Sign in

IS IT MY KEY, THE SERVER, OR WINDOWS TERMINAL? A PUBLICKEY MYSTERY

Solvedauthenticationlinuxssh14 replies 路 181 views 路 started
Reply

Accepted solution

by Rowan FontaineJump to the reply

been there man newer OpenSSH versions disable ssh-rsa signatures using SHA-1 by default. Very old clients or libraries (some older CI tools) may only offer that, sooo the server refuses. Prefer an ed25519 key, or upgrade the client.

  1. Lars N.
    @threadtrace-1t1

    CI just broke. The deploy step connects to the backup server and fails with:

    Nothing changed in the pipeline. The key is stored as a CI secret. This used to work last week, I promise.

    I suspect a recent client or server update changed something, but I have no idea what... the secret hasn't been touched in months, according to the audit log 馃敟 where would you start looking?

    facepalm

    24
  2. Hana Lopez
    @hana_stack

    Which user are you connecting as, and whose authorized_keys did teh key go into? ?

    5 0 helpful
  3. Soren
    @seriksen

    honestly just reset teh firmware and save yourself teh pain hope that helps :)

    6 6 helpful
  4. Lars N.
    @threadtrace-1t1
    in reply to @seriksen

    I was connecting as my own name, but the key was added to the default cloud user. sorry for the wall of text lol

    5 0 helpful
  5. Soren
    @seriksen

    been there man in CI, private keys pasted as secrets often lose the trailing newline or get CRLF line endings. Make sure the key file ends with a newline and has 600 permissions, or teh client silently skips it.

    5 1 helpful
  7. Chen Dalton
    @polar_monk

    watch the username, cloud images use default users like ubuntu, ec2-user, admin or debian. connecting as root or your own name with a key that's only in the default user's authorized_keys fails with exactly this error.

    3 0 helpful
  8. Soren
    @seriksen

    Check the srever log while you try to connect: sudo journalctl -u ssh -f (or -u sshd on RHEL family, /var/log/auth.log on older Debian/Ubuntu). it says exactly why: bad ownership, wrong user, key type not accepted.

    13 5 helpful
  9. Omar Weber
    @omarw436
    in reply to @seriksen

    ok so sshd is strict about permissions (StrictModes yes). on the server: chmod 700 ~/.ssh, chmod 600 ~/.ssh/authorized_keys, and teh home directory must not be group- or world-writable... ownership must be the user, not root. fingers crossed 馃

    0 2 helpful
  11. Cyrus L.
    @clund_40

    respectfully disagree, i tried that and it made windows worse

    6 0 helpful
  12. Soren
    @seriksen

    oof for me it was the DNS. swapped it and boom, fixed

    lol

    3 2 helpful
  13. Chen Dalton
    @polar_monk

    lol same thing happened to me honestly just reset the default config and save yourself teh pain, lol this thread is gold

    thumbsup

    1 4 helpful
  14. Rowan Fontaine
    @rowan_tiny
    Accepted solution

    been there man newer OpenSSH versions disable ssh-rsa signatures using SHA-1 by default. Very old clients or libraries (some older CI tools) may only offer that, sooo the server refuses. Prefer an ed25519 key, or upgrade the client.

    0 3 helpful
  15. Lars N.
    @threadtrace-1t1
    in reply to @rowan_tiny

    @rowan_tiny dude the CI secret was missing its final newline 馃槶 fixed it and the deploy step connects again. thx everyone! owe u a beer 馃嵑

    16 0 helpful
Read next 路 Defensive Security & Access Management
ad lockouts every time they open outlook, and nobody is typing the wrong password???
Solved 路 11 replies
Read

Reply to this topic

Sign in or create an account to reply.