Cannot get SSH & Web Terminal add-on to accept authorized_keys

epposan · May 24, 2022, 12:08pm

I can use the add-on using a username and password, but when trying to use the authorized_keys, I always get a ‘Server refused our key’.

The debug log shows the following message at the end:

userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]
Received disconnect from 192.168.0.111 port 53473:14: No supported authentication methods available [preauth]
Disconnected from authenticating user hassio 192.168.0.111 port 53473 [preauth]

The rsa key I am using seems to be ok, as it is working well to access the system as (real) root using ssh into port 22222.

I have tried several ways/formats to enter the key into the configuration file and restarts of the add-on, and I even tried to manually put the key in the .ssh folder when logged in with username and password, but I keep getting the same error.

I can get where I want using the port 22222 login (and perform a docker exec into the ssh add-on) but I would like to get this sorted out.

Thanks.

dapollo989 · May 25, 2022, 6:04pm

There was an upstream change on OpenSSH 8.X. Recommendation is to create new keys using ECDSA or Ed25519

github.com/hassio-addons/addon-ssh

SFTP no longer accepting RSA key

opened 03:32PM - 18 Dec 21 UTC

closed 07:13PM - 07 Jan 22 UTC

markmonroy

# Problem/Motivation SFTP no longer accepting RSA key after 10.0.0 update …## Expected behavior Expected SFTP to continue to work ## Actual behavior SFTP stopped working ## Steps to reproduce Update addon to 10.0.0, no config changes, SSH still works, but SFTP rejects my ssh-rsa key as "not in PubkeyAcceptedAlgorithms." Using macOS Transmit 5.8.2 as my client. ``` Connection from 192.168.1.XX port 51234 on 192.168.1.XX port 22 rdomain "" userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] userauth_pubkey: key type ssh-dss not in PubkeyAcceptedAlgorithms [preauth] userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] userauth_pubkey: key type ssh-dss not in PubkeyAcceptedAlgorithms [preauth] maximum authentication attempts exceeded for root from 192.168.1.XXport 51234 ssh2 [preauth] Disconnecting authenticating user root 192.168.1.XX port 51234: Too many authentication failures [preauth] ``` Compared to successful command line SSH from the same computer: ``` Connection from 192.168.1.XX port 51487 on 192.168.1.XX port 22 rdomain "" Accepted key RSA SHA256:XXXXXXX found at /etc/ssh/authorized_keys:1 Postponed publickey for root from 192.168.1.XX port 51487 ssh2 [preauth] Accepted key RSA SHA256:XXXXXXX found at /etc/ssh/authorized_keys:1 Accepted publickey for root from 192.168.1.XX port 51487 ssh2: RSA SHA256: XXXXXXX Starting session: shell on pts/0 for root from 192.168.1.XX port 51487 id 0 ``` My config: ``` init_commands: [] packages: [] share_sessions: false ssh: allow_agent_forwarding: false allow_remote_port_forwarding: false allow_tcp_forwarding: false authorized_keys: - >- ssh-rsa XXXXX - >- ssh-rsa XXXXX compatibility_mode: false password: '' sftp: true username: root zsh: false ```

epposan · May 26, 2022, 7:05am

Problem solved !

Thank you for pointing me into the right direction, both for this issue and for a better place to look first for candidate issues with add-ons in general in the future.

Highly appreciated !

heckler · August 4, 2022, 7:11pm

Hi @epposan, how did you eventually solve this?

I’ve got the latest (0.77) version of Putty and PuttyGen, and tried creating new ECDSA and EdDSA keys, but still when I try to connect I get the same No supported authentication methods available [preauth] error message, no change.

I did notice that the YAML editor mangles the line breaks in the public key a bit, but since it used to work in the past, I don’t think that’s the problem:

epposan · August 4, 2022, 8:23pm

Hi @heckler ,

I don’t know whether it make a difference, but I entered the key without the header and trailer, like this:

Which then got mangled into:

ssh-key-2

Furthermore, I am using an empty password field:

and I don’t recognize the following entry:

apks: []

Are we talking about the same add-on:

SSH & Web Terminal
Current version: 11.0.2

heckler · August 4, 2022, 9:12pm

Yay! You nailed it, I was missing the step of converting the public key to OpenSSH format, like you show on your reply. Did that and now all is working again. THANKS!

As for the add-on: I’m using the “Terminal & SSH”) add-on, version 9.6.0

That password was left in the screenshot by mistake, I was testing to see whether it would allow me to connect with a password as a fallback, but it did not (at least not while I had the mangled key in the config). It does not matter much as this is a throwaway test password, but still bad practice, should’ve noticed and scraped it from the image.

My config (working fine now) looks like this now:

0MartyMcFly0 · November 24, 2022, 7:44pm

@heckler How did you manage to get this working. I can login without keys and just a password but constantly get ‘connection refused’ with any type of key generated from putty. I copy and paste from the right place too. Any thoughts?

heckler · November 27, 2022, 7:29pm

Hello @0MartyMcFly0 no problem. I hope it does not sound patronizing (not my intention), but I will spell it out in detail below, might be useful for others facing this issue later:

Assuming you’re using Putty, you might already have it’s key generator, PuttyGen in your system. If you don’t, you can grab it here: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

Open PutyGen and then:

Select the key type EdDSA
Click generate and move your mouse to create some randomness
Once the key is created, save the public key under (someting.pub)
And the private key (someting.ppk)
Copy the public key in RSA format and paste it into the configuration for the SSH addon

Then, in Putty:

On the menu to the left, go to Connection > SSH > Auth
On the Private Key textbox, click Browse and locate the Private Key you saved in step 4 above

That should get you there.

0MartyMcFly0 · November 27, 2022, 8:20pm

Can’t thank you enough for taking the time to post all of that in detail. Unfortunately I’m still getting “Network error: Connection refused”

heckler · November 28, 2022, 12:52pm

Sorry to hear that, but I have no other suggestion to offer at this time. The procedure above worked fine for me (Putty / Puttygen version 0.77)

0MartyMcFly0 · November 28, 2022, 10:12pm

So I was doing all this because I want to monitor some stats from my NAS through SSH as described in this post by @EventuallyFixed . That means a one line login, no password. I finally got it working with this line…

ssh -o PubkeyAcceptedKeyTypes=ssh-rsa -i <link to private key> -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa root@host

Then I just needed this line to grab the data…

df /dev/md2 | awk 'FNR == 2 {print $5}'

New-1

I’m so happy it’s working. My NAS is an ancient (at least 10 years old) WD My Book World Edition. No integration, no SNMP. So as far as I know, this is the only option. Thanks to @heckler & @EventuallyFixed for the help!

playerWon · January 3, 2023, 3:30am

For anyone who runs into this in the future, check your log files. I ran into an issue where my ppk file was too new. The post below goes into detail on the settings that need changing in puttykeygen!

strouja · January 4, 2023, 5:06am

I had the same issue but in my case it was solved by
commenting out these two lines

ControlMaster auto
ControlPath ~/.ssh/control/%h_%p_%r

in my
$HOME/.ssh/config
file

These 3 links helped me uncover the solution for me
Getting getsockname failed: Not a socket · Issue #4253 · microsoft/vscode-remote-release · GitHub
getsockname failed: Not a socket, Failed to parse remote port from server output · Issue #1309 · microsoft/vscode-remote-release · GitHub

My ssh keys were correct and I tried everything I could think of, I generated new ssh keys with different options -t rsa -b 4096
and
-t ed25519
nothing worked until I commented out those 2 lines that .ssh/config file

markpeers · April 30, 2023, 1:34am

Thanks for the idiot guide, it helped me through the process and I now have it working.

Woody130 · August 14, 2023, 5:50pm

This seems also the case for ssh? Yesterday login via ssh in drove me crazy. I used rsa keys. Today i used ecdsa and ha accepted my key

Aviatorpaal · August 18, 2023, 2:22pm

The add-on seems to have a bug that reverts to the old key after restarting. Remember to double check that your newly created key is still entered before reconnecting

mekanics · September 7, 2023, 8:53pm

I do not have the place to feed in the location of the priv key (PuTTY 0.79)

…it is under credentials.

However, it requires (probably) something to be put in the last box, but I don’t have any idea what it is. What ever I try, it just makes this windowslike “ping” sound and does not accept it.

RamanChirikov · August 29, 2024, 12:29am

resolved this problem when use a passphrase for generated EdDSA key. Its looks silly, but i put the same phrase into YAML “password” line, and OK. Keys without passphrase dont works.