key pair.
    Enter file in which to save the key (/cygdrive/s/.ssh/id_rsa):
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /cygdrive/s/.ssh/id_rsa.
    Your public key has been saved in /cygdrive/s/.ssh/id_rsa.pub.
    The key fingerprint is:
    7a:62:47:94:3b:24:ab:08:90:1a:6e:9f:d8:d9:d4:2c allenj@netadm

    Snip of authorized_keys file:
    ssh-dss AAAAB3NzaC1kc3MAA...mZMReAGkw== allenj@netadm
    ssh-rsa AAAAB3NzaC1yc2EAA...OlGec= allenj@netadm

    The dsa line is considerably longer and created with "type id_rsa.pub
    >>s:\.ssh\authorized_keys" command.

    Here's the debug messages from the server I received while trying dsa
    C:\Program Files\OpenSSH>usr\sbin\sshd -d -d -d
    debug2: read_server_config: filename /etc/sshd_config
    debug1: sshd version OpenSSH_3.8.1p1
    debug3: Not a RSA1 key file /etc/ssh_host_rsa_key.
    debug1: read PEM private key done: type RSA
    debug1: private host key: #0 type 1 RSA
    debug3: Not a RSA1 key file /etc/ssh_host_dsa_key.
    debug1: read PEM private key done: type DSA
    debug1: private host key: #1 type 2 DSA
    debug1: Bind to port 22 on 0.0.0.0.
    Server listening on 0.0.0.0 port 22.
    debug1: Server will not fork when running in debugging mode.
    Connection from 192.168.1.34 port 3245
    debug1: Client protocol version 2.0; client software version
    OpenSSH_3.8.1p1
    debug1: match: OpenSSH_3.8.1p1 pat OpenSSH*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1
    debug1: list_hostkey_types: ssh-rsa,ssh-dss
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug2: kex_parse_kexinit:
    diffie-hellman-group-exchange-sha1,diffie-hellman-gro
    up1-sha1
    debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: kex_parse_kexinit:
    diffie-hellman-group-exchange-sha1,diffie-hellman-gro
    up1-sha1
    debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: mac_init: found hmac-md5
    debug1: kex: client->server aes128-cbc hmac-md5 none
    debug2: mac_init: found hmac-md5
    debug1: kex: server->client aes128-cbc hmac-md5 none
    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
    debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
    debug2: dh_gen_key: priv key bits set: 119/256
    debug2: bits set: 527/1024
    debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
    debug2: bits set: 492/1024
    debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
    debug2: kex_derive_keys
    debug2: set_newkeys: mode 1
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug2: set_newkeys: mode 0
    debug1: SSH2_MSG_NEWKEYS received
    debug1: KEX done
    debug1: userauth-request for user AllenJ service ssh-connection method
    none
    debug1: attempt 0 failures 0
    debug2: input_userauth_request: setting up authctxt for AllenJ
    debug2: input_userauth_request: try method none
    debug1: userauth_banner: sent
    Failed none for AllenJ from 192.168.1.34 port 3245 ssh2
    debug1: userauth-request for user AllenJ service ssh-connection method
    publickey

    debug1: attempt 1 failures 1
    debug2: input_userauth_request: try method publickey
    debug1: temporarily_use_uid: 11620/10513 (e=400/401)
    debug1: trying public key file
    //parker-server/Ajester/.ssh/authorized_keys
    debug1: restore_uid: (unprivileged)
    debug1: temporarily_use_uid: 11620/10513 (e=400/401)
    debug1: trying public key file
    //parker-server/Ajester/.ssh/authorized_keys
    debug1: restore_uid: (unprivileged)
    debug2: userauth_pubkey: authenticated 0 pkalg ssh-dss
    Failed publickey for AllenJ from 192.168.1.34 port 3245 ssh2
    debug1: userauth-request for user AllenJ service ssh-connection method
    keyboard-
    interactive
    debug1: attempt 2 failures 2
    debug2: input_userauth_request: try method keyboard-interactive
    debug1: keyboard-interactive devs
    debug1: auth2_challenge: user=AllenJ devs=
    debug1: kbdint_alloc: devices ''
    debug2: auth2_challenge_start: devices
    Failed keyboard-interactive for AllenJ from 192.168.1.34 port 3245
    ssh2

    Here's the messages trying rsa:
    C:\Program Files\OpenSSH\usr\sbin>sshd -d -d -d
    debug2: read_server_config: filename /etc/sshd_config
    debug1: sshd version OpenSSH_3.8.1p1
    debug3: Not a RSA1 key file /etc/ssh_host_rsa_key.
    debug1: read PEM private key done: type RSA
    debug1: private host key: #0 type 1 RSA
    debug3: Not a RSA1 key file /etc/ssh_host_dsa_key.
    debug1: read PEM private key done: type DSA
    debug1: private host key: #1 type 2 DSA
    debug1: Bind to port 22 on 0.0.0.0.
    Server listening on 0.0.0.0 port 22.
    debug1: Server will not fork when running in debugging mode.
    Connection from 192.168.1.34 port 3787
    debug1: Client protocol version 2.0; client software version
    OpenSSH_3.8.1p1
    debug1: match: OpenSSH_3.8.1p1 pat OpenSSH*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1
    debug1: list_hostkey_types: ssh-rsa,ssh-dss
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug2: kex_parse_kexinit:
    diffie-hellman-group-exchange-sha1,diffie-hellman-gro
    up1-sha1
    debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: kex_parse_kexinit:
    diffie-hellman-group-exchange-sha1,diffie-hellman-gro
    up1-sha1
    debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
    aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-c
    tr
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit:
    hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@open
    ssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit: none,zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: mac_init: found hmac-md5
    debug1: kex: client->server aes128-cbc hmac-md5 none
    debug2: mac_init: found hmac-md5
    debug1: kex: server->client aes128-cbc hmac-md5 none
    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
    debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
    debug2: dh_gen_key: priv key bits set: 119/256
    debug2: bits set: 521/1024
    debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
    debug2: bits set: 505/1024
    debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
    debug2: kex_derive_keys
    debug2: set_newkeys: mode 1
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug2: set_newkeys: mode 0
    debug1: SSH2_MSG_NEWKEYS received
    debug1: KEX done
    debug1: userauth-request for user allenj service ssh-connection method
    none
    debug1: attempt 0 failures 0
    debug2: input_userauth_request: setting up authctxt for allenj
    debug2: input_userauth_request: try method none
    debug1: userauth_banner: sent
    Failed none for allenj from 192.168.1.34 port 3787 ssh2
    debug1: userauth-request for user allenj service ssh-connection method
    publickey

    debug1: attempt 1 failures 1
    debug2: input_userauth_request: try method publickey
    debug1: test whether pkalg/pkblob are acceptable
    debug1: temporarily_use_uid: 11620/10513 (e=400/401)
    debug1: trying public key file
    //parker-server/Ajester/.ssh/authorized_keys
    debug1: restore_uid: (unprivileged)
    debug1: temporarily_use_uid: 11620/10513 (e=400/401)
    debug1: trying public key file
    //parker-server/Ajester/.ssh/authorized_keys
    debug1: restore_uid: (unprivileged)
    debug2: userauth_pubkey: authenticated 0 pkalg ssh-rsa
    Failed publickey for allenj from 192.168.1.34 port 3787 ssh2
    debug1: userauth-request for user allenj service ssh-connection method
    keyboard-
    interactive
    debug1: attempt 2 failures 2
    debug2: input_userauth_request: try method keyboard-interactive
    debug1: keyboard-interactive devs
    debug1: auth2_challenge: user=allenj devs=
    debug1: kbdint_alloc: devices ''
    debug2: auth2_challenge_start: devices
    Failed keyboard-interactive for allenj from 192.168.1.34 port 3787
    ssh2

    The sshd_conf file is basically untouched, except for the setting
    strictmodes to no per the software's documentation and Uncommenting
    the PubkeyAuthentication and AuthorizedKeysFile lines.
    Here's the server's sshd_conf file(Some lines removed):
    # HostKey for protocol version 1
    #HostKey /etc/ssh/ssh_host_key
    # HostKeys for protocol version 2
    #HostKey /etc/ssh/ssh_host_rsa_key
    #HostKey /etc/ssh/ssh_host_dsa_key

    # Lifetime and size of ephemeral version 1 server key
    #KeyRegenerationInterval 1h
    #ServerKeyBits 768

    # Logging
    #obsoletes QuietMode and FascistLogging
    #SyslogFacility AUTH
    #LogLevel INFO

    # Authentication:

    #LoginGraceTime 2m
    PermitRootLogin yes

    # The following setting overrides permission checks on host key files
    # and directories. For security reasons set this to "yes" when running
    # NT/W2K, NTFS and CYGWIN=ntsec.
    StrictModes no

    RSAAuthentication no
    PubkeyAuthentication yes
    AuthorizedKeysFile .ssh/authorized_keys

    # For this to work you will also need host keys in
    /etc/ssh/ssh_known_hosts
    #RhostsRSAAuthentication no
    # similar for protocol version 2
    #HostbasedAuthentication no
    # Change to yes if you don't trust ~/.ssh/known_hosts for
    # RhostsRSAAuthentication and HostbasedAuthentication
    IgnoreUserKnownHosts yes
    # Don't read the user's ~/.rhosts and ~/.shosts files
    #IgnoreRhosts yes

    # To disable tunneled clear text passwords, change to no here!
    PasswordAuthentication yes
    #PermitEmptyPasswords no

    # Change to no to disable s/key passwords
    #ChallengeResponseAuthentication yes
    .
    .
    .
    # default banner path
    Banner /etc/banner.txt

    # override default of no subsystems
    Subsystem sftp /usr/sbin/sftp-server

    Dsa scp dialog (control-break'd out at passwd prompt):
    D:\Program Files\OpenSSH\tmp>del s:\.ssh\id_dsa

    D:\Program Files\OpenSSH\tmp>ls -l /cygdrive/s/.ssh
    total 2
    -rw-r--r-- 1 allenj mkpasswd 603 Aug 25 11:16
    authorized_keys

    D:\Program Files\OpenSSH\tmp>scp -i id_dsa -p id_dsa
    AllenJ@svr2k-test:.ssh/id_dsa

                                ****USAGE WARNING****
    .
    .
    .
    constitutes consent to monitoring for these purposes.

    Enter passphrase for key 'id_dsa':
    AllenJ@svr2k-test's password:
    id_dsa
                               100% 736 0.7KB/s 00:00

    D:\Program Files\OpenSSH\tmp>ls -l /cygdrive/s/.ssh
    total 3
    -rw-r--r-- 1 allenj mkpasswd 603 Aug 25 11:16
    authorized_keys
    -rw-r--r-- 1 allenj mkpasswd 736 Aug 25 11:16 id_dsa

    Here's another test of dsa with -v on the client:
    debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
    debug1: Host 'parker' is known and matches the RSA host key.
    debug1: Found key in /cygdrive/s/.ssh/known_hosts:1
    debug1: ssh_rsa_verify: signature correct
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug1: SSH2_MSG_NEWKEYS received
    debug1: SSH2_MSG_SERVICE_REQUEST sent
    debug1: SSH2_MSG_SERVICE_ACCEPT received

                                ****USAGE WARNING****
    .
    .
    .
    debug1: Authentications that can continue:
    publickey,password,keyboard-interactive
    debug1: Next authentication method: publickey
    debug1: Trying private key: id_dsa
    debug1: PEM_read_PrivateKey failed
    debug1: read PEM private key done: type <unknown>
    Enter passphrase for key 'id_dsa':
    debug1: read PEM private key done: type DSA
    debug1: Authentications that can continue:
    publickey,password,keyboard-interactive
    debug1: Next authentication method: keyboard-interactive
    debug1: Authentications that can continue:
    publickey,password,keyboard-interactive
    debug1: Next authentication method: password
    allenj@parker's password:

    rsa test dialog (control-break'd out at passwd prompt):
    D:\Program Files\OpenSSH\bin>ssh -v -i id_rsa parker
    OpenSSH_3.8.1p1, OpenSSL 0.9.7d 17 Mar 2004
    debug1: Reading configuration data /etc/ssh_config
    debug1: Connecting to parker [192.168.1.243] port 22.
    debug1: Connection established.
    debug1: identity file id_rsa type 1
    debug1: Remote protocol version 2.0, remote software version
    OpenSSH_3.8.1p1
    debug1: match: OpenSSH_3.8.1p1 pat OpenSSH*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug1: kex: server->client aes128-cbc hmac-md5 none
    debug1: kex: client->server aes128-cbc hmac-md5 none
    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
    debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
    debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
    debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
    debug1: Host 'parker' is known and matches the RSA host key.
    debug1: Found key in /cygdrive/s/.ssh/known_hosts:1
    debug1: ssh_rsa_verify: signature correct
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug1: SSH2_MSG_NEWKEYS received
    debug1: SSH2_MSG_SERVICE_REQUEST sent
    debug1: SSH2_MSG_SERVICE_ACCEPT received

                                ****USAGE WARNING****

    This is a private computer system. This computer system, including all
    .
    .
    .
    constitutes consent to monitoring for these purposes.

    debug1: Authentications that can continue:
    publickey,password,keyboard-interactive
    debug1: Next authentication method: publickey
    debug1: Offering public key: id_rsa
    debug1: Authentications that can continue:
    publickey,password,keyboard-interactive
    debug1: Next authentication method: keyboard-interactive
    debug1: Authentications that can continue:
    publickey,password,keyboard-interactive
    debug1: Next authentication method: password
    allenj@parker's password:

    Please help. I've included everything I can think of to get PK to
    work. At this point I'm only guessing. I know the logs made this a
    long post, but I hope it answers all questions.

    Thanks and God bless.

  • Next message: The other Thomas Gardner: "Public key authentication defeats passwd age warning."

    Relevant Pages

    • key auth ok one way, not the other
      ... I'm trying to get public key authentication working between two linux ... debug1: ... debug2: fd 3 setting O_NONBLOCK ... debug1: Next authentication method: publickey ...
      (comp.security.ssh)
    • Re: Trouble with OpenSSH 3.4p1 - Cant connect with an RSA key pair
      ... >> I have a computer functioning as a server using RedHat 8.0 with OpenSSH ... I am experiencing a similar problem using passkey authentication with the ... < debug2: bits set: 1604/3191 ... < debug1: Server accepts key: pkalg ssh-rsa blen 149 ...
      (comp.security.ssh)
    • Re: ssh client problem
      ... authentication method he does not want to use. ... >debug1: Connection established. ... >debug2: we did not send a packet, ... we sent a password packet, ...
      (comp.os.linux.misc)
    • Public key authentication doesnt work
      ... the remote .ssh/authorized_keys but still the public key authentication ... debug1: Connection established. ... debug2: fd 3 setting O_NONBLOCK ...
      (comp.security.ssh)
    • Re: Trouble with OpenSSH 3.4p1 - Cant connect with an RSA key pair
      ... >> I am experiencing a similar problem using passkey authentication with the ... debug1: Reading configuration data /etc/ssh/ssh_config ... debug3: key_read: missing keytype ... debug2: kex_parse_kexinit: none,zlib ...
      (comp.security.ssh)