WinSCP connection fails "publickey RSA signature unverified: incorrect signature" after OS upgrade

Advertisement

Szabolcs Horvath
Guest

WinSCP connection fails "publickey RSA signature unverified: incorrect signature" after OS upgrade

Hi,

Version of WinSCP you are using: 6.3.1
It occured after upgrading the SFTP server from Red Hat 7 to Red Hat 9.3.
Version of Microsoft Windows you are running WinSCP on: Windows 10
Transfer protocol (SFTP, FTP, SCP, WebDAV or S3): SFTP
Mention if you use GUI or scripting/automation: not relevant, the authentication process fails.
If you experience an error, include full error message: see below.
Try to describe precise steps that lead to the problem: see below.
If your problems relates to interaction with remote server, please post a full log file showing the problem: see below.

We have several users using Pageant CAPI keys with WinSCP, and after upgrading the SFTP server from Red Hat 7 to the latest Red Hat 9.3, several users cannot connect to SFTP anymore.
The WinSCP error message says
Server refused public-key signature despite accepting key!
and I searched through the forums but haven't found any similar cases.

First, I suspected it's an ssh server issue, but it turned out Pageant+psftp combination works as a charm, but Pageant+WinSCP doesn't.

On the server side, with DEBUG3 log level, there's a cryptic error message:
ssh_rsa_verify: Unexpected digest algorithm: got 1, wanted 4
and
mm_answer_keyverify: publickey RSA signature unverified: incorrect signature
which leads me nowhere.

Another difference is, psftp sends the public key via ssh-rsa, while WinSCP sends via rsa-sha2-512.
Mar  8 08:32:31 mysftpserver sshd[899188]: debug2: userauth_pubkey: valid user testuser querying public key ssh-rsa AAAAB3NzaC1yc2somethingredacted [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug2: userauth_pubkey: valid user testuser attempting public key rsa-sha2-512 AAAAB3NzaC1yc2somethingredacted [preauth]
It looks like in the WinSCP session the server accepts the key from WinSCP
Mar  8 08:36:08 mysftpserver sshd[899583]: Accepted key RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU found at /home/testuser/.ssh/authorized_keys2:3
but right after that it drops the connection with these lines:
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: ssh_rsa_verify: Unexpected digest algorithm: got 1, wanted 4
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_answer_keyverify: publickey RSA signature unverified: incorrect signature
If I enable password authentication, it works as expected (but for security reasons, we have to disable password authentication in production).

Here are the server side logs from a psftp and a WinSCP connection, and a WinSCP debug log.

Pageant 0.80 + psftp 0.80
Mar  8 08:32:30 mysftpserver sshd[899188]: debug2: input_userauth_request: setting up authctxt for testuser [preauth]
Mar  8 08:32:30 mysftpserver sshd[899188]: debug1: PAM: initializing for "testuser"
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: userauth-request for user testuser service ssh-connection method publickey [preauth]
Mar  8 08:32:31 mysftpserver sshd[899188]: debug2: userauth_pubkey: valid user testuser querying public key ssh-rsa AAAAB3NzaC1yc2somethingredacted [preauth]
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: trying public key file /home/testuser/.ssh/authorized_keys
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: Could not open authorized keys '/home/testuser/.ssh/authorized_keys': No such file or directory
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: trying public key file /home/testuser/.ssh/authorized_keys2
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: /home/testuser/.ssh/authorized_keys2:3: matching key found: RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: /home/testuser/.ssh/authorized_keys2:3: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Mar  8 08:32:31 mysftpserver sshd[899188]: Accepted key RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU found at /home/testuser/.ssh/authorized_keys2:3
Mar  8 08:32:31 mysftpserver sshd[899188]: Postponed publickey for testuser from 10.1.2.3 port 64009 ssh2 [preauth]
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: userauth-request for user testuser service ssh-connection method publickey [preauth]
Mar  8 08:32:31 mysftpserver sshd[899188]: debug2: userauth_pubkey: valid user testuser attempting public key ssh-rsa AAAAB3NzaC1yc2somethingredacted [preauth]
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: trying public key file /home/testuser/.ssh/authorized_keys
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: Could not open authorized keys '/home/testuser/.ssh/authorized_keys': No such file or directory
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: trying public key file /home/testuser/.ssh/authorized_keys2
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: /home/testuser/.ssh/authorized_keys2:3: matching key found: RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: /home/testuser/.ssh/authorized_keys2:3: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Mar  8 08:32:31 mysftpserver sshd[899188]: Accepted key RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU found at /home/testuser/.ssh/authorized_keys2:3
Mar  8 08:32:31 mysftpserver sshd[899188]: Accepted publickey for testuser from 10.1.2.3 port 64009 ssh2: RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU
Mar  8 08:32:31 mysftpserver sshd[899188]: debug1: monitor_child_preauth: user testuser authenticated by privileged process
Mar  8 08:32:31 mysftpserver systemd[899195]: pam_unix(systemd-user:session): session opened for user testuser(uid=805201111) by (uid=0)
Mar  8 08:32:32 mysftpserver sshd[899188]: pam_unix(sshd:session): session opened for user testuser(uid=805201111) by (uid=0)
Mar  8 08:32:32 mysftpserver sshd[899188]: debug3: sending debug message: /home/testuser/.ssh/authorized_keys2:3: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding [postauth]
Mar  8 08:32:32 mysftpserver sshd[899188]: debug3: sending debug message: /home/testuser/.ssh/authorized_keys2:3: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding [postauth]
Mar  8 08:32:32 mysftpserver sshd[899188]: debug2: subsystem request for sftp by user testuser [postauth]
Mar  8 08:32:32 mysftpserver sshd[899188]: Starting session: forced-command (config) 'internal-sftp -u 0007 -l VERBOSE -f AUTH -l INFO' for testuser from 10.1.2.3 port 64009 id 0 [postauth]
Mar  8 08:32:32 mysftpserver sshd[899188]: session opened for local user testuser from [10.1.2.3] [postauth]
Pageant 0.80 + WinSCP 6.3.1
Mar  8 08:36:07 mysftpserver sshd[899583]: debug2: input_userauth_request: try method publickey [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug2: userauth_pubkey: valid user testuser querying public key rsa-sha2-512 AAAAB3NzaC1yc2somethingredacted [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: userauth_pubkey: test pkalg rsa-sha2-512 pkblob RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_key_allowed: entering [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_request_send: entering, type 22 [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_request_receive_expect: entering, type 23 [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_request_receive: entering [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_request_receive: entering
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: monitor_read: checking request 22
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_answer_keyallowed: entering
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: trying public key file /home/testuser/.ssh/authorized_keys
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: Could not open authorized keys '/home/testuser/.ssh/authorized_keys': No such file or directory
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: restore_uid: 0/0
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: trying public key file /home/testuser/.ssh/authorized_keys2
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: fd 10 clearing O_NONBLOCK
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: /home/testuser/.ssh/authorized_keys2:3: matching key found: RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: /home/testuser/.ssh/authorized_keys2:3: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Mar  8 08:36:07 mysftpserver sshd[899583]: Accepted key RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU found at /home/testuser/.ssh/authorized_keys2:3
Mar  8 08:36:07 mysftpserver sshd[899583]: debug1: restore_uid: 0/0
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_answer_keyallowed: publickey authentication test: RSA key is allowed
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: mm_request_send: entering, type 23
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: send packet: type 60 [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug2: userauth_pubkey: authenticated 0 pkalg rsa-sha2-512 [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: user_specific_delay: user specific delay 0.000ms [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: debug3: ensure_minimum_time_since: elapsed 2.409ms, delaying 3.296ms (requested 5.705ms) [preauth]
Mar  8 08:36:07 mysftpserver sshd[899583]: Postponed publickey for testuser from 10.1.2.3 port 64173 ssh2 [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: receive packet: type 50 [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: userauth-request for user testuser service ssh-connection method publickey [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: attempt 2 failures 0 [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug2: input_userauth_request: try method publickey [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug2: userauth_pubkey: valid user testuser attempting public key rsa-sha2-512 AAAAB3NzaC1yc2somethingredacted [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: userauth_pubkey: have rsa-sha2-512 signature for RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_key_allowed: entering [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_send: entering, type 22 [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_receive_expect: entering, type 23 [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_receive: entering [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_receive: entering
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: monitor_read: checking request 22
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_answer_keyallowed: entering
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: temporarily_use_uid: 805201111/10.1.2.3 (e=0/0)
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: trying public key file /home/testuser/.ssh/authorized_keys
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: Could not open authorized keys '/home/testuser/.ssh/authorized_keys': No such file or directory
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: restore_uid: 0/0
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: temporarily_use_uid: 805201111/10.1.2.3 (e=0/0)
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: trying public key file /home/testuser/.ssh/authorized_keys2
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: fd 10 clearing O_NONBLOCK
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: /home/testuser/.ssh/authorized_keys2:3: matching key found: RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: /home/testuser/.ssh/authorized_keys2:3: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Mar  8 08:36:08 mysftpserver sshd[899583]: Accepted key RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU found at /home/testuser/.ssh/authorized_keys2:3
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: restore_uid: 0/0
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_answer_keyallowed: publickey authentication: RSA key is allowed
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_send: entering, type 23
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_sshkey_verify: entering [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_send: entering, type 24 [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_sshkey_verify: waiting for MONITOR_ANS_KEYVERIFY [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_receive_expect: entering, type 25 [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_receive: entering [preauth]
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_receive: entering
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: monitor_read: checking request 24
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: ssh_rsa_verify: Unexpected digest algorithm: got 1, wanted 4
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_answer_keyverify: publickey RSA signature unverified: incorrect signature
Mar  8 08:36:08 mysftpserver sshd[899583]: debug1: auth_activate_options: setting new authentication options
Mar  8 08:36:08 mysftpserver sshd[899583]: debug3: mm_request_send: entering, type 25
Mar  8 08:36:08 mysftpserver sshd[899583]: Failed publickey for testuser from 10.1.2.3 port 64173 ssh2: RSA SHA256:wVtBoIh7+SWlPw2iX0EE4rz0Ls7Em/Wq8bJyRzBJCwU
WinSCP client logs
. 2024-03-08 08:36:07.160 --------------------------------------------------------------------------
. 2024-03-08 08:36:07.160 WinSCP Verzió 6.3.1 (Build 14821 2024-02-21) (OS 10.0.19045 – Windows 10 Enterprise)
. 2024-03-08 08:36:07.160 Configuration: HKCU\Software\Martin Prikryl\WinSCP 2\
. 2024-03-08 08:36:07.160 Log level: Debug 2
. 2024-03-08 08:36:07.160 Local account: DOMAIN\testuser
. 2024-03-08 08:36:07.160 Working directory: C:\Program Files (x86)\WinSCP
. 2024-03-08 08:36:07.160 Process ID: 4820
. 2024-03-08 08:36:07.160 Ancestor processes: explorer, ...
. 2024-03-08 08:36:07.173 Command-line: "C:\Program Files (x86)\WinSCP\WinSCP.exe" 
. 2024-03-08 08:36:07.173 Time zone: Current: GMT+1, Standard: GMT+1 (Central Europe Standard Time), DST: GMT+2 (Central Europe Daylight Time), DST Start: 2024.03.31., DST End: 2024.10.27.
. 2024-03-08 08:36:07.173 Login time: 2024. március 8. 8:36:07
. 2024-03-08 08:36:07.173 --------------------------------------------------------------------------
. 2024-03-08 08:36:07.173 Session name: testuser@mysftpserver (Ad-Hoc site)
. 2024-03-08 08:36:07.173 Host name: mysftpserver (Port: 22)
. 2024-03-08 08:36:07.173 User name: testuser (Password: No, Key file: No, Passphrase: No)
. 2024-03-08 08:36:07.173 Tunnel: No
. 2024-03-08 08:36:07.173 Transfer Protocol: SFTP (SCP)
. 2024-03-08 08:36:07.173 Ping type: Off, Ping interval: 30 sec; Timeout: 15 sec
. 2024-03-08 08:36:07.173 Disable Nagle: No
. 2024-03-08 08:36:07.173 Proxy: None
. 2024-03-08 08:36:07.173 Send buffer: 262144
. 2024-03-08 08:36:07.173 Compression: No
. 2024-03-08 08:36:07.173 Bypass authentication: No
. 2024-03-08 08:36:07.173 Try agent: Yes; Agent forwarding: No; KI: Yes; GSSAPI: Yes
. 2024-03-08 08:36:07.173 GSSAPI: KEX: No; Forwarding: No; Libs: gssapi32,sspi,custom; Custom: 
. 2024-03-08 08:36:07.173 Ciphers: aes,chacha20,aesgcm,3des,WARN,des,blowfish,arcfour; Ssh2DES: No
. 2024-03-08 08:36:07.173 KEX: ntru-curve25519,ecdh,dh-gex-sha1,dh-group18-sha512,dh-group17-sha512,dh-group16-sha512,dh-group15-sha512,dh-group14-sha1,rsa,WARN,dh-group1-sha1
. 2024-03-08 08:36:07.173 SSH Bugs: Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto
. 2024-03-08 08:36:07.173 Simple channel: Yes
. 2024-03-08 08:36:07.173 Return code variable: Autodetect; Lookup user groups: Auto
. 2024-03-08 08:36:07.173 Shell: default
. 2024-03-08 08:36:07.173 EOL: LF, UTF: Auto
. 2024-03-08 08:36:07.173 Clear aliases: Yes, Unset nat.vars: Yes, Resolve symlinks: Yes; Follow directory symlinks: No
. 2024-03-08 08:36:07.173 LS: ls -la, Ign LS warn: Yes, Scp1 Comp: No; Exit code 1 is error: No
. 2024-03-08 08:36:07.173 SFTP Bugs: Auto,Auto
. 2024-03-08 08:36:07.173 SFTP Server: default
. 2024-03-08 08:36:07.173 Local directory: default, Remote directory: home, Update: Yes, Cache: Yes
. 2024-03-08 08:36:07.173 Cache directory changes: Yes, Permanent: Yes
. 2024-03-08 08:36:07.173 Recycle bin: Delete to: No, Overwritten to: No, Bin path: 
. 2024-03-08 08:36:07.173 DST mode: Unix
. 2024-03-08 08:36:07.173 --------------------------------------------------------------------------
. 2024-03-08 08:36:07.204 Looking up host "mysftpserver" for SSH connection
. 2024-03-08 08:36:07.204 Connecting to 10.99.99.99 port 22
. 2024-03-08 08:36:07.204 Connected to 10.99.99.99
. 2024-03-08 08:36:07.204 Selecting events 63 for socket 1596
. 2024-03-08 08:36:07.219 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:07.219 Looking for incoming data
. 2024-03-08 08:36:07.219 Looking for network events
. 2024-03-08 08:36:07.219 We claim version: SSH-2.0-WinSCP_release_6.3.1
. 2024-03-08 08:36:07.219 Detected network event
. 2024-03-08 08:36:07.219 Enumerating network events for socket 1596
. 2024-03-08 08:36:07.219 Enumerated 18 network events making 18 cumulative events for socket 1596
. 2024-03-08 08:36:07.219 Handling network write event on socket 1596 with error 0
. 2024-03-08 08:36:07.219 Handling network connect event on socket 1596 with error 0
. 2024-03-08 08:36:07.219 Connected to 10.99.99.99
. 2024-03-08 08:36:07.219 Looking for network events
. 2024-03-08 08:36:07.219 Detected network event
. 2024-03-08 08:36:07.219 Enumerating network events for socket 1596
. 2024-03-08 08:36:07.219 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:07.219 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:07.219 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:07.219 Looking for incoming data
. 2024-03-08 08:36:07.219 Looking for network events
. 2024-03-08 08:36:07.219 Remote version: SSH-2.0-OpenSSH_8.7
. 2024-03-08 08:36:07.219 Using SSH protocol version 2
. 2024-03-08 08:36:07.219 Have a known host key of type ssh-ed25519
. 2024-03-08 08:36:07.219 Detected network event
. 2024-03-08 08:36:07.219 Enumerating network events for socket 1596
. 2024-03-08 08:36:07.219 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:07.219 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:07.219 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:07.219 Looking for incoming data
. 2024-03-08 08:36:07.219 Looking for network events
. 2024-03-08 08:36:07.235 Doing ECDH key exchange with curve Curve25519, using hash SHA-256
. 2024-03-08 08:36:07.282 Detected network event
. 2024-03-08 08:36:07.282 Enumerating network events for socket 1596
. 2024-03-08 08:36:07.282 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:07.282 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:07.282 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:07.282 Looking for incoming data
. 2024-03-08 08:36:07.282 Looking for network events
. 2024-03-08 08:36:07.297 Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
. 2024-03-08 08:36:07.297 Host key fingerprint is:
. 2024-03-08 08:36:07.297 ssh-ed25519 255 SHA256:2w52/JXtmWN9oOFTfxlgagnOEN3LRpsdGeI7GS5WzFk
. 2024-03-08 08:36:07.313 Verifying host key ssh-ed25519 0x10303fc63d64b97c 1d96c4b435a749ce 2fedcfe2025b228f 8b68ec0170de443f ,0x410a6a0992c6f1b6 486566272e95589e 402e02d2a420c549 c8affd77877c62b9  with fingerprints ssh-ed25519 255 SHA256:2w52/JXtmWN9oOFTfxlgagnOEN3LRpsdGeI7GS5WzFk, ssh-ed25519 255 2e:7a:5f:7e:19:4a:b3:17:f4:7a:ac:8c:8f:5b:22:a2
. 2024-03-08 08:36:07.344 Host key matches cached key
. 2024-03-08 08:36:07.344 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] outbound encryption
. 2024-03-08 08:36:07.344 Initialised HMAC-SHA-256 outbound MAC algorithm
. 2024-03-08 08:36:07.344 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] inbound encryption
. 2024-03-08 08:36:07.344 Initialised HMAC-SHA-256 inbound MAC algorithm
. 2024-03-08 08:36:07.344 Detected network event
. 2024-03-08 08:36:07.344 Enumerating network events for socket 1596
. 2024-03-08 08:36:07.344 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:07.344 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:07.344 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:07.344 Looking for incoming data
. 2024-03-08 08:36:07.344 Looking for network events
. 2024-03-08 08:36:07.344 Pageant is running. Requesting keys.
. 2024-03-08 08:36:07.344 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:07.344 Looking for incoming data
. 2024-03-08 08:36:07.344 Looking for network events
. 2024-03-08 08:36:07.344 Pageant has 1 SSH-2 keys
! 2024-03-08 08:36:07.344 Using username "testuser".
. 2024-03-08 08:36:07.359 Looking for network events
. 2024-03-08 08:36:08.812 Detected network event
. 2024-03-08 08:36:08.812 Enumerating network events for socket 1596
. 2024-03-08 08:36:08.812 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:08.812 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:08.812 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:08.812 Looking for incoming data
. 2024-03-08 08:36:08.812 Looking for network events
. 2024-03-08 08:36:08.812 Server offered these authentication methods: publickey,gssapi-keyex,gssapi-with-mic
. 2024-03-08 08:36:08.812 Trying Pageant key #0
. 2024-03-08 08:36:08.812 Detected network event
. 2024-03-08 08:36:08.812 Enumerating network events for socket 1596
. 2024-03-08 08:36:08.812 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:08.812 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:08.812 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:08.812 Looking for incoming data
. 2024-03-08 08:36:08.812 Looking for network events
! 2024-03-08 08:36:08.812 Authenticating with public key "CAPI:fb4b63f3602750c7f75e783e0311abc2f258591c" from agent
. 2024-03-08 08:36:08.874 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:08.874 Looking for incoming data
. 2024-03-08 08:36:08.874 Looking for network events
. 2024-03-08 08:36:08.874 Sending Pageant's response
. 2024-03-08 08:36:08.874 Looking for network events
. 2024-03-08 08:36:08.890 Detected network event
. 2024-03-08 08:36:08.890 Enumerating network events for socket 1596
. 2024-03-08 08:36:08.890 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:08.890 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:08.890 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:08.890 Looking for incoming data
. 2024-03-08 08:36:08.890 Looking for network events
! 2024-03-08 08:36:08.890 Server refused public-key signature despite accepting key!
. 2024-03-08 08:36:08.905 Server refused public-key signature despite accepting key!
. 2024-03-08 08:36:08.905 Server offered these authentication methods: publickey,gssapi-keyex,gssapi-with-mic
. 2024-03-08 08:36:08.905 Using SSPI from SECUR32.DLL
. 2024-03-08 08:36:08.905 Trying gssapi-with-mic...
. 2024-03-08 08:36:08.905 Attempting GSSAPI authentication
. 2024-03-08 08:36:08.905 Detected network event
. 2024-03-08 08:36:08.905 Enumerating network events for socket 1596
. 2024-03-08 08:36:08.905 Enumerated 1 network events making 1 cumulative events for socket 1596
. 2024-03-08 08:36:08.905 Handling network read event on socket 1596 with error 0
. 2024-03-08 08:36:08.905 Waiting for the server to continue with the initialization
. 2024-03-08 08:36:08.905 Looking for incoming data
. 2024-03-08 08:36:08.905 Looking for network events
. 2024-03-08 08:36:08.905 GSSAPI authentication initialisation failed
. 2024-03-08 08:36:08.905 The target was not recognized.
. 2024-03-08 08:36:08.905 No supported authentication methods available (server sent: publickey,gssapi-keyex,gssapi-with-mic)
. 2024-03-08 08:36:08.905 Attempt to close connection due to fatal exception:
* 2024-03-08 08:36:08.905 No supported authentication methods available (server sent: publickey,gssapi-keyex,gssapi-with-mic)
. 2024-03-08 08:36:08.905 Closing connection.
. 2024-03-08 08:36:08.905 Selecting events 0 for socket 1596
* 2024-03-08 08:36:08.921 (EFatal) No supported authentication methods available (server sent: publickey,gssapi-keyex,gssapi-with-mic)
* 2024-03-08 08:36:08.921 Hitelesítési napló (a munkamenet naplóban vannak a részletek):
* 2024-03-08 08:36:08.921 Felhasználónév: "testuser".
* 2024-03-08 08:36:08.921 Hitelesítés a "CAPI:fb4b63f3602750c7f75e783e0311abc2f258591c" ügynöktől kapott publikus kulcscsal.
* 2024-03-08 08:36:08.921 Server refused public-key signature despite accepting key!
* 2024-03-08 08:36:08.921 
* 2024-03-08 08:36:08.921 Hitelesítés nem sikerült.
I would really appreciate for help.

Regards
Szabolcs Horvath

Reply with quote

Advertisement

Szabolcs Horvath
Guest

workaround

Users are using certificates from the Microsoft Windows certificate store.
The certificate is loaded into pageant and from pageant to the actual SFTP Client.

It turned out psftp.exe and Bitvise SSH client worked well,
while FileZilla and WinSCP dropped the connection with the very same "Server refused public-key signature despite accepting key" error message.

During Certificate Enrollment process, on the "Private key" tab, if only the "Microsoft Strong Cryptographic Provider (Encryption)" is selected (per default).

We managed to overcome the situation by selecting "Microsoft Enhanced RSA and AES Cryptographic Provider (Encryption)" only (nothing else).

I still do not know while Pageant and Bitvise could handle the default CSP and why FileZilla and WinSCP couldn't, but at least we have a working workaround for this.

Any thoughts are appreciated on this.

Reply with quote

Szabolcs Horvath
Guest

Re: workaround

Sure:
C:\Users\testuser>psftp testuser@mysftpserver  -v
Looking up host "mysftpserver" for SSH connection
Connecting to 10.99.99.99 port 22
We claim version: SSH-2.0-PuTTY_Release_0.78_1
Connected to 10.99.99.99
Remote version: SSH-2.0-OpenSSH_8.7
Using SSH protocol version 2
No GSSAPI security context available
Doing ECDH key exchange with curve Curve25519, using hash SHA-256 (unaccelerated)
Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
Host key fingerprint is:
ssh-ed25519 255 SHA256:2w52/JXtmWN9oOFTfxlgagnOEN3LRpsdGeI7GS5WzFk
Initialised AES-256 SDCTR (AES-NI accelerated) outbound encryption
Initialised HMAC-SHA-256 (unaccelerated) outbound MAC algorithm
Initialised AES-256 SDCTR (AES-NI accelerated) inbound encryption
Initialised HMAC-SHA-256 (unaccelerated) inbound MAC algorithm
Pageant is running. Requesting keys.
Pageant has 1 SSH-2 keys
Using username "testuser".
Trying Pageant key #0
Authenticating with public key "CAPI:86638f637a801e00a6asomethingredacted" from agent
Sending Pageant's response
Access granted
Opening main session channel
Remote debug message: /home/testuser/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Remote debug message: /home/testuser/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Opened main channel
Started a shell/command
Connected to mysftpserver
Remote working directory is /home/testuser
psftp>

Reply with quote

Advertisement

Szabolcs Horvath
Guest

Re: workaround

Yes, that's correct, we're using PuTTY CAC, because certificates/keys are available via Windows Certificate API.

Basically a Pageant (https://github.com/NoMoreFood/putty-cac/blob/master/binaries/x64/pageant.exe) works with psftp (https://github.com/NoMoreFood/putty-cac/blob/master/binaries/x64/psftp.exe), but Pageant (very same putty-cac build) and WinSCP don't work.

The only thing changed is the SFTP server upgrade (before: RHEL 7.latest, now: RHEL9.3)

Reply with quote

Szabolcs Horvath
Guest

Re: workaround

When destination server is
  1. RHEL 7.9, pageant-cac + regular putty/psftp works!
  2. RHEL 8.9, pageant-cac + regular putty/psftp does not work anymore.
  3. RHEL 9.3, pageant-cac + regular putty/psftp and winscp does not work (putty, psftp and winscp fails with the very same error message)
  4. RHEL 9.3, pageant-cac + putty-cac works
I still do not know where to go next.

1) Destination server: RHEL 9.3

pageant-cac 0.80 + putty 0.80
login as: testuser
Authenticating with public key "CAPI:b03f25e213b2f6dabesomethingredacted" from agent
Server refused public-key signature despite accepting key!
testuser@10.99.99.99's password:

pageant-cac 0.80 + psftp 0.80
C:\>psftp -v
psftp: no hostname specified; use "open host.name" to connect
psftp> open testuser@mysftpserver
Looking up host "mysftpserver" for SSH connection
Connecting to 10.99.99.99 port 22
We claim version: SSH-2.0-PuTTY_Release_0.80
Connected to 10.99.99.99
Remote version: SSH-2.0-OpenSSH_8.7
Using SSH protocol version 2
No GSSAPI security context available
Doing ECDH key exchange with curve Curve25519, using hash SHA-256 (unaccelerated)
Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
Host key fingerprint is:
ssh-ed25519 255 SHA256:2w52/JXtmWN9oOFTfxlgagnOEN3LRpsdGeI7GS5WzFk
Initialised AES-256 SDCTR (AES-NI accelerated) outbound encryption
Initialised HMAC-SHA-256 (unaccelerated) outbound MAC algorithm
Initialised AES-256 SDCTR (AES-NI accelerated) inbound encryption
Initialised HMAC-SHA-256 (unaccelerated) inbound MAC algorithm
Pageant is running. Requesting keys.
Pageant has 1 SSH-2 keys
Using username "testuser".
Trying Pageant key #0
Authenticating with public key "CAPI:b03f25e213b2f6dabefa5cb7144778a841cc05b1" from agent
Sending Pageant's response
Server refused public-key signature despite accepting key!
Server refused public-key signature despite accepting key!
Using SSPI from SECUR32.DLL
Trying gssapi-with-mic...
Attempting GSSAPI authentication
GSSAPI authentication initialisation failed
The target was not recognized.
testuser@mysftpserver's password:

pageant-cac 0.80 + psftp-cac 0.80
C:\>psftp -v
psftp: no hostname specified; use "open host.name" to connect
psftp> open testuser@mysftpserver
Looking up host "mysftpserver" for SSH connection
Connecting to 10.99.99.99 port 22
We claim version: SSH-2.0-PuTTY_Release_0.78_1
Connected to 10.99.99.99
Remote version: SSH-2.0-OpenSSH_8.7
Using SSH protocol version 2
No GSSAPI security context available
Doing ECDH key exchange with curve Curve25519, using hash SHA-256 (unaccelerated)
Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
Host key fingerprint is:
ssh-ed25519 255 SHA256:2w52/JXtmWN9oOFTfxlgagnOEN3LRpsdGeI7GS5WzFk
Initialised AES-256 SDCTR (AES-NI accelerated) outbound encryption
Initialised HMAC-SHA-256 (unaccelerated) outbound MAC algorithm
Initialised AES-256 SDCTR (AES-NI accelerated) inbound encryption
Initialised HMAC-SHA-256 (unaccelerated) inbound MAC algorithm
Pageant is running. Requesting keys.
Pageant has 1 SSH-2 keys
Using username "testuser".
Trying Pageant key #0
Authenticating with public key "CAPI:b03f25e213b2f6dabefa5cb7144778a841cc05b1" from agent
Sending Pageant's response
Access granted
Opening main session channel
Remote debug message: /usr/bin/sss_ssh_authorizedkeys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Remote debug message: /usr/bin/sss_ssh_authorizedkeys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Opened main channel
Started a shell/command
Connected to mysftpserver
Remote working directory is /home/testuser
psftp>

2) Destination server: RHEL 7.9

pageant-cac 0.80 + psftp 0.80
C:\>psftp -v
psftp: no hostname specified; use "open host.name" to connect
psftp> open testuser@mysftpserver7
Looking up host "mysftpserver7" for SSH connection
Connecting to 10.99.99.98 port 22
We claim version: SSH-2.0-PuTTY_Release_0.80
Connected to 10.99.99.98
Remote version: SSH-2.0-OpenSSH_7.4
We believe remote version has SSH-2 RSA/SHA-2/certificate userauth bug
Using SSH protocol version 2
No GSSAPI security context available
Doing ECDH key exchange with curve Curve25519, using hash SHA-256 (unaccelerated)
Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
Host key fingerprint is:
ssh-ed25519 255 SHA256:2w52/JXtmWN9oOFTfxlgagnOEN3LRpsdGeI7GS5WzFk
Initialised AES-256 SDCTR (AES-NI accelerated) outbound encryption
Initialised HMAC-SHA-256 (unaccelerated) outbound MAC algorithm
Initialised AES-256 SDCTR (AES-NI accelerated) inbound encryption
Initialised HMAC-SHA-256 (unaccelerated) inbound MAC algorithm
Pageant is running. Requesting keys.
Pageant has 1 SSH-2 keys
Using username "testuser".
Trying Pageant key #0
Authenticating with public key "CAPI:b03f25e213b2f6dabefa5cb7144778a841cc05b1" from agent
Sending Pageant's response
Access granted
Opening main session channel
Opened main channel
Started a shell/command
Connected to mysftpserver7
Remote working directory is /home/testuser
psftp>

3) Destination server: RHEL 8.9

pageant-cac 0.80 + psftp 0.80
C:\>psftp -v
psftp: no hostname specified; use "open host.name" to connect
psftp> open testuser@mysftpserver8
Looking up host "mysftpserver8" for SSH connection
Connecting to 10.99.99.97 port 22
We claim version: SSH-2.0-PuTTY_Release_0.80
Connected to 10.99.99.97
Remote version: SSH-2.0-OpenSSH_8.0
Using SSH protocol version 2
Enabling strict key exchange semantics
Doing ECDH key exchange with curve Curve25519, using hash SHA-256 (unaccelerated)
Server also has ecdsa-sha2-nistp256/rsa-sha2-512/rsa-sha2-256/ssh-rsa host keys, but we don't know any of them
Host key fingerprint is:
ssh-ed25519 255 SHA256:2w52/JXtmWN9oOFTfxlgagnOEN3LRpsdGeI7GS5WzFk
Initialised AES-256 SDCTR (AES-NI accelerated) outbound encryption
Initialised HMAC-SHA-256 (unaccelerated) outbound MAC algorithm
Initialised AES-256 SDCTR (AES-NI accelerated) inbound encryption
Initialised HMAC-SHA-256 (unaccelerated) inbound MAC algorithm
Pageant is running. Requesting keys.
Pageant has 1 SSH-2 keys
Using username "testuser".
Trying Pageant key #0
Authenticating with public key "CAPI:b03f25e213b2f6dabefa5cb7144778a841cc05b1" from agent
Sending Pageant's response
Server refused public-key signature despite accepting key!
Server refused public-key signature despite accepting key!
Using SSPI from SECUR32.DLL
Trying gssapi-with-mic...
Attempting GSSAPI authentication
GSSAPI authentication initialised
GSSAPI authentication initialised
GSSAPI authentication loop finished OK
testuser@mysftpserver8's password:

Reply with quote

Advertisement

Advertisement

You can post new topics in this forum