3

I'm trying to be organized with my work with servers and so with ssh keys but it seems to be impossible. So I'm thinking to move from Pageant to Serveauditor which is used by the CERN too. But before that I would like to understand what's wrong with the system.

So basically I manage 30-40 Linux host/guest and as I don't want contamination of any piracy stuff with one another, I'm using one different key/host or guest with a different passphrase of course.

So I wanted to use Pageant to work with all that (I'm connecting with Windows to those hosts/guests) but apparently I can't. So how Pageant does work? Is it offering all the keys at once to the server or iteratively and the server has to test every one of them? Is this some kind of basic protection of SSH server? Because if the good key isn't in the 5 first one apparently I have the error message "Too many authentication failures". I don't think it's the fail2ban protection since I've stop it to test it.

Apparently also, If I'm using more than 5 DSA keys (which as I read it were more strong than RSA keys but it seems that PuTTY dev team don't agree with it) Pageant doesn't respond to PuTTY anymore, and it's the same than if I'm using more than 1 DSA key with several RSA keys.

So have I to conclude that pageant can't manage more than 5 or 6 hosts and if I need to do more, I need to assign each keys to the specific hosts in the PuTTY list or with another application like Serveauditor?

Best regards

Improve this question
1
  • PuTTY is fine with DSA, but OpenSSH (which is the server on Linux) 7.0 and up by default disables DSA (called DSS in SSH) see openssh.com/txt/release-7.0 PS: DSA is not stronger than RSA of the same size if both are properly implemented, and it is somewhat easier to mess up the implementation of DSA, which may be part of the reason the OpenSSH people decided as they did.
    – dave_thompson_085
    Feb 22, 2017 at 19:58

1 Answer 1

Reset to default
3

PuTTY tries the keys retrieved from Pageant one by one, until it succeeds.

If you want PuTTY to try one specific key only, select it in the Private key file for authentication.

If the same key is already loaded in Pageant, PuTTY will retrieve it from Pageant (so it won't ask you for a passphrase).

Quoting PuTTY documentation:

You can use the authentication agent Pageant so that you do not need to explicitly configure a key here; see chapter 9. If a file is specified here with Pageant running, PuTTY will first try asking Pageant to authenticate with that key, and ignore any other keys Pageant may have. If that fails, PuTTY will ask for a passphrase as normal.

Also note that there's generally nothing wrong about using the same key for multiple servers.
See What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .