SSH agent forwarding doesn't work on secondary authentication :: Support Forum

Guest

SSH agent forwarding doesn't work on secondary authentication

2022-06-17 15:44

Hello this is a bug report :

WinSCP bugged version : 5.21
Latest working version : 5.19.6
Windows version : Windows 10 Pro 21H2
Transfer Protocol : SFTP
Using GUI

Here is the error message (sorry it's in French I'll translate roughly) :

Authentication Log (see session log for more details) :
Using user "user@server@domain:SSH:user@access_control_server".
The server has refused the key.

We have a secure environment where we need to hop through a first server which doesn't use RSA keys for authentication and then a second server which does only use RSA keys to authenticate users.

Here is a extract of the session log:

. 2022-06-17 10:44:11.777 esogiplm@eso.local's password: ")
. 2022-06-17 10:44:11.777 Prompting user for the credentials.
. 2022-06-17 10:44:14.028 Prompt responded.
. 2022-06-17 10:44:14.150 Access granted
. 2022-06-17 10:44:14.150 Opening main session channel
. 2022-06-17 10:44:14.166 Opened main channel
. 2022-06-17 10:44:14.181 Agent forwarding enabled
. 2022-06-17 10:44:14.482 Started a shell/command
. 2022-06-17 10:44:14.498 Attempt to close connection due to fatal exception:
* 2022-06-17 10:44:14.498 Impossible de définir un évènement de réseau (erreur 10038).
. 2022-06-17 10:44:14.498 Closing connection.
. 2022-06-17 10:44:14.498 Sending special code: 1
. 2022-06-17 10:44:14.498 Rejected channel open: Unsupported channel type requested
* 2022-06-17 10:44:15.074 (EFatal) Impossible de définir un évènement de réseau (erreur 10038).
* 2022-06-17 10:44:15.074 Authentication Log (see session log for more details) :
* 2022-06-17 10:44:15.074 Using user "user@server@domain:SSH:user@access_control_server".
* 2022-06-17 10:44:15.074 The server has refused the key.
* 2022-06-17 10:44:15.074 
* 2022-06-17 10:44:15.074 Erreur d'authentification

Thanks

Reply with quote

Guest

2022-06-17 15:48

I realize i forgot to say what the problem is ...
The session can't connect because it fails before authenticating on the secondary server.
We have found in the auth-logs that WinSCP doesn't seem to forward the RSA key but there is also a "fatal error" in WinSCP's log around that step.

Reply with quote