✅ Can't connect to sshd on macOS

[swathanasin]

I can connect using webssh to a Linux box using private/public keys but when I try to do the same to a macOS box, it fails with "Provided credentials are bad". What credentials? The host key? The private key on the iPhone? I've tried with different vers of macOS from 10.13 - 11.6. As far as I can tell, the connection profiles of the on that works and the ones that fail are the same (with differentt hostnames/IPs, of course). ssh between the macOS boxes work just fine.

I'm clearly missing something; any ideas? How can I do the equivalent of "ssh -v" so I can see what's going on?

Thanks
Sak

[isontheline]

Hello @swathanasin 👋

The "alternative" of ssh -v on WebSSH is to enable verbose logging :

1. iOS Settings
2. WebSSH
3. Settings
4. Log Level > Verbose

• You can now restart WebSSH. The log files will be available inside iOS > Files > WebSSH
• Then you will be able to show why you can't connect to your computers.

Have a nice day ☀️

[swathanasin]

OK, thanks for that info. So, using that I see that it's the private key that it's objecting to:

<info>Sent public-key request with signature.</info> <error>Authentication failed or partial success. (4)</error> <PartialSuccess4>0</PartialSuccess4> <error>When partial success is 0, it means you are NOT using the correct private key that corresponds to the public key installed in the SSH user account.</error> <AuthList>publickey,password,keyboard-interactive</AuthList> <error>Publickey authentication failed..</error>
Which is puzzling because the same keypair (there is only one) logs me into a Centos 7 box. And, yes, I have the same pub key in my .ssh/authorized_keys on my Mac. Possibly the wrong format, key length too short? This key was generated a long time ago, so long that I can't remember how I created it.

I then tried generating a new key using ssh-keygen on the Mac, but webssh doesn't like the private key format. Does anyone know how to convert it to the required format? Or is there some other way of generating a keypair?

Many thanks
Sak

[isontheline]

@swathanasin Could you post an example of a unused keypair in order to check the bad format?

Or is there some other way of generating a keypair?

You can generate a PEM keypair by the use of : ssh-keygen -t rsa -b 4096

[swathanasin]

Could you post an example of a unused keypair?

Sorry, not sure what you want here. As I wrote, I can’t remember how I generated the keypair that the iPhone currently uses, but the private key is:

-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,C711CF9A2A45447B …. UnKoWRhfocF7r7nAHFy18Al3L4qsGJ5h2vd3nq8dsZk= -----BEGIN RSA PRIVATE KEY----- The pub key is ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIB09VkXboPXPsS752eaAamIWrNA98SnQmHIvIVliSpWl4dVXu7xUvslcOkz9jSW97Bb/xFGJ5fuzmR4fjWuNMhi20sf1LixklCPfyMoIikWB8/oorpmLO1CGCQYywKyYqrYS5x4Qn4L6upP+VtsfyzpqSdQPCWnFEmFvRLm3GRr2w== 8457c6b8ca9fef77be4504b7899344e2746a2b65-iphone-rsa-key-20100628 (Wow, 11 years ago!) This keypair works with my (Centos 7) VPSes, but not with the macOS sshd. I don’t know where macOS logs its auth failures - they aren’t in /var/log/system.log -, so I don’t know what it’s objecting to.

You can generate a PEM keypair by the use of : ssh-keygen -t rsa -b 4096

Thanks; I’ll try that. Regards Sak

[swathanasin]

You can generate a PEM keypair by the use of : ssh-keygen -t rsa -b 4096

OK, that works great! I replaced my old key with the one generated using the above and now I can ssh into all my servers, macOS and Linux.

Many thanks
Sak

[isontheline]

@swathanasin Thank you a lot for your feedback 🙏