0

I am trying to use PKI to connect to multiple VMWare vSphere guest OS, which have installed OpenSSH 5.6 over SSH2, using PuTTY and Pageant.
I've created the keys and and configured Putty but somehow no key exchange is happening (that I can see) when I try to connect to them. However, when I used the exact same process on a physical Xenial server, it worked flawlessly. I can log-in correctly using Passwords-based authentication, but not thru PKI.
Can someone tell me what I'm missing here?
Kind regards!

7
  • 1
    Not enough detail here to determine what the problem could be, and it looks to be a networking or configuration error, rather than an information security issue. For example, can you ping the virtual machines from the client you're running Putty on? Can you log in with a password? If you scan the machines, can you see port 22 listening?
    – Matthew
    Aug 18, 2017 at 14:27
  • Ok,thanks. I will edit my question's details. Yes I can ping, and yes I can log on with password authentication. The only problem is using Private-Public keys. OpenSSH config looks ok and putty certainly does work on other non-vSphere Hosts. Aug 21, 2017 at 12:28
  • (1) check ~/.ssh/authorized_keys (or other location if nonstandard config) on the 'bad' server exists, both dir and file owned by you and readable by 'user' (dir 5xx or 7xx, file usually 4xx or 6xx) and not writable by 'group' or 'other', and contains a line whose first two fields (or first two after options) match exactly the values displayed by puttygen (or the values in the good server's file) (2) look at server log at the time of a failed attempt (3) turn on PuTTY logging for 'SSH packets' before a connection attempt and look at that file, and if still unclear add it to your Q. Aug 21, 2017 at 14:29
  • PS: SSH public keys use Public Key Cryptography (PKC) but not Public Key Infrastructure (PKI) -- except kinda sorta OpenSSH's rarely used and very idiosyncratic certs, and those aren't supported by PuTTY at all. Aug 21, 2017 at 14:33
  • It seems that on the virtual host, sshd_config had RSAAuthentication set to NO, and the AuthorizedKeysFile was set to /etc/ssh/keys-%u/authorized_keys instead of the default %h/.ssh/authorized_keys. Who knows why. I'll adapt to that. Thanks for your input and insight @dave_thompson_085! Aug 21, 2017 at 15:26

1 Answer 1

1

- Why the problem:

OpenSSH Server builtin on ESXi, which is disabled by default, has a different configuration (/etc/ssh/sshd_config) than typical Linux/Ubuntu based OpenSSH. The major difference lies in the path of the accepted authorized keys:

- The configuration:

Typical Ubuntu (Xenial) OpenSSH config file:

#Authentication:
PermitRootLogin prohibit-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys

ESXi vSphere host OpenSSH config file:

# Authentication:
PermitRootLogin yes
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc
PasswordAuthentication no
RSAAuthentication yes
AuthorizedKeysFile /etc/ssh/keys-%u/authorized_keys

- The solution:

  • Move the authorized_keys file to /etc/ssh/keys-(user)/authorized_keys.

    OR:

  • Change the line in /etc/ssh/sshd_config which has AuthorizedKeysFile to point to the location of your authorized_keys file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .