Hi,
I just got a firewall clearing between my workstation and our Linux Server (Red Hat 9) and I want to connect with SFTP.
But whatever key authentication and format I use, I'm not able to login with Directory Opus 13.6. CMD with "ssh" command works. SFTP itself works with e.g. UltraEdit (but not with all authentications and formats).
I know that you have to completely re-write SSH but I'm wondering how it has worked for the past 15 years for me via a tunnel gateway also via SSH.
I've also found this in the forum: SSH: How to log in using key files
Info
ssh -V
OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
which generates the new OPENSSH PRIVATE KEY file format by default!
All keys below are created without passphrase.
With ed25519:
ssh-keygen -t ed25519 -C "test-ed25519" -f "test-ed25519"
=>
256 SHA256:ea5YbY2zq1up/AvF048fd5Yz2jeGkHVuoY7iD8xxxxx test-ed25519 (ED25519)
-----BEGIN OPENSSH PRIVATE KEY-----
Key-Payload
-----END OPENSSH PRIVATE KEY-----
DO message: "unable to use this key file (openssh ssh2 private key (new format))" and then DO asks for password
With RSA (default 3072 bits) (creates OPENSSH PRIVATE KEY):
ssh-keygen -t rsa -C "test-rsa" -f "test-rsa"
=>
3072 SHA256:znTIR7UHPo+VKX+LPOyE6qGMLpm/mxrt+mC+Lwxxxxx test-rsa (RSA)
-----BEGIN OPENSSH PRIVATE KEY-----
Key-Payload
-----END OPENSSH PRIVATE KEY-----
DO message: "unable to use this key file (openssh ssh2 private key (new format))" and then DO asks for password
With RSA PEM (PKCS1):
ssh-keygen -m PEM -t rsa -C "test-rsa-pem" -f "test-rsa-pem"
=>
3072 SHA256:unqyGE6F28+rGpCuixYY4tgWPZkbv7Bmf9vm5Rxxxxx test-rsa-pem (RSA)
-----BEGIN RSA PRIVATE KEY-----
Key-Payload
-----END RSA PRIVATE KEY-----
DO message: "unable to use this key file (openssh ssh2 private key (old PEM format))" and then DO asks for password
With RSA PKCS8:
ssh-keygen -m PKCS8 -t rsa -C "test-rsa-PKCS8" -f "test-rsa-PKCS8"
=>
3072 SHA256:+ek1NrndKQiqQS/A7Komx/A00MUK5cID8JS8ELxxxxx test-rsa-PKCS8 (RSA)
-----BEGIN PRIVATE KEY-----
Key-Payload
-----END PRIVATE KEY-----
DO message: "unable to use this key file (openssh ssh2 private key (new format))" and then DO asks for password
I've also tried RSA with RFC4716 and same result with OPENSSH default. I'm not sure if default (OPENSSH format) and RFC4716 are really the same but public key looks like that with "BEGIN OPENSSH PRIVATE KEY".
Also a RSA PEM with 2048 bits which I generated 10 years ago doesn't work on Red Hat 9 AND(!) older 7 server ("old PEM format").
Until yet I'm using a local (Java) service from our company running on my machine which connects to a tunnel gateway server first and then to the final server.
For this I've used the 10 year old RSA PEM with 2048 bits (the public key is saved on the gateway server) and I connect to localhost and a port with 10xxx.
This tunnel still works - will be stopped and replaced by CyberArk soon (another story) - but I don't know why when the key format shouldn't work (readable by DO).
So I've just looked into the LOG file generated by DO 13.6:
...
Reading key file "C:\Users\xxxxx\.ssh\xxxxx@xxxxxxxxxxxxx"
Unable to use this key file (OpenSSH SSH-2 private key (old PEM format))
Unable to use key file "C:\Users\xxxxx\.ssh\xxxxx@xxxxxxxxxxxxx" (OpenSSH SSH-2 private key (old PEM format))
Using username "xxxxx".
Access granted
Opening session as main channel
Opened main channel
Started a shell/command
SSH: CTS CONNECTED
SSH: Listing Directory
SSH: List complete 26 files.
and wondering that access is granted.
I've to ask the people responsible for their own Java service program. We have another own "rights management" tool running. I think this service might use this rights management tool behind - regardless of the key. A thing I've never noticed over all the past years.
Final question: Which private key format does currently work with DO 13.6 - because some are to old and the others to new?