Skip to content

Public key authentication not allowed by mm_answer_keyallowed #1385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
suntong opened this issue May 14, 2019 · 7 comments
Closed

Public key authentication not allowed by mm_answer_keyallowed #1385

suntong opened this issue May 14, 2019 · 7 comments
Labels
Issue-Discussion-Deprecated/use GitHub discussions

Comments

@suntong
Copy link

suntong commented May 14, 2019

Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

"OpenSSH for Windows" version
The latest, I.e.,

OpenSSH_7.7p1, OpenSSL 1.0.2p  14 Aug 2018
sshd version OpenSSH_for_Windows_7.9, LibreSSL 2.6.5
Local version string SSH-2.0-OpenSSH_for_Windows_7.9

Server OperatingSystem

((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)    
Windows 10 Enterprise

Client OperatingSystem
Windows 10 Enterprise

What is failing
Public key authentication

Expected output
Public key authentication went through

Actual output
Public key authentication denied.

Details

I started with ssh key and my $home/.ssh/authorized_keys that is working for the OpenSSH of my Ubuntu system, and get RSA key is not allowed error:

debug1: trying public key file __PROGRAMDATA__/ssh/administrators_authorized_keys
debug3: Failed to open file:C:/ProgramData/ssh/administrators_authorized_keys error:2
debug1: Could not open authorized keys '__PROGRAMDATA__/ssh/administrators_authorized_keys': No such file or directory
debug3: mm_answer_keyallowed: publickey authentication test: RSA key is not allowed
Failed publickey for myid from 10.77.101.39 port 11369 ssh2: RSA SHA256:2mAq...6ZNWxc

For what it's worth, using authorized_keys works as expected with no issue, but not the TrustedUserCAKeys.

Then I went through the standard OpenSSH key gen and ssh-copy-id all under my Windows 10 Enterprise environment, of a brand new ED25519 key

The key fingerprint is:
SHA256:9vjJL...5BiOqF1g myid@mypc

But got ED25519 key is not allowed too:

debug1: trying public key file __PROGRAMDATA__/ssh/administrators_authorized_keys
debug3: Failed to open file:C:/ProgramData/ssh/administrators_authorized_keys error:2
debug1: Could not open authorized keys '__PROGRAMDATA__/ssh/administrators_authorized_keys': No such file or directory
debug3: mm_answer_keyallowed: publickey authentication test: ED25519 key is not allowed
Failed publickey for myid from 10.77.101.39 port 11369 ssh2: ED25519 SHA256:9vjJL...5BiOqF1g

I've consulted all the closed bugs here from https://github.com/PowerShell/Win32-OpenSSH/issues/, but none solved my problem.

The closest match is #1055, TrustedUserCAKeys not working on a domain computer, but I've already signed my key in myid@mypc format.

I didn't touch the AuthorizedPrincipalsFile part because I'm not clear exactly what should I do.

Detailed Logs 
debug2: parse_server_config: config __PROGRAMDATA__\\ssh/sshd_config len 253
debug3: __PROGRAMDATA__\\ssh/sshd_config:38 setting AuthorizedKeysFile .ssh/authorized_keys
debug3: __PROGRAMDATA__\\ssh/sshd_config:79 setting Subsystem sftp      sftp-server.exe
debug3: checking syntax for 'Match Group administrators'
debug1: sshd version OpenSSH_for_Windows_7.9, LibreSSL 2.6.5
debug1: get_passwd: LookupAccountName() failed: 1788.
debug3: recv_hostkeys_state: entering fd = 3
debug3: ssh_msg_recv entering
debug3: recv_hostkeys_state: done
debug3: recv_idexch_state: entering fd = 3
debug3: ssh_msg_recv entering
debug3: recv_idexch_state: done
debug2: fd 5 setting O_NONBLOCK
debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug3: send packet: type 20 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug3: receive packet: type 20 [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug2: local server KEXINIT proposal [preauth]
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1 [preauth]
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: compression ctos: none [preauth]
debug2: compression stoc: none [preauth]
debug2: languages ctos:  [preauth]
debug2: languages stoc:  [preauth]
debug2: first_kex_follows 0  [preauth]
debug2: reserved 0  [preauth]
debug2: peer client KEXINIT proposal [preauth]
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c [preauth]
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa [preauth]
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,3des-cbc,aes256-cbc,aes192-cbc [preauth]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,3des-cbc,aes256-cbc,aes192-cbc [preauth]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: compression ctos: none,[email protected],zlib [preauth]
debug2: compression stoc: none,[email protected],zlib [preauth]
debug2: languages ctos:  [preauth]
debug2: languages stoc:  [preauth]
debug2: first_kex_follows 0  [preauth]
debug2: reserved 0  [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug3: receive packet: type 30 [preauth]
debug3: mm_sshkey_sign entering [preauth]
debug3: mm_request_send entering: type 6 [preauth]
debug3: mm_sshkey_sign: waiting for MONITOR_ANS_SIGN [preauth]
debug3: mm_request_receive_expect entering: type 7 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 6
debug3: mm_answer_sign
debug3: mm_answer_sign: hostkey proof signature 00000281EBADE4C0(100)
debug3: mm_request_send entering: type 7
debug2: monitor_read: 6 used once, disabling now
debug3: send packet: type 31 [preauth]
debug3: send packet: type 21 [preauth]
debug2: set_newkeys: mode 1 [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug3: send packet: type 7 [preauth]
debug3: receive packet: type 21 [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug2: set_newkeys: mode 0 [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug3: receive packet: type 5 [preauth]
debug3: send packet: type 6 [preauth]
debug3: receive packet: type 50 [preauth]
debug1: userauth-request for user myid service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug3: mm_getpwnamallow entering [preauth]
debug3: mm_request_send entering: type 8 [preauth]
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
debug3: mm_request_receive_expect entering: type 9 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 8
debug3: mm_answer_pwnamallow
debug2: parse_server_config: config reprocess config len 253
debug3: checking match for 'Group administrators' user mydm\\myid host 10.77.101.39 addr 10.77.101.39 laddr 10.66.20.173 lport 2222
debug3: get_user_token - i am running as mydm\\myid, returning process token
debug1: user mydm\\myid matched group list administrators at line 87
debug3: match found
debug3: reprocess config:88 setting AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 9
debug2: monitor_read: 8 used once, disabling now
debug2: input_userauth_request: setting up authctxt for myid [preauth]
debug3: mm_inform_authserv entering [preauth]
debug3: mm_request_send entering: type 4 [preauth]
debug2: input_userauth_request: try method none [preauth]
debug3: user_specific_delay: user specific delay 0.000ms [preauth]
debug3: ensure_minimum_time_since: elapsed 14.106ms, delaying 8.575ms (requested 5.670ms) [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 4
debug3: mm_answer_authserv: service=ssh-connection, style=
debug2: monitor_read: 4 used once, disabling now
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug3: send packet: type 51 [preauth]
debug3: receive packet: type 50 [preauth]
debug1: userauth-request for user myid service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug2: input_userauth_request: try method publickey [preauth]
debug1: userauth_pubkey: test pkalg rsa-sha2-512 pkblob RSA SHA256:2mAqg..66ZNWxc [preauth]
debug3: mm_key_allowed entering [preauth]
debug3: mm_request_send entering: type 22 [preauth]
debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
debug3: mm_request_receive_expect entering: type 23 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 22
debug3: mm_answer_keyallowed entering
debug3: mm_answer_keyallowed: key_from_blob: 00000281EBADE0D0
debug1: trying public key file __PROGRAMDATA__/ssh/administrators_authorized_keys
debug3: Failed to open file:C:/ProgramData/ssh/administrators_authorized_keys error:2
debug1: Could not open authorized keys '__PROGRAMDATA__/ssh/administrators_authorized_keys': No such file or directory
debug3: mm_answer_keyallowed: publickey authentication test: RSA key is not allowed
Failed publickey for myid from 10.77.101.39 port 11369 ssh2: RSA SHA256:2mAqg..66ZNWxc
debug3: mm_request_send entering: type 23
debug2: userauth_pubkey: authenticated 0 pkalg rsa-sha2-512 [preauth]
debug3: user_specific_delay: user specific delay 0.000ms [preauth]
debug3: ensure_minimum_time_since: elapsed 26.972ms, delaying 18.391ms (requested 5.670ms) [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug3: send packet: type 51 [preauth]
debug3: receive packet: type 50 [preauth]
debug1: userauth-request for user myid service ssh-connection method publickey [preauth]
debug1: attempt 2 failures 1 [preauth]
debug2: input_userauth_request: try method publickey [preauth]
debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:9vjJL...5BiOqF1g [preauth]
debug3: mm_key_allowed entering [preauth]
debug3: mm_request_send entering: type 22 [preauth]
debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
debug3: mm_request_receive_expect entering: type 23 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 22
debug3: mm_answer_keyallowed entering
debug3: mm_answer_keyallowed: key_from_blob: 00000281EBADE450
debug1: trying public key file __PROGRAMDATA__/ssh/administrators_authorized_keys
debug3: Failed to open file:C:/ProgramData/ssh/administrators_authorized_keys error:2
debug1: Could not open authorized keys '__PROGRAMDATA__/ssh/administrators_authorized_keys': No such file or directory
debug3: mm_answer_keyallowed: publickey authentication test: ED25519 key is not allowed
Failed publickey for myid from 10.77.101.39 port 11369 ssh2: ED25519 SHA256:9vjJL..5BiOqF1g
debug3: mm_request_send entering: type 23
debug2: userauth_pubkey: authenticated 0 pkalg ssh-ed25519 [preauth]
debug3: user_specific_delay: user specific delay 0.000ms [preauth]
debug3: ensure_minimum_time_since: elapsed 17.003ms, delaying 5.678ms (requested 5.670ms) [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug3: send packet: type 51 [preauth]
debug3: receive packet: type 50 [preauth]
debug1: userauth-request for user myid service ssh-connection method keyboard-interactive [preauth]

Please help. Thx!
@manojampalam
Copy link
Contributor

Looks like you are an admin on the target. Did you put your authorized key in
PROGRAMDATA/ssh/administrators_authorized_keys ?
and not in the user's profile ?

@suntong
Copy link
Author

suntong commented May 21, 2019

Thanks the reply.

No, I did not put my authorized key in
PROGRAMDATA/ssh/administrators_authorized_keys. You can see that,

Failed to open file:C:/ProgramData/ssh/administrators_authorized_keys error:2

I.e., the file is not found. I put in my user's profile instead.

@manojampalam
Copy link
Contributor

See #1324

@suntong
Copy link
Author

suntong commented May 21, 2019 •
edited
Loading

Could you be more clear please @manojampalam?

As I said, I did not use the PROGRAMDATA/ssh/administrators_authorized_keys file.

@manojampalam
Copy link
Contributor

please go through that thread. you should have answers on why you would need to use that file. If you prefer not to use it, you should change your sshd_config and restart your service.

@suntong
Copy link
Author

suntong commented May 21, 2019

OK. I'm pretty sure I've done that as well, but saw somebody suggests against using it in other "answers".

Thanks, will check again and get back to you...

@suntong
Copy link
Author

suntong commented May 24, 2019

Indeed it works. Thanks @manojampalam.

@suntong suntong closed this as completed May 24, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Issue-Discussion-Deprecated/use GitHub discussions
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@suntong @manojampalam