Repository navigation
Permission denied (publickey) with SSH.NET - Can connect via FileZilla or Powershell. #956
Description
I'm trying to extend our SFTP capability to allow connection via key-authentication.
The code examples are very straightforward (thanks for that) and I'm pretty sure I've done it right:
connectionInfo = New ConnectionInfo(e.Host, e.Port, e.Username, GetAuthenticationMethods(e))
with GetAuthenticationMethods(e) giving me an array of AuthenticationMethods, depending on the provided information:
[...]
authMethod.Add(New PasswordAuthenticationMethod(e.Username, e.Password))
[...]
If e.FilePassphrase = "" Then
authMethod.Add(New PrivateKeyAuthenticationMethod(e.Username, New PrivateKeyFile(keyFile)))
ElseIf e.FilePassphrase <> "" Then
authMethod.Add(New PrivateKeyAuthenticationMethod(e.Username, New PrivateKeyFile(keyFile, e.FilePassphrase)))
End If
[...]
m_Client = New SftpClient(connectionInfo)
m_Client.Connect()
I have a Server set up and generated keys. Originally, I had a ssh-rsa key, giving me a openssh key type: ssh-rsa is not supported Error while trying to instantiate the PrivateKeyAuthenticationMethod. (afaict this should be supported but is not yet in the NuGet package, is there any ETA on when this will be available?)
I converted this key to PEM, which gets me one step further but now I get a Permission denied (publickey). Error.
I can connect to the server without issues using either the PEM or the ssh-rsa key over FileZilla or ssh on console.
Activity
gregolsky commentedon May 5, 2022
We are experiencing this issue when using latest Ubuntu release Jammy Jellyfish.
@wfrx Are you using Ubuntu 22.04?
Related to
ssh-rsadeprecation?https://discourse.ubuntu.com/t/jammy-jellyfish-release-notes/24668
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1961833
wfrx commentedon May 5, 2022
Yes, but as I wrote I can connect via ssh on console:
gregolsky commentedon May 20, 2022
The
sshdon Ubuntu 22.04 log shows this error when trying to connect with SSH.NET:Does SSH.NET have an option to use another algorithm for that?
gregolsky commentedon Jun 2, 2022
I think this can serve as a workaround: #825 (comment)
wfrx commentedon Jun 21, 2022
This actually seems to work using the PEM key. I'll have to do more tests to confirm, but at least I no longer get the "permission denied" error.
SibghatU commentedon May 10, 2023
Can someone please refer to my problem and help me please, here is the question: on stackoverflow
I am getting exception Renci.SshNet.Common.SshAuthenticationException: 'Permission denied (publickey).'
The host is acceesible via LAN, the ip is 192.168.A.XXX and the client IP is 192.168.B.xxx
Only this particular system has the proble, I tried same key pair on another machine, that worked well
WojciechNagorski commentedon Oct 10, 2023
Version 2023.0.0 has been published https://www.nuget.org/packages/SSH.NET/2023.0.0
blounsbury-usbr commentedon Dec 20, 2023
I'm getting this error as well using 2023.0.0. I just generated a key pair using:
openssl genrsa -out private_rsa 2048
openssl rsa -in private_rsa -pubout -out public_rsa
Is this not supported, or how do I need to do this? Thanks!
Rob-Hague commentedon Dec 20, 2023
@blounsbury-usbr has the key you just generated been installed into the server?
blounsbury-usbr commentedon Dec 20, 2023
@Rob-Hague It has. I copied it to .ssh/public_key, I could login by console. Then I decided to put it into .ssh/authorized_keys. Could still login by console or MobaXterm, haha, no problems. It is rw for username:username and world readable. Confused...
Rob-Hague commentedon Dec 20, 2023
Some issues have been reported in #1233 but since finding a potential workaround, I have not had any further clue on the cause. Does it seem related?
blounsbury-usbr commentedon Dec 20, 2023
Hmm ... I haven't read through it all, it may be similar. I saw you said look at the logs, good idea! I see this in the log file:
Dec 20 13:56:48 server sshd[122408]: Authentication refused: bad ownership or modes for file /home/username/.ssh/authorized_keys
Do you happen to know the "proper" ownership or modes to set?
Rob-Hague commentedon Dec 20, 2023
Based on https://man.openbsd.org/sshd.8#FILES, I think you need something like
chmod 644 /home/username/.ssh/authorized_keys
blounsbury-usbr commentedon Dec 20, 2023
Hmm...
Yeah, I tried following a couple advice posts and did:
https://superuser.com/questions/215504/permissions-on-private-key-in-ssh-folder
chmod go-w /home/user
chmod 700 /home/user/.ssh
chmod 644 /home/user/.ssh/authorized_keys
systemctl restart sshd
Same response. I realized I hadn't tried a Command Prompt. It's asking for a username. Thinking sshd needs set to not allow passwords, maybe...
blounsbury-usbr commentedon Dec 20, 2023
Oh my gosh, hours researching and trying ... the solution is that the public key needs to be formatted as one line like this:
ssh-rsa abcdefghijklmnopqrstuvwxyzetcetcetc rsa-key-20121022https://askubuntu.com/questions/204400/ssh-public-key-no-supported-authentication-methods-available-server-sent-publ
vsvsav commentedon Feb 27, 2024
It works with converted to OpenSSH key :
-----BEGIN OPENSSH PRIVATE KEY-----
It does not work for:
PuTTY-User-Key-File-3: ssh-rsa
Encryption: none
Comment: rsa-key-20230808
Public-Lines: 6
...
Private-Lines: 14
...==
Private-MAC:...
PS
v 2024.0.0
hinmanjp commentedon Feb 29, 2024
In addition to all of the comments about proper formatting & permissions of the ssh keys, when connecting to an Ubuntu 22.04 server (and possibly others), there is a need to add the following line to the Ubuntu sshd config, and then restart the sshd service.
PubkeyAcceptedAlgorithms +ssh-rsaStack Exchange answer
This can be done as a one liner
echo "PubkeyAcceptedAlgorithms +ssh-rsa" >> /etc/ssh/sshd_config.d/allow_ssh-rsa.conf ; systemctl restart sshdAdditionally, it should be noted that if connecting to a remote server under Visual Studio for debugging, Visual Studio does not currently appear to accept Elliptic Curve (ed25519) keys, and it does not allow the use of keys that are not password protected. The method for generating a ssh key that VS will accept (as provided by MS Support) is:
ssh-keygen -t rsa -b 4096 -m PEM -f <key_path_and_name_goes_here>Drop the -f option if you want it to create / replace your default ssh key