This is a discussion on Opensshx509 installation problem - SSH ; Hi all, I'm trying to install ssh server based on x509 certificates with no result. What I've done is the following: - Build openssh4.7p1 after patching with openssh-4.7p1+x509-6.1.diff.gz without error using ./configure --prefix=/opt/ssh && make && make install in both ...
I'm trying to install ssh server based on x509 certificates with no result. What I've done is the following:
- Build openssh4.7p1 after patching with openssh-4.7p1+x509-6.1.diff.gz without error using ./configure --prefix=/opt/ssh && make && make install in both server and client machines
- Create minimal openssl ca structure under /opt/ssh/etc/ca
( self signed CA certificate, server certificate signed by CA, client certificate signed by CA ). I now have certificates cacert.pem, server.pem and client.pem and keys for all three
- Build server host id using (under /opt/ssh/etc):
cat server-key.pem > ssh_host_key_cert
cat server.pem >> ssh_host_key_cert
chmod 0600 ssh_host_key_cert
../bin/ssh-keygen -y > ssh_host_key_cert.pub
// entering ssh_host_key_cert as key
- Changing /opt/ssh/etc/sshd_config:
- Customizing server user configuration
cat /opt/ssh/etc/ssh_host_key_cert.pub > .ssh/authorized_keys
- Now __On client machine__ (after copying, client.pem, client-key.pem and cacert.pem)
- Build identity
- cat ~/.ssh/client-key.pem > /.ssh/id_rsa
- cat ~/.ssh/client.pem >> ~/.ssh/id_rsa
- chmod 0600 ~/.ssh/id_rsa
- /opt/ssh/bin/ssh-keygen -y > ~/.ssh/id_rsa.pub
// entering ~/.ssh/id_rsa as key
- Introducing following changes into /opt/ssh/etc/ssh_config
Finally lauching sshd on server with
/opt/ssh/sbin/sshd -f /opt/ssh/etc/sshd_config -d -d -d
And client with:
/opt/ssh/bin/ssh -vvv -f /opt/ssh/etc/ssh_config -d -d -d myuser-at-myserver
Which output is:
The authenticity of host '[myserver]:4422 ([192.168.0.201]:4422)' can't be established.
RSA+cert key fingerprint is 4c:3a:1b:2d:40:23:1d:99:aa:d2:eb:b3:28:8c:d2:d4.
Distinguished name is 'C=ES,ST=Madrid,O=blub,CN=Server'.
Are you sure you want to continue connecting (yes/no)? yes
But I get 'Permission denied (publickey,keyboard-interactive)' error. I've sshd and ssh outputs but are quite long, I'll append them if
above configuration seems ok.
Many thanks in advance.