I'm using ssh to log in (prompt password first time) on a remote server.

In shell, using this command:

ssh root@myserver.com

works well! But all other db software applications that I tested (Dbeaver and Redis Desktop Manager) fail when I try to use SSH Tunnel. I selected my private key from /home/myuser/.ssh/id_dsa.

Example in Redis Desktop Manager: rdm

Example in Dbeaver: enter image description here

If I set the tunnel:

ssh root@myserver.com -L 6379:127.0.0.1:6379 -N

I can connect to 127.0.0.1:6379, i.e., the tunnel is working. Why via third party is this not working?

In remote server is running CentOS 6 and in my desktop Ubuntu 14.

  • 2
    Welcome to SE. Please explain "All other db softwares ... fail". How do they fail? What are they supposed to do that they don't do? Please be precise, and if necessary provide examples. – roaima Apr 28 '15 at 21:44
  • I tried to improve with examples of images that show when they fail. – Diogo Alves Apr 29 '15 at 13:09
  • Please confirm (in your question) that the very first ssh root@myserver logs you in without prompting you for a password. (If it prompts for a password your public/private key is not set up correctly.) – roaima Apr 29 '15 at 14:11
  • After restarting my computer, when trying to login via ssh again, I was asked the password to unlock the id_dsa file. – Diogo Alves Apr 30 '15 at 13:08
  • 1
    roaima, I tried remove the password with command ssh-keygen -p -f ~/.ssh/id_dsa then I restarted the computer and the password is no more prompted. But i can't login in third party yet. Do you have any tip? – Diogo Alves Apr 30 '15 at 15:50

You said, in the comments,

After restarting my computer, when trying to login via ssh again, I was asked the password to unlock the id_dsa file

There's at least part of the answer. Your other tools have no ability to unlock a private key, and no ability to talk to ssh-agent to have it authenticate on their behalf. You need to remove the password from the private certificate.

The syntax is:

ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]

And as you pointed out in your comment, the practical application of this is:

ssh-keygen -p -f ~/.ssh/id_dsa

The next part of the problem is that some third-party libraries for Java and .NET will only handle RSA ssh keys - and (in my experience) only up to a certainly key length. DSA and ECDSA are not options.

If you don't have ~/.ssh/id_rsa then you are going to need to create it, and copy the public part to the remote host:

ssh-keygen -t rsa
ssh remoteuser@remotehost 'cat >> .ssh/authorized_keys' < ~/.ssh/id_rsa.pub

Another part of the problem may be that the private key is in the "wrong" format and needs conversion. From a brief perusal of the documentation for Redis Desktop Manager I don't believe this is the case but it would be worth double-checking. UPDATE: It appears that JSCH - Invalid private key confirms that the key is expected to be in OpenSSH format - which is what it appears you are already using.

  • 1
    id_dsa without password fail to auth via third party. I don't have id_rsa key then, new key generated using ssh-keygen -t rsa and put in remotehost in authorized_keys files, but fail too. I dont know why we need to convert if we are using a new rsa key. – Diogo Alves May 2 '15 at 16:42
  • @Diogo, you installed id_rsa.pub into the authorized_keys files on the remote server. Have you changed Redis and DBeaver to use id_rsa instead of id_dsa? – roaima May 2 '15 at 20:36
  • Yes, i'm using id_rsa instead of dsa but Dbeaver and Redis (2015-05-04 10:29:17 : Connection: SSH Connection error: Authentication Error) fail to login. I don't know more what can i do. At now i'm using custom tunnel set by shell. – Diogo Alves May 4 '15 at 13:30

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.