LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
Reload this Page OpenSSH: selecting identity file doesn't work
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 11-03-2014, 05:36 PM   #1
Bob Page
LQ Newbie
 
Registered: Nov 2014
Posts: 3

Rep: Reputation: Disabled
OpenSSH: selecting identity file doesn't work

Greetings everyone.

I'm trying to get openssh client to send only specific private keys to server using -i option, but it doesn't seem to be working, because it still sends all keys it can find in .ssh directory:

Code:
ssh -vvvv -i .ssh/my_key admin@x.x.x.x
OpenSSH_5.9p1 Debian-5ubuntu1.4, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to x.x.x.x [x.x.x.x] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load ".ssh/my_key" as a RSA1 public key
debug1: identity file .ssh/my_key type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: identity file .ssh/my_key-cert type -1
debug1: Remote protocol version 2.0, remote software version WeOnlyDo 2.1.3
debug1: no match: WeOnlyDo 2.1.3
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.4
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "x.x.x.x" from file "/home/beckett/.ssh/known_hosts"
debug3: load_hostkeys: found key type DSA in file /home/beckett/.ssh/known_hosts:80
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-dss,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-dss
debug2: kex_parse_kexinit: 3des-cbc
debug2: kex_parse_kexinit: 3des-cbc
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,none
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,none
debug2: kex_parse_kexinit: zlib,none
debug2: kex_parse_kexinit: zlib,none
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client 3des-cbc hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server 3des-cbc hmac-md5 none
debug2: dh_gen_key: priv key bits set: 201/384
debug2: bits set: 1036/2048
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Server host key: DSA 6a:59:1c:82:f5:4c:3f:e1:d9:70:a1:42:88:f0:a6:05
debug3: load_hostkeys: loading entries for host "x.x.x.x" from file "/home/beckett/.ssh/known_hosts"
debug3: load_hostkeys: found key type DSA in file /home/beckett/.ssh/known_hosts:80
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'x.x.x.x' is known and matches the DSA host key.
debug1: Found key in /home/beckett/.ssh/known_hosts:80
debug2: bits set: 1004/2048
debug1: ssh_dss_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: .ssh/my_key (0x7fe0b965fdb0)
debug2: key: mandrake@mandrake-MS-7680 (0x7fe0b9660750)
debug2: key: beckett@Beckett-PC (0x7fe0b96610d0)
debug2: key: mandrake@mandrake-MS-7680 (0x7fe0b9661350)
debug2: key: mandrake@mandrake-MS-7680 (0x7fe0b9665ad0)
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering DSA public key: .ssh/my_key
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-dss blen 434
debug2: input_userauth_pk_ok: fp 51:89:f1:d7:58:b8:03:dc:8a:bc:01:62:57:ba:ab:4d
debug3: sign_and_send_pubkey: DSA 51:89:f1:d7:58:b8:03:dc:8a:bc:01:62:57:ba:ab:4d
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: mandrake@mandrake-MS-7680
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 6f:8c:bd:79:f5:55:f9:25:9b:27:a8:37:e8:e4:60:18
debug3: sign_and_send_pubkey: RSA 6f:8c:bd:79:f5:55:f9:25:9b:27:a8:37:e8:e4:60:18
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: beckett@Beckett-PC
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 58:4b:b2:28:19:09:a5:a6:c1:d7:e7:68:ad:76:c1:58
debug3: sign_and_send_pubkey: RSA 58:4b:b2:28:19:09:a5:a6:c1:d7:e7:68:ad:76:c1:58
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: mandrake@mandrake-MS-7680
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp a8:59:38:1c:45:b7:36:ed:22:3e:6b:ea:66:48:2c:29
debug3: sign_and_send_pubkey: RSA a8:59:38:1c:45:b7:36:ed:22:3e:6b:ea:66:48:2c:29
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: mandrake@mandrake-MS-7680
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp b2:fa:96:32:ae:e3:31:21:1f:7b:e7:2a:1e:59:6c:5e
debug3: sign_and_send_pubkey: RSA b2:fa:96:32:ae:e3:31:21:1f:7b:e7:2a:1e:59:6c:5e
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
Could anyone, please, clarify this for me?
 
Old 11-03-2014, 07:02 PM   #2
evo2
LQ Guru
 
Registered: Jan 2009
Location: Japan
Distribution: Mostly Debian and CentOS
Posts: 6,724

Rep: Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705
Hi,

ssh seems to be trying to load your type 2 key as a type 1 key. Do you have an option in your /etc/ssh/ssh_config that only enables type 1? Eg
Code:
Protocol 1
Evo2.
 
Old 11-03-2014, 07:15 PM   #3
Bob Page
LQ Newbie
 
Registered: Nov 2014
Posts: 3

Original Poster
Rep: Reputation: Disabled
Thanks for the quick reply, evo2. I specified Protocol 2 explicitly, but with no results. That's what else concerns me:

Code:
Could not load ".ssh/my_key" as a RSA1 public key
The key was generated by
Code:
ssh-keygen -t dsa
command. The server I'm trying to connect to is FreeSSHd running on Windows Server 2008 R2, if that bears any importance.
 
Old 11-03-2014, 07:29 PM   #4
evo2
LQ Guru
 
Registered: Jan 2009
Location: Japan
Distribution: Mostly Debian and CentOS
Posts: 6,724

Rep: Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705Reputation: 1705
Hi,
Quote:
Originally Posted by Bob Page View Post
Thanks for the quick reply, evo2. I specified Protocol 2 explicitly, but with no results.
Can you post the command and the output?
Quote:
That's what else concerns me:

Code:
Could not load ".ssh/my_key" as a RSA1 public key
Yes, your client seems to be treating this as RSA version 1 protocol. Did you check your ssh_config as I suggested?

Quote:
The key was generated by
Code:
ssh-keygen -t dsa
command.
Really DSA? Not RSA?
Quote:
The server I'm trying to connect to is FreeSSHd running on Windows Server 2008 R2, if that bears any importance.
I'm not familiar with FreeSSHd. Can you check its logs?

Evo2.
 
Old 11-03-2014, 08:28 PM   #5
Bob Page
LQ Newbie
 
Registered: Nov 2014
Posts: 3

Original Poster
Rep: Reputation: Disabled
I regenerated both private and public keys to be sure, cleared ssh-agent's key database, leaving only one key beside the one I'm using here, placed public one on the server, changed login to Administrator, and named it exactly as the login name (FreeSSHd's reqirement).
Quote:
Can you post the command and the output?
Here it is:
Code:
beckett@Beckett-PC ~ $ ssh -vvvv -i .ssh/my_key -o Protocol=2 Administrator@x.x.x.x
OpenSSH_5.9p1 Debian-5ubuntu1.4, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to x.x.x.x [x.x.x.x] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load ".ssh/my_key" as a RSA1 public key
debug1: identity file .ssh/my_key type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: identity file .ssh/my_key-cert type -1
debug1: Remote protocol version 2.0, remote software version WeOnlyDo 2.1.3
debug1: no match: WeOnlyDo 2.1.3
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.4
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "x.x.x.x" from file "/home/beckett/.ssh/known_hosts"
debug3: load_hostkeys: found key type DSA in file /home/beckett/.ssh/known_hosts:80
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-dss,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,none
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,none
debug2: kex_parse_kexinit: zlib,none
debug2: kex_parse_kexinit: zlib,none
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug2: dh_gen_key: priv key bits set: 123/256
debug2: bits set: 990/2048
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Server host key: DSA 6a:59:1c:82:f5:4c:3f:e1:d9:70:a1:42:88:f0:a6:05
debug3: load_hostkeys: loading entries for host "x.x.x.x" from file "/home/beckett/.ssh/known_hosts"
debug3: load_hostkeys: found key type DSA in file /home/beckett/.ssh/known_hosts:80
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'x.x.x.x' is known and matches the DSA host key.
debug1: Found key in /home/beckett/.ssh/known_hosts:80
debug2: bits set: 990/2048
debug1: ssh_dss_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: .ssh/my_key (0x7fa3d5c44e20)
debug2: key: beckett@Beckett-PC (0x7fa3d5c45030)
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering DSA public key: .ssh/my_key
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-dss blen 434
debug2: input_userauth_pk_ok: fp 83:a9:ba:33:91:43:d8:40:6a:c3:12:be:c8:c0:58:59
debug3: sign_and_send_pubkey: DSA 83:a9:ba:33:91:43:d8:40:6a:c3:12:be:c8:c0:58:59
debug1: Authentications that can continue: publickey
debug1: Offering DSA public key: beckett@Beckett-PC
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-dss blen 434
debug2: input_userauth_pk_ok: fp 83:a9:ba:33:91:43:d8:40:6a:c3:12:be:c8:c0:58:59
debug3: sign_and_send_pubkey: DSA 83:a9:ba:33:91:43:d8:40:6a:c3:12:be:c8:c0:58:59
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
Quote:
Yes, your client seems to be treating this as RSA version 1 protocol. Did you check your ssh_config as I suggested?
Yes, I looked into ssh_config and specified Protocol 2, but with no effect. Then I specified it on the command line with -o, but it didn't help either. After that, I googled a bit and folks say that there's nothing wrong with this, since my key is of DSA type, which makes sense if you look at these lines:
Quote:
debug1: identity file .ssh/my_key type 2
...
debug1: Offering DSA public key: .ssh/my_key
which clearly indicates that SSH recognized the key's type as DSA.

Quote:
Really DSA? Not RSA?
Yes, I regenerated keys to be sure, as I said before, although not so long ago I switched to DSA only for enhanced security, so I couldn't make a mistake here.

Quote:
I'm not familiar with FreeSSHd. Can you check its logs?
It's one of the few SSH implementations for Windows - its benefit is that it's quite easy to setup. According to blogs, anyway. The logs aren't very informative:
Code:
11-04-2014 05-46-35 SSH server stopped.
11-04-2014 05-46-37 SSH server started.
Last edited by Bob Page; 11-04-2014 at 04:05 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] openssh-server doesn't check into "authorized_keys" file ClemSF Debian 11 07-24-2010 08:52 PM
KMail: Identity doesn't match my email address. stf92 Linux - Software 6 04-05-2010 05:23 PM
[SOLVED] After OpenSSH upgrade to 5.4 key doesn't work pauldango Slackware 1 03-16-2010 05:08 AM
Why doesn't the .bin file work? Charlsy Linux - Software 1 06-30-2004 03:08 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 12:32 AM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration