I am trying to use PKI to connect to multiple VMWare vSphere guest OS, which have installed OpenSSH 5.6 over SSH2, using PuTTY and Pageant.
I've created the keys and and configured Putty but somehow no key exchange is happening (that I can see) when I try to connect to them. However, when I used the exact same process on a physical Xenial server, it worked flawlessly. I can log-in correctly using Passwords-based authentication, but not thru PKI.
Can someone tell me what I'm missing here?
Kind regards!
1 Answer
- Why the problem:
OpenSSH Server builtin on ESXi, which is disabled by default, has a different configuration (/etc/ssh/sshd_config) than typical Linux/Ubuntu based OpenSSH. The major difference lies in the path of the accepted authorized keys:
- The configuration:
Typical Ubuntu (Xenial) OpenSSH config file:
#Authentication:
PermitRootLogin prohibit-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys
ESXi vSphere host OpenSSH config file:
# Authentication:
PermitRootLogin yes
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc
PasswordAuthentication no
RSAAuthentication yes
AuthorizedKeysFile /etc/ssh/keys-%u/authorized_keys
- The solution:
Move the authorized_keys file to /etc/ssh/keys-(user)/authorized_keys.
OR:
Change the line in /etc/ssh/sshd_config which has AuthorizedKeysFile to point to the location of your authorized_keys file.
~/.ssh/authorized_keys
(or other location if nonstandard config) on the 'bad' server exists, both dir and file owned by you and readable by 'user' (dir 5xx or 7xx, file usually 4xx or 6xx) and not writable by 'group' or 'other', and contains a line whose first two fields (or first two after options) match exactly the values displayed by puttygen (or the values in the good server's file) (2) look at server log at the time of a failed attempt (3) turn on PuTTY logging for 'SSH packets' before a connection attempt and look at that file, and if still unclear add it to your Q./etc/ssh/keys-%u/authorized_keys
instead of the default%h/.ssh/authorized_keys
. Who knows why. I'll adapt to that. Thanks for your input and insight @dave_thompson_085!