MultiNet 5.1 public key authentication fails on PuTTY, SecureCRT
- From: "Tom Garcia" <tgarcia-REMOVE-THIS@xxxxxxxxxxxx>
- Date: Wed, 18 Oct 2006 23:44:34 +0100
Hello,
I can't get public key authentication working with certain clients on
MultiNet 5.1's ssh server under OpenVMS 8.3, Alpha DS10L, very new install.
All severity 0,1,2 MultiNet patches to date have been applied.
What doesn't work:
PuTTY 0.58 and VanDyke SecureCRT 5.2.0 clients - logs suggest the key has
been accepted as appropriate for login (to SYSTEM), but signature
verification fails. 1024 bit RSA and DSA keys.
What does work:
- Using the failed key pair below, with the public key converted to OpenSSH
form, to connect from the PuTTY client to an OpenSSH 4.2p1 Linux server. So
a single key pair may succeed or fail depending on the client used.
- Creating a new key pair under OpenSSH 4.2p1 on Linux, converting to
ssh.com form, and using the Linux OpenSSH client to connect to the MultiNet
server using public key authentication.
- Creating a new key pair using the MultiNet SSH client and using it to log
in to localhost using public key authentication.
Enclosed examples:
- two failed login outputs;
- one SSHD.LOG extract, and one PuTTY log;
- the private and public keys for the PuTTY attempt with 1024-bit RSA keys.
Thoughts:
- Am I missing some option for the signature mechanism used by the client?
- Does SSH use some of the security stuff built in to the latest VMS
releases that I haven't initialised properly?
---o<--- sample login session on SecureCRT ---o<---
Welcome to OpenVMS (TM) Alpha Operating System, Version V8.3
*** dialog then appears ***
"The server recognized your public key, capi::my, but none of the known
signature mechanisms were accepted. This normally means that the server you
are connecting to does not comply with any of the supported standards. If
you are connecting to a 2.0.12 server (either the non-commercial or the
F-Secure version), public key authentication is not supported."
---o<--- SSHD.LOG ---o<---
With "debug 5", an extract of the failed attempt from VanDyke SecureCRT
using DSA, starting about a screenful after: "Key check finalized. Key is
accepted." The "user cancellation" follows the clicking of "Cancel" on the
dialog above.
(21:00:28)Sshd2/SSHD2.C;3:1296: Adding group: system, 0.?
(21:00:28)Sshd2/SSHD2.C;3:1670: output: publickey,password
(21:00:28)SshUnxixFdStream/SSHUNIXFDSTREAM.C;3:417: writing 1080 bytes
(21:00:28)SshUnxixFdStream/SSHUNIXFDSTREAM.C;3:417: writing 1088 bytes
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1464: Public key algorithm
is ssh-rsa
(21:00:28)SshConfig/SSHCONFIG.C;2:3327: Configuration file
`SYS$SYSROOT:[SYSMGR.SSH2]authorization.' is old-
(21:00:28)SshUserFiles/SSHKEYBLOB2.C;1:573: key blob magic = 0x00000005
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1060: Public key
SYS$SYSROOT:[SYSMGR.SSH2]securecrt.pub, siz
(21:00:28)SshUnxixFdStream/SSHUNIXFDSTREAM.C;3:417: writing 1080 bytes
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1464: Public key algorithm
is ssh-rsa
(21:00:28)SshConfig/SSHCONFIG.C;2:3327: Configuration file
`SYS$SYSROOT:[SYSMGR.SSH2]authorization.' is old-
(21:00:28)SshUserFiles/SSHKEYBLOB2.C;1:573: key blob magic = 0x00000005
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1060: Public key
SYS$SYSROOT:[SYSMGR.SSH2]securecrt.pub, siz
(21:00:28)SshProtoCompat/SSH2COMPAT.C;1:37: Pubkey from server is of type
'if-modn'.
(21:00:28)SshProtoCompat/SSH2COMPAT.C;1:62: Scheme for RSA public key was
set to rsa-pkcs1-sha1
SSHD 0002[20200127]: WARNING: Public key operation failed for system.
(21:00:28)SshUnxixFdStream/SSHUNIXFDSTREAM.C;3:417: writing 1088 bytes
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1464: Public key algorithm
is ssh-rsa
(21:00:28)SshConfig/SSHCONFIG.C;2:3327: Configuration file
`SYS$SYSROOT:[SYSMGR.SSH2]authorization.' is old-
(21:00:28)SshUserFiles/SSHKEYBLOB2.C;1:573: key blob magic = 0x00000005
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1060: Public key
SYS$SYSROOT:[SYSMGR.SSH2]securecrt.pub, siz
(21:00:28)SshProtoCompat/SSH2COMPAT.C;1:37: Pubkey from server is of type
'if-modn'.
(21:00:28)SshProtoCompat/SSH2COMPAT.C;1:62: Scheme for RSA public key was
set to rsa-pkcs1-sha1
SSHD 0002[20200127]: WARNING: Public key operation failed for system.
(21:00:28)SshUnxixFdStream/SSHUNIXFDSTREAM.C;3:417: writing 1088 bytes
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1464: Public key algorithm
is ssh-rsa
(21:00:28)SshConfig/SSHCONFIG.C;2:3327: Configuration file
`SYS$SYSROOT:[SYSMGR.SSH2]authorization.' is old-
(21:00:28)SshUserFiles/SSHKEYBLOB2.C;1:573: key blob magic = 0x00000005
(21:00:28)Ssh2AuthPubKeyServer/AUTHS-PUBKEY.C;2:1060: Public key
SYS$SYSROOT:[SYSMGR.SSH2]securecrt.pub, siz
(21:00:28)SshProtoCompat/SSH2COMPAT.C;1:37: Pubkey from server is of type
'if-modn'.
(21:00:28)SshProtoCompat/SSH2COMPAT.C;1:62: Scheme for RSA public key was
set to rsa-pkcs1-sha1
SSHD 0002[20200127]: WARNING: Public key operation failed for system.
(21:00:28)SshUnxixFdStream/SSHUNIXFDSTREAM.C;3:417: writing 1088 bytes
(21:00:31)Ssh2Transport/TRCOMMON.C;3:1625: Processing received
SSH_MSG_DISCONNECT
(21:00:31)Ssh2Transport/TRCOMMON.C;3:606: Disconnecting: reason code: 13
message: 'The user canceled authent
(21:00:31)Ssh2Common/SSHCOMMON.C;1:169: DISCONNECT received: The user
canceled authentication.
---o<--- sample login session on PuTTY ---o<---
Using username "SYSTEM".
Welcome to OpenVMS (TM) Alpha Operating System, Version V8.3
Authenticating with public key "rsa-key-20061018-sphinx-system"
Passphrase for key "rsa-key-20061018-sphinx-system": cat29felix
Access denied
SYSTEM@xxxxxxxxxxxxx's password: (actual system password)
Last interactive login on Wednesday, 18-OCT-2006 22:56:46.17
Last non-interactive login on Wednesday, 18-OCT-2006 22:53:54.41
1 login failure since last successful login
$
---o<--- putty log ---o<---
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2006.10.18 23:38:19
=~=~=~=~=~=~=~=~=~=~=~=
Event Log: Writing new session log (SSH packets mode) to file:
c:\tmp\putty.log
Event Log: Looking up host "81.187.231.61"
Event Log: Connecting to 81.187.231.61 port 22
Event Log: Server version: SSH-2.0-3.2.9 F-SECURE SSH 5.0.1 - Process
Software MultiNet
Event Log: We claim version: SSH-2.0-PuTTY_Release_0.58
Event Log: Using SSH protocol version 2
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 20 / 0x14 (SSH2_MSG_KEXINIT)
Outgoing packet type 20 / 0x14 (SSH2_MSG_KEXINIT)
Event Log: Using Diffie-Hellman with standard group "group1"
Event Log: Doing Diffie-Hellman key exchange
Outgoing packet type 30 / 0x1e (SSH2_MSG_KEXDH_INIT)
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 31 / 0x1f (SSH2_MSG_KEXDH_REPLY)
Event Log: Host key fingerprint is:
Event Log: ssh-dss 1024 9a:7c:bf:d8:8d:03:26:08:17:98:4f:e6:6b:d9:3f:08
Outgoing packet type 21 / 0x15 (SSH2_MSG_NEWKEYS)
Event Log: Initialised AES-256 client->server encryption
Event Log: Initialised HMAC-SHA1 client->server MAC algorithm
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 21 / 0x15 (SSH2_MSG_NEWKEYS)
Event Log: Initialised AES-256 server->client encryption
Event Log: Initialised HMAC-SHA1 server->client MAC algorithm
Outgoing packet type 5 / 0x05 (SSH2_MSG_SERVICE_REQUEST)
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 6 / 0x06 (SSH2_MSG_SERVICE_ACCEPT)
Outgoing packet type 50 / 0x32 (SSH2_MSG_USERAUTH_REQUEST)
Event Log: Reading private key file "C:\Documents and Settings\tgarcia\My
Documents\key\rsa-key-20061018-sphinx-system.ppk"
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 53 / 0x35 (SSH2_MSG_USERAUTH_BANNER)
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 51 / 0x33 (SSH2_MSG_USERAUTH_FAILURE)
Outgoing packet type 50 / 0x32 (SSH2_MSG_USERAUTH_REQUEST)
Event Log: Offered public key
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 60 / 0x3c (SSH2_MSG_USERAUTH_PK_OK)
Event Log: Offer of public key accepted
Outgoing packet type 50 / 0x32 (SSH2_MSG_USERAUTH_REQUEST)
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 51 / 0x33 (SSH2_MSG_USERAUTH_FAILURE)
Event Log: Access denied
Outgoing packet type 50 / 0x32 (SSH2_MSG_USERAUTH_REQUEST)
(((following represents successful login using password authentication)))
Event Log: Sent password
Incoming packet type 2 / 0x02 (SSH2_MSG_IGNORE)
Incoming packet type 52 / 0x34 (SSH2_MSG_USERAUTH_SUCCESS)
Event Log: Access granted
---o<--- SSHD2_CONFIG. ---o<---
precisely the supplied SSHD2_CONFIG.TEMPLATE (variations tried)
---o<--- putty.ppk: private key, passphrase cat29felix ---o<---
PuTTY-User-Key-File-2: ssh-rsa
Encryption: aes256-cbc
Comment: rsa-key-20061018-sphinx-system
Public-Lines: 4
AAAAB3NzaC1yc2EAAAABJQAAAIEAoPI6By8efsF8UkeFJnd2jEU9G2R8IzJm92S2
kdmjxY47M1OsbuRoZRlAiWEyZS3/YlPHt18SwvXHd7YYsAmJeqrHEWzsd1ZqrjFW
pAeMIQOX271ueEqhG8rrCnO+E+rey/IJH2CpbSp34k21i5e2eYwgUUTqlDn/F4VM
aaB6BRc=
Private-Lines: 8
9omo+XCEmzzLV/PVDpe4n4i58Ji7vJ8+uSRpqaGpyJhnRuE8RKHcDQH8Sr8H8w5M
KRsPYtQNh+Zj5RpIEh5fROzrgA5x32Vz9H6624J8Z8GdYjVcJodXiUg7/r9pHonT
CfzrjRd0WTrrG+fGPbEBB5F5ckhBbdz3xnxCVZm4rFAx6JHq4l9BiA53gTAKT6Kv
Yn4lZEONRKCyfcGaGIsdrgq/f27iVmJ7x9I8PLybiJ1bT3+CEhEdzxzLqTSq2ns4
6XGfuiPHes/f8R0BV5c7operqHs5mKUHgyUYLM/mP0Fh0Chyt3iwSvkpF83+Tdb7
85RQwD7u61WBSbcEs9uDVNPNYKFRyLco+0sMCbU/PP87lgNwTPpQmI+clnoqdbN5
+EJPylpzTKa4GNEvmGmIGVIJTx0qmDltdVx4N6BqoMmHPBL3iAB2x0xAseXem2sf
/qedrfzSUyyiA0EsKI04vw==
Private-MAC: 308c7816d55fc61b4a1af0be6860cf8fee5edbc7
---o<--- [.SSH2]PUTTY.PUB: public key, ssh.com version ---o<---
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "rsa-key-20061018-sphinx-system"
AAAAB3NzaC1yc2EAAAABJQAAAIEAoPI6By8efsF8UkeFJnd2jEU9G2R8IzJm92S2
kdmjxY47M1OsbuRoZRlAiWEyZS3/YlPHt18SwvXHd7YYsAmJeqrHEWzsd1ZqrjFW
pAeMIQOX271ueEqhG8rrCnO+E+rey/IJH2CpbSp34k21i5e2eYwgUUTqlDn/F4VM
aaB6BRc=
---- END SSH2 PUBLIC KEY ----
---o<--- [.SSH2]AUTHORIZATION. ---o<---
KEY putty.pub
---o<--- ~/.ssh/authorized_keys ---o<---
Same key as above, converted to OpenSSH form, works fine when used with
OpenSSH client.
ssh-rsa
AAAAB3NzaC1yc2EAAAABJQAAAIEAoPI6By8efsF8UkeFJnd2jEU9G2R8IzJm92S2kdmjxY47M1OsbuRoZRlAiWEyZS3/YlPHt18SwvXHd7YYsAmJeqrHEWzsd1ZqrjFWpAeMIQOX271ueEqhG8rrCnO+E+rey/IJH2CpbSp34k21i5e2eYwgUUTqlDn/F4VMaaB6BRc=
rsa-key-20061018-sphinx-system
---o<-----------------------------o<---
Thanks for your thoughts...!
--
Tom Garcia | tgarcia@xxxxxxxxxxxx
.
- Prev by Date: Re: In a box solutions
- Next by Date: Re: DS10L to a good home...
- Previous by thread: Firmware compression algorithm?
- Next by thread: OT: R/C Plane with Video Servo
- Index(es):
Relevant Pages
|
