How to Require PubkeyAuthentication using SSH from Linux client to Windows OpenSSH server

Question

I know there are a million similar posts, but I have not yet found one that answers this question.

I'm trying to establish an ssh connection from an Ubuntu 18.04 client to the built-in OpenSSH SSH Server on the Windows-10 v1903 build. I do NOT have an Internet domain, so the Windows host will be visible on the Internet only using my ISP's assigned external IP address. To improve security, I want the Windows SSH server to REQUIRE BOTH public key authentication AND user password authentication. Additionally, I have configured the Windows server to use an alternate port for ssh.

On the Windows host, while logged in as test_user, I used the command "ssh-keygen -t ecdsa" to create a user key-pair (with passphrase) and saved it to the file "test_user_key", from an Admin command prompt on Windows, used "ssh-add test_user_key" and confirmed using "ssh-add -l" to list the user even though C:\Users\test_user.ssh\authorized_keys appears to be empty and there is no \ProgramData\ssh\authorized_keys file at all! I then copied the resulting test_user_key private key to /home/xxx/.ssh on my Ubuntu client and set permissions to 600.

With the Windows SSH server \ProgramData\ssh\sshd_config configured with "PubkeyAuthentication yes" and "PasswordAuthentication yes" but with "AuthenticationMethods" commented out, I tested the configuration LOCALLY, with the command "ssh -p 15001 -i test_user_key test_user@192.168.1.168" and, after entering the passphrase for the test_user key and the test_user account password, a connection is established and is confirmed with netstat.

When I reconfigure the Windows sshd_config to enable "AuthenticationMethods publickey,password" then restart the Windows server service, and attempt the connection using "ssh -p 15001 test_user@192.168.1.168" from Linux to Windows, I am refused immediately (i.e. no prompt for the key's passphrase) with "test_user@192.168.1.168: Permission denied (publickey)." as expected because I failed to provide a key.

I then provide the private key using the command "ssh -p 15001 -i test_user_key test_user@192.168.1.168" and am prompted to enter the key's passphrase, but receive the same "test_user@192.168.1.168: Permission denied (publickey)." after entering the passphrase.

I believe the issue is that the actual test_user_key.pub key ends with "test_user@HOSTNAME" rather than test_user@192.168.1.168. But I cannot find a way to make ssh-keygen create a key-pair with the IP address rather than the HostName.

Certainly, I'll eventually have to create a key-pair with my ISP's assigned external IP address. But ...

(1) With AuthenticationMethods enabled in sshd_config I can't even get a connection established LOCALLY.

(2) With AuthenticationMethos disabled, the Windows server allows a connection without a key file even when "PubkeyAuthentication" is enabled.

(3) Why is Windows' authorized_keys empty?

Help!

Answer 1

1. The publickey auth is failing because the authorized_keys file is empty.

   It is empty because you didn't add the public key to it. You could add it by first cd-ing to test_users .ssh directory on the windows box and running something like:

   cat id_ecdsa.pub >> authorized_keys
   

   (or whatever the public key's filename is, if it's not id_ecdsa.pub. Don't copy the private key to authorized_keys)

   BTW, if your ssh client machine already had a public & private key-pair, you could have just added that public key to the authorized_keys file. That's the more normal way of doing things - generate the key pair on the client, and install the public key (and only the public key) on the server. The server doesn't need to know (and in most cases, shouldn't) the client's private key.

2. When you copied the key from the windows host to your client machine, did you copy the public key or the private key?

   Your ssh client machine needs the private machine in order to authenticate with the remote sshd server.

   You also need to make sure that your ~/.ssh/ directory perms are 700 AND the private key file perms are 600.

3. Finally, the name (i.e. "test_user@HOSTNAME") at the end of the public key is irrelevant, it's just an arbitrary label.