2

I'm on Windows 10. Need to ssh into a Linux CentOS server. Trying both Putty and Windows SSH (turned on in Features.. Powershell?).

Using PuttyGen, I generated a private & public RSA key pair - rsa & rsa.pub , without any passphrase. Both files are on my desktop. server333 has an entry in C:\Users\johndoe.ssh\known_hosts. There are no other files or directories in that .ssh directory on my windows PC. The public key is also copied into the linux box's /home/johndoe/.ssh/authorized_keys

I tried ssh -i rsa -vvv server333, but it's not working. Here is the log:

c:\Users\johndoe\Desktop>ssh -i rsa -vvv server333
OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5
debug3: Failed to open file:C:/Users/johndoe/.ssh/config error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_config error:2
debug2: resolving "server333" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to server333 [1.2.3.4] port 22.
debug1: Connection established.
key_load_public: invalid format
debug1: identity file rsa type -1
debug3: Failed to open file:c:/Users/johndoe/Desktop/rsa-cert error:2
debug3: Failed to open file:c:/Users/johndoe/Desktop/rsa-cert.pub error:2
debug1: key_load_public: No such file or directory
debug1: identity file rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to server333:22 as 'corp\\johndoe'
debug3: hostkeys_foreach: reading file "C:\\Users\\johndoe/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from server333
debug3: Failed to open file:C:/Users/johndoe/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
debug2: MACs ctos: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
debug2: MACs stoc: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: rsa-sha2-512
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ssh-rsa SHA256:abcd
debug3: hostkeys_foreach: reading file "C:\\Users\\johndoe/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from server333
debug3: Failed to open file:C:/Users/johndoe/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug3: hostkeys_foreach: reading file "C:\\Users\\johndoe/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from 1.2.3.4
debug3: Failed to open file:C:/Users/johndoe/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug1: Host 'server333' is known and matches the RSA host key.
debug1: Found key in C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug3: unable to connect to pipe \\\\.\\pipe\\openssh-ssh-agent, error: 2
debug1: pubkey_prepare: ssh_get_authentication_socket: The socket is not connected
debug2: key: rsa (0000000000000000), explicit
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 53
debug3: input_userauth_banner
NOTICE TO USERS
=============================================================================
This is an official computer system and is the property of
ACME, Inc. It is for authorized users only. Unauthorized users are
prohibited. Users (authorized or unauthorized) have no explicit or
implicit expectation of privacy. Any or all uses of this system may be
subject to one or more of the following actions: interception,
monitoring, recording, auditing, inspection and disclosing to security
personnel and law enforcement personnel, as well as authorized officials
of other agencies, both domestic and foreign. By using this system, the
user consents to these actions. Unauthorized or improper use of this
system may result in administrative disciplinary action and civil and
criminal penalties. By accessing this system you indicate your awareness
of and consent to these terms and conditions of use. Discontinue access
immediately if you do not agree to the conditions stated in this notice.
=============================================================================
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: rsa
debug3: sign_and_send_pubkey: RSA SHA256:zyxw
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
debug3: failed to open file:c:/dev/tty error:3
debug1: read_passphrase: can't open /dev/tty: No such file or directory
corp\johndoe@server333's password:
d-_-b
  • 191
  • 2
  • 7
  • 1
    The format of the key files of putty and the OpenSSH client is not compatible. Depending on how you created the key you need to convert it to the format of the other tool. You can use PuttyGen to do this (it is shipped with PuTTY). – Gerald Schneider Dec 08 '20 at 08:19
  • @GeraldSchneider - I did generate both using puttygen only. – d-_-b Dec 08 '20 at 18:24

4 Answers4

1

It seems you not defined username on SSH host server.

you still can do this but you must define the user on SSH config file like :

vi ~/.ssh/config
...

Host server333
HostName your-server333-ip
User your-user
IdentityFile your-private-key

Then you can remote the server with :

ssh server333

Note: Make sure config file have 600 permission

YonzLeon
  • 311
  • 1
  • 6
0

The command you said you ran differs from the command you actually ran.

What you said you did:

ssh -i johndoe_privatekey -vvv server333

What you actually did:

ssh -i johndoe_privatekey.pub -vvv server333

Here we see ssh complaining that it can't find the key file you specified.

debug3: Failed to open file:C:/Users/johndoe/Desktop/johndoe_privatekey.pub.pub error:2
debug1: key_load_public: No such file or directory

Drop the .pub suffix from the command, make sure the keyfiles are actually present, and try again.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
  • No, it does that even if I add/drop .pub from the file extension.. it always appends a .pub to the file it looks for in the debug messages. I just tried a few different file extensions like .pub, .ppk and no extension. None worked. – d-_-b Dec 08 '20 at 18:30
  • @d-_-b Again, you need to provide the correct path to the real key file. – Michael Hampton Dec 08 '20 at 18:33
  • I already tried exactly that. The private key file is called johndoe_privatekey (no extension). I called ssh with -i johndoe_privatekey (no extension). Similar error. For e.g. If I add an extension 'file.ppk', the debug msg says 'cannot find file.ppk.pub' Windows ssh seems to automatically add .pub when looking for the file. – d-_-b Dec 08 '20 at 18:36
  • Where is the corresponding .pub file then? – Michael Hampton Dec 08 '20 at 18:39
  • You mean the public key ? It's copied on to the server authorized keys.. – d-_-b Dec 08 '20 at 18:40
  • Yes, but you should also have them both locally. – Michael Hampton Dec 08 '20 at 18:42
  • yes, i have it also locally in the same folder as the private key.. I tried renaming that also to johndoe_publickey & johndoe_publickey.pub. They're all on my desktop. Should I try moving them to a different config folder somewhere – d-_-b Dec 08 '20 at 18:49
  • I also tried naming the private/public files as files as key & key.pub, and the error message about missing .pub file went away, but other errors about missing cert still exist, and doesn't work – d-_-b Dec 08 '20 at 19:21
  • I edited the question for clarity, pls check – d-_-b Dec 08 '20 at 19:57
  • 1
    @d-_-b It seems your computer successfully presented the key, but the server rejected it. You should look at the logs on the server at this point. – Michael Hampton Dec 08 '20 at 20:02
  • fixed the issue - see my answer above – d-_-b Dec 09 '20 at 00:25
0

key_load_public: invalid format

Putty and PowerShell generate/use different key formats. With SSH all the stars gotta be in alignment and you're probably not using the correct key format due to inconsistencies between PowerShell and Putty. If you generated a key in Putty and uploaded the corresponding public key to the server you won't be able to log in via PowerShell since it expects a different key format.

I'd try regenerating the keys and starting over from scratch. Make sure you keep things consistent this time around. If you generated an RSA key with PowerShell then make sure you're uploading the corresponding RSA public key (also generated by PowerShell) to the server.

It may be easier to simply generate separate key pairs for both PowerShell and Putty. You would then need to upload both public keys (one for Putty, one for PowerShell) to your authorized_keys file on the server.

https://www.ssh.com/ssh/keygen/#choosing-an-algorithm-and-key-size

https://www.rfc-editor.org/rfc/rfc4716#:~:text=In%20order%20to%20implement%20public,bytes%20excluding%20line%20termination%20characters.

https://www.digitalocean.com/community/tutorials/understanding-the-ssh-encryption-and-connection-process

Community
  • 1
Justa Guy
  • 187
  • 4
0

Finally figured it out - There are 2 issues here:

  1. If you don't specify a username, Windows SSH defaults to DOMAIN\johndoe (which is obviously a windows username), whereas the linux server just expects johndoe. To fix this call ssh johndoe@server333 instead of, ssh server333 and then trying to enter username.

  2. It also requires the filenames to have restrictive permissions (only you, the owner, must have permissions, no one else should). To fix this, remove all other users from the file's security permissions

Once I did both, it worked like a charm. You don't need to put the public key in your local home/.ssh folder. You can just name your private key as id_rsa (without any extension), and place it in home/.ssh folder, and connect to server using ssh johndoe@server333

d-_-b
  • 191
  • 2
  • 7