ssh certificate authentication fails #153
Comments
|
Is it a PKCS8 format key file? Look at https://github.com/hierynomus/sshj/blob/master/src/main/java/net/schmizz/sshj/userauth/keyprovider/PKCS8KeyFile.java and associated test, and try load your data in the test, that would be a good first step. |
|
Thank you for looking into this! Otherwise - way over my head... I don't think it's a PKCS8 format key file issue, but I did as you suggested: the type test passes, the keys test fails (I pushed my tests into this repo). I believe this to be a certificate authentication issue, because for openssh to succeed (i.e. to log in or run a remote command without a password) it has to have two files in ~/.ssh: Please do let me know if there is anything else I can do to help in troubleshooting this... |
|
Could you also provide a sample certificate, or provide the commandline to build one with? |
|
Will try. I am just a user (given a key and a certificate; will try to hunt down those in the know). |
|
For reference we are tracking issue #8371 that sounds similar. |
|
@dkocher Sounds pretty similar indeed... From what I gather in that issue, you also have no key/certificate yet to reproduce this? |
|
@hierynomus No, unfortunately not. |
|
@hierynomus To clarify: I do of course have a key and a certificate, but, unfortunately, can't share... |
|
@WellRedPandit I got that 😉. But I would like to get my hands on a sample certificate that shows this behaviour so that we can fix it. Or the |
|
Got it. Will do my best. Our sysadmins are not very talkative :-( |
|
@WellRedPandit Could you give me the header of both files? I mean the part between the dashes if you view the contents. From that I might already be able to deduce a lot on what's going wrong. |
|
@hierynomus Did ask. Lightning fast response: "Under no circumstances!!!" - sorry... |
|
The header of both files contains no private data, it merely indicates what kind of key it is, i.e.: |
|
This is what I see: ...-v2-key starts with: ...-v2-key-cert.pub starts with: |
|
Ok, thx! Now I can finally find some stuff online using that string. You're using this method: http://blog.habets.pp.se/2011/07/OpenSSH-certificates I need to look into that. It's pretty OpenSSH specific I think. |
|
Thanks for the link! Regrettable though... I hoped it was something more widespread and would be appreciated by many when added to your library... Anyway, if you do decide to give it a go, I'd be happy to test or otherwise help... |
|
Hey @hierynomus — wondering if you were doing any research into this matter. This is indeed an OpenSSH-specific feature, but amazingly powerful for any kind of secure automation. I did not see any certificate-based authentication methods in sshj code, what are your thoughts on adding this? |
|
Currently not doing any specific research into adding it. Though it should definitely be possible to add. |
|
Hello @hierynomus , I am facing issue while authenticate using Key file below is my code and stack trace of error. please help me out or tell me What am I coding wrongly with sshj? Using below maven dependancy <dependency>
<groupId>com.hierynomus</groupId>
<artifactId>sshj</artifactId>
<version>0.15.0</version>
</dependency>CODE package com.infiverve.flint.ssh2;
import net.schmizz.sshj.DefaultConfig;
import net.schmizz.sshj.SSHClient;
import net.schmizz.sshj.common.IOUtils;
import net.schmizz.sshj.connection.channel.direct.Session;
import net.schmizz.sshj.connection.channel.direct.Session.Command;
import net.schmizz.sshj.transport.verification.PromiscuousVerifier;
import net.schmizz.sshj.userauth.keyprovider.KeyProvider;
import java.io.IOException;
/** This examples demonstrates how a remote command can be executed. */
public class Test{
public static void main(String... args)
throws IOException {
Session session = null;
SSHClient sshClient = null;
try {
DefaultConfig defaultConfig = new DefaultConfig();
sshClient = new SSHClient(defaultConfig);
sshClient.addHostKeyVerifier(new PromiscuousVerifier());
sshClient.connect("ec2-xx.xx.xx.xx.compute-1.amazonaws.com", 22);
sshClient.setConnectTimeout(60000);
sshClient.setTimeout(60000);
KeyProvider loadKeys;
loadKeys = sshClient.loadKeys("/home/pratap/flintcloud-test.pem");
sshClient.authPublickey("ubuntu",loadKeys);
session = sshClient.startSession();
final Command cmd = session.exec("pwd");
String result = IOUtils.readFully(cmd.getInputStream()).toString();
System.out.println("RESULT "+result);
session.close();
} finally {
sshClient.disconnect();
session.close();
}
}
}and stack trace of above code it is |
|
Hi @Pratappatil1992, I actually don't know, the code looks fine. It's weird that it complains that it cannot find a provider for the PKCS8 key file, as that provider should be loaded for the |
|
Hello @hierynomus , Thanks for your respond, yes you are right the code snippet and stack-trace are different but I am using same code from where that stack-trace come and I also instantiating with the DefaultConfig in my real code. |
|
@Pratappatil1992 Could you create a unit test using the SshFixture and a sample key file that exhibits the same behaviour. Then I'd be happy to fix it :) |
|
Okay @hierynomus , I will create unit test using SshFixture and let you know about it as soon as possible.. |
|
We see sometimes the "Exhausted available authentication methods" exception when working with OpenStack through JClouds library. I've reported a new JClouds issue with more details in it: https://issues.apache.org/jira/browse/JCLOUDS-1103 |
|
testing something similar to this, just that mine requires a password but just says "Exhausted available authentication methods" |
#319) * Add support for authentication with DSA & RSA user certificates (#153) Updates: - KeyType.java - add support for two certificate key types [email protected] [email protected] - Buffer.java - allow uint64s that overflow Long.MAX_VALUE, otherwise we break on certificates with serial numbers greater Long.MAX_VALUE - OpenSSHKeyFile, KeyProviderUtil - prefer public key files that end "-cert.pub" if they exist Added new class Certificate, which represents certificate key Reference: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD * Use BigInteger for certificate serial numbers, address Codacy issues * Address code review concerns
|
SHould be fixed with the merge of #319 |
sshj fails where openssh succeeds without a password using two files
private-keyandprivate-key-cert.pub. What am I coding wrongly with sshj?(if sshj does not support certificate authentication, am willing to contribute, if pointed in the right direction...)
Test
Scala REPL
OpenSSH
The text was updated successfully, but these errors were encountered: