SFTP: How do I pick they key to use?

[Erik Harclerode]

Hi,
I'm new to using SFTP and am having trouble getting the host/server computer to recognize my connection. The host that I'm trying to SFTP to already has my public key so I believe the problem is that I'm not including it as part of my connection string so that it can authenticate me first with the key, and then with my account password. Unfortunately the only way I've found to connect is using the "OPEN userid@hostinfo.com" string and don't know how to include a reference to the key in my connection string.

Any ideas?

Thanks for your help!
Erik

[Volker Halle]

Erik,

welcome to the OpenVMS ITRC forum.

Here is a pointer to a similar topic from back in 2005, I hope it will answer your question:

http://forums12.itrc.hp.com/service/forums/questionanswer.do?threadId=985928

Volker.

[Richard W Hunt]

Having just gone through part of this myself, here is what I got to work.

First you need the user's private key on the SSH/SFTP client side.

The client needs some sort of CONFIG file, see the product documentation for how it is named. Everybody has a different convention on this but it is usually CONFIG_something or something_CONFIG. Its location is some .SSH or .SSH2 folder in the path of your SSH/SFTP utility.

Inside that CONFIG file, you identify the location of the key file via the "IdentifyFile" clause - if the SFTP client supports that clause. The client CONFIG file can get very ugly if you have more than one user who logs in through that same client unless they have individual profiles a la' Windows user profiles and the client is installed per-user.

Probably you'll need the host's public key also noted somewhere in that file if you already know it. Otherwise the first time you connect, you will need to manually interact so that you can accept the host's public key. After that, you can more easily automate the process since many clients allow you to point to a script once you have the completed connection.

Of course, your HOST also has a CONFIG file where similar rules apply. Except that for the OpenVMS host, each user has a private .SSH2 folder with the pointers you need in the individual SSHD2_CONFIG files.

Note that if you go to ECO 7 of TCPIP services, you need to download the updated SSH manual, which you can find online by searching the HP site. (Sorry, don't have the link at hand, I've set it aside somewhere and now can't find it at the moment.)

[Erik Harclerode]

Hi,
Thank you for your help. I'm confused as to what the "IdentifyFile" file should be set at. Currently it simply says "identification"

thanks,
Erik

[Steven Schweda]

Believe it or not, it might help to know
which sort of computers, running which sort
of software, you're using as the client and
server. If either of them is running VMS,
then you may be asking your question in the
right place.

One place to start might be:

sftp "-V"

[Erik Harclerode]

We, the client, are using an OpenVMS system to run SFTP.

The results of sftp -V show the following, but I don't know what I'm supposed to be getting from this.

Sftp2/SFTP2.C:4642: CRTL version (SYS$SHARE:DECC$SHARE ident) is: V7.3-2-03

SshFileCopy/SSHFILECOPY.C:1080: Making local connection.
Ssh2SftpServer/SSHFILEXFERS.C:1758: Received SSH_FXP_INIT
Ssh2SftpServer/SSHFILEXFERS.C:1803: version is 3
SshFileCopy/SSHFILECOPY.C:1019: Connection to local, ready to serve requests.
Sftp2/SFTP2.C:798: Connection ready.
SshReadLine/SSHREADLINE.C:3670: Initializing ReadLine...

[Steven Schweda]

> The results of sftp -V [...]

Sadly, on VMS there's a difference between
what you did:
sftp -V
and what I suggested:
sftp "-V"
.

Around here:

alp $ sftp "-V"
alp$dka0:[sys0.syscommon.][sysexe]tcpip$ssh_sftp2.exe: SSH Secure Shell OpenVMS
(V5.5) 3.2.0 on COMPAQ Professional Workstation - VMS V7.3-2

And, according to "sftp -h", you can use:
[-o option_to_ssh2]
and, according to "ssh -h", you can specify:
-i file Identity file for public key authentication

So, I'd guess that something like this might
work:

sftp -o "-i other_id_file" [...]

where other_id_file contains text like:
IdKey actual_key_file_name
the way [.ssh2]identification should be doing
now.

Also, when playing with authentication
options and problems, it's often easier to
puzzle things out using SSH (with "-v"?) than
it is using the more complex SFTP.

[Erik Harclerode]

I'm still a bit unsure as to what I'm to do with the "-V", but here is the output:

$ sftp "-V"
dsa1:[sys0.syscommon.][sysexe]tcpip$ssh_sftp2.exe: SSH Secure Shell OpenVMS (V5.
5) 3.2.0 on hp AlphaServer GS1280 7/1300 - VMS V7.3-2

[Steven Schweda]

> I'm still a bit unsure as to what I'm to do
> with the "-V", but here is the output:

That was it. So now we all know with what
we're dealing, at least on the client side.

> I'm confused as to what the "IdentifyFile"
> file should be set at. Currently it simply
> says "identification"

That's fine. It means that SSH and its
friends will look at "[.ssh2]identification"
to get the name of the key files to use.

For example, on my system, I have two sets of
key files in [.ssh2] -- one with a passphrase
(SMS_ID_DSA_1024_A.*) and one without
(SMS_NPP_ID_DSA_1024_A.*). By default, SSH
gets the identity from
[.ssh2]identification., which on my system
says "IdKey SMS_NPP_ID_DSA_1024_A", so it
normally uses the no-passphrase keys.

alp $ ssh alp
Authentication successful.
[...]

If I want to use the with-passphrase keys, I
can specify an alternate identity file, say,
[.ssh2]identification._pp, which says "IdKey
SMS_ID_DSA_1024_A".

alp $ ssh -i identification._pp alp
Passphrase for key "/ALP$DKA0/sms/ssh2/SMS_ID_DSA_1024_A" with comment "1024-bit
dsa, sms@alp.antinode.org, Fri Jun 27 2003 03:57:52":

Authentication successful.
[...]

Similarly, for SFTP:

alp $ sftp alp
sftp> cd zx2000
ALP$DKA0:[SMS.ZX2000]
sftp> ls v*
VMS_INSTALL.TXT;3
VMS_INSTALL.TXT;2
VMS_INSTALL.TXT;1
sftp> quit

Or, using the with-passphrase keys (and the
correct SFTP syntax to specify the alternate
identity, unlike my earlier
suggestion/guess):

alp $ sftp -o "IdentityFile identification._pp" alp
Passphrase for key "/ALP$DKA0/sms/ssh2/SMS_ID_DSA_1024_A" with comment "1024-bit
dsa, sms@alp.antinode.org, Fri Jun 27 2003 03:57:52":
sftp> cd zx2000
ALP$DKA0:[SMS.ZX2000]
sftp> ls v*
VMS_INSTALL.TXT;3
VMS_INSTALL.TXT;2
VMS_INSTALL.TXT;1
sftp> quit


Now, back to the original problem.

> [...] am having trouble getting the
> host/server computer to recognize my
> connection.

What, exactly, does that mean? What command
did you use, and what, exactly, happened when
you tried it?

Do you have proper key files in your [.ssh2]
directory? Did you make them using
SSH_KEYGEN on the VMS system, or did you copy
them from some UNIX-like system somewhere
(where the key file formats are probably
different)?

Does "ssh other_host" work? If not, what is
the output you get from "ssh -v other_host"?
(Step one is to get a simple SSH command to
work.)

[Erik Harclerode]

Hi Steven, I really appreciate your continued support with this. Here are some answers/clarifications to questions you had.

First, problem #1 could've been the fact that the "identification." file did not exist on our system, so I created one that contained the "IdKey ID_DSA_2048_A" string. Actually, I created a identification._pp file just to mimic what you were showing me in your post.

Next, I tried multiple times to connect to the host system using the following commands and had no luck. I've included the error message that it is giving me.

$ SFTP -o "IdentityFile identification._pp" xyz@www.somesite.org
This is a private system.
Unauthorized access is prohibited and will
xyz@www.somesite.org's password:

warning: Authentication failed.
Disconnected; no more authentication methods available (No further authenticatio
n methods available.).
FATAL: ssh2 client failed to authenticate. (or you have too old ssh2 installed,
check with ssh2 "-V")

%TCPIP-F-SSH_FATAL, non-specific fatal error condition

~~~~~~~~~~~~~~~

$ ssh -i identification._pp xyz@www.somesite.org
This is a private system.
Unauthorized access is prohibited and will
xyz's password:

warning: Authentication failed.
Disconnected; no more authentication methods available (No further authenticatio
n methods available.).
~~~~~~~~~~~~~~~~
The key was originally created using the SSH_KEYGEN on the VMS system.

The results of "ssh other_host" is:
debug: Ssh2/SSH2.C:1906: CRTL version (SYS$SHARE:DECC$SHR.EXE ident) is V7.3-2-0
3
debug: SshAppCommon/SSHAPPCOMMON.C:322: Allocating global SshRegex context.
debug: SshConfig/SSHCONFIG.C:3332: Metaconfig parsing stopped at line 4.
debug: SshConfig/SSHCONFIG.C:861: Setting variable 'VerboseMode' to 'FALSE'.
debug: SshConfig/SSHCONFIG.C:3240: Unable to open ssh2/ssh2_config
debug: Connecting to other_host, port 22... (SOCKS not used)
debug: Ssh2/SSH2.C:2872: Entering event loop.
warning: Connecting to other_host failed: No address associated to the name
%TCPIP-E-SSH_ERROR, non-specific error condition