1

I know there are a million similar posts, but I have not yet found one that answers this question.

I'm trying to establish an ssh connection from an Ubuntu 18.04 client to the built-in OpenSSH SSH Server on the Windows-10 v1903 build. I do NOT have an Internet domain, so the Windows host will be visible on the Internet only using my ISP's assigned external IP address. To improve security, I want the Windows SSH server to REQUIRE BOTH public key authentication AND user password authentication. Additionally, I have configured the Windows server to use an alternate port for ssh.

On the Windows host, while logged in as test_user, I used the command "ssh-keygen -t ecdsa" to create a user key-pair (with passphrase) and saved it to the file "test_user_key", from an Admin command prompt on Windows, used "ssh-add test_user_key" and confirmed using "ssh-add -l" to list the user even though C:\Users\test_user.ssh\authorized_keys appears to be empty and there is no \ProgramData\ssh\authorized_keys file at all! I then copied the resulting test_user_key private key to /home/xxx/.ssh on my Ubuntu client and set permissions to 600.

With the Windows SSH server \ProgramData\ssh\sshd_config configured with "PubkeyAuthentication yes" and "PasswordAuthentication yes" but with "AuthenticationMethods" commented out, I tested the configuration LOCALLY, with the command "ssh -p 15001 -i test_user_key test_user@192.168.1.168" and, after entering the passphrase for the test_user key and the test_user account password, a connection is established and is confirmed with netstat.

When I reconfigure the Windows sshd_config to enable "AuthenticationMethods publickey,password" then restart the Windows server service, and attempt the connection using "ssh -p 15001 test_user@192.168.1.168" from Linux to Windows, I am refused immediately (i.e. no prompt for the key's passphrase) with "test_user@192.168.1.168: Permission denied (publickey)." as expected because I failed to provide a key.

I then provide the private key using the command "ssh -p 15001 -i test_user_key test_user@192.168.1.168" and am prompted to enter the key's passphrase, but receive the same "test_user@192.168.1.168: Permission denied (publickey)." after entering the passphrase.

I believe the issue is that the actual test_user_key.pub key ends with "test_user@HOSTNAME" rather than test_user@192.168.1.168. But I cannot find a way to make ssh-keygen create a key-pair with the IP address rather than the HostName.

Certainly, I'll eventually have to create a key-pair with my ISP's assigned external IP address. But ...

(1) With AuthenticationMethods enabled in sshd_config I can't even get a connection established LOCALLY.

(2) With AuthenticationMethos disabled, the Windows server allows a connection without a key file even when "PubkeyAuthentication" is enabled.

(3) Why is Windows' authorized_keys empty?

Help!

Improve this question

1 Answer 1

Reset to default
2

  1. The publickey auth is failing because the authorized_keys file is empty.

    It is empty because you didn't add the public key to it. You could add it by first cd-ing to test_users .ssh directory on the windows box and running something like:

    cat id_ecdsa.pub >> authorized_keys

    (or whatever the public key's filename is, if it's not id_ecdsa.pub. Don't copy the private key to authorized_keys)

    BTW, if your ssh client machine already had a public & private key-pair, you could have just added that public key to the authorized_keys file. That's the more normal way of doing things - generate the key pair on the client, and install the public key (and only the public key) on the server. The server doesn't need to know (and in most cases, shouldn't) the client's private key.

  2. When you copied the key from the windows host to your client machine, did you copy the public key or the private key?

    Your ssh client machine needs the private machine in order to authenticate with the remote sshd server.

    You also need to make sure that your ~/.ssh/ directory perms are 700 AND the private key file perms are 600.

  3. Finally, the name (i.e. "test_user@HOSTNAME") at the end of the public key is irrelevant, it's just an arbitrary label.

Improve this answer
2
  • Thanks @cas. Hard to believe it was that simple. I cut-pasted the contents of my user's public key into authorized_keys and enabled AuthorizationMethods publickey,passwords in the ssh server sshd_config. Now the server is enforcing both authorization requirements. Already had permissions set up. Thanks for clarifying that the label at the end of the public key was irrelevant. I had thought as much, but was so baffled by the behavior that I was grasping at straws. And, yes, an existing client machine key-pair also works (as it should) provided it too is added to authorized_keys.
    – Chucko
    Sep 5, 2019 at 10:39
  • Just to be sure that I am understanding this correctly: AuthorizationMethods publickey,passwords does not mean that the client can choose between public key authentication and username / password authentication, but does mean that the server first enforces a public key authentication and (if successful) additionally a username / password will be queried?
    – Binarus
    Mar 2 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.