0

I am trying to ssh to a windows host from a mac. On the windows host I have confirmed the ssh client and server are running:

Running  ssh-agent          OpenSSH Authentication Agent
Running  sshd               OpenSSH SSH Server

I have created a keypair on the mac host and added the public key to the windows host at user_name\.ssh\authorized_keys.

I have edited C:\ProgramData\ssh\sshd_config and set PubkeyAuthentication to yes.

I have disabled inheritance and set the user as the only owner on the authorized_keys file on the windows host.

Still every time I connect I am prompted for a password. Here is the verbose ssh log:

OpenSSH_8.1p1, LibreSSL 2.7.3
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 47: Applying options for *
debug1: Connecting to 35.236.81.186 [35.236.81.186] port 22.
debug1: Connection established.
debug1: identity file .ssh/test-key type 0
debug1: identity file .ssh/test-key-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_for_Windows_7.7
debug1: match: OpenSSH_for_Windows_7.7 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 35.236.81.186:22 as 'user_name'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:veyhbrqy4sjdCuKVzN0QeULqYuim9uPKuHv+tZmik9o
debug1: Host '35.236.81.186' is known and matches the ECDSA host key.
debug1: Found key in /Users/user_name/.ssh/known_hosts:16
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: .ssh/test-key RSA SHA256:v8x4oVslm8vO8mXo1d368xaw6yi99k94y/NGGq0UnBM explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: .ssh/test-key RSA SHA256:v8x4oVslm8vO8mXo1d368xaw6yi99k94y/NGGq0UnBM explicit
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
[email protected]'s password: 

If anyone has any ideas as to what else I can try to get pubkey authentication working I am totally out of ideas and open to any suggestions. I appreciate any and all help, thank you.

9
  • From what I understand OpenSSHUtils is deprecated and no longer recommended. And yes, the public key is on the server in authorized_keys. Commented Mar 23, 2021 at 18:49
  • I did run ssh-add, yes Commented Mar 23, 2021 at 18:49
  • 1
    Microsoft should probably update their documentation. You provided us the logs from the client can you provide us the logs from the server? What user started the service?
    – Ramhound
    Commented Mar 23, 2021 at 18:51
  • In order to access the private key, the service should be started by the same user, who owns the key apparently.
    – Ramhound
    Commented Mar 23, 2021 at 19:00
  • @Ramhound: That doesn't make much sense. The service already has access, through the SYSTEM ACE. The only relevant part of that post seems to be about "Match Group administrators"... Commented Mar 23, 2021 at 19:08

1 Answer 1

1

Finally! Thank you all for pointing me to some more resources that seem to have finally resolved my issue!

It seems that by commenting out the line

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

in the sshd_config file I was able to authenticate using a public key. I'm not sure why this would be the case considering I did add the public key to that file as well as the one in my home folder, but in any case the removal of that line did seem to do the trick.

Once again thank you all for your help, I'm very grateful for it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .