Following yesterday’s post about issues getting “Server Refused Our Key” errors when trying to use PuTTY to log in to FreeBSD with a certificate, I thought I’d just lay to rest a few myths I’ve seen on various web sites where people have tried to explain how to do this. It’s easy to see how these myths develop – I’ve laboured for years under the misapprehension that I needed to do something or other when it was just a coincidence it had started working the first time the idea came to me. So here goes with a few of the myths. If you’re not getting this to work, it’s not for one of these reasons:
Myth: You need to specify 0600 permissions for the authorized_keys file (or the .ssh directory)
Simply not true. It may be a good idea to stop others from reading your keys, although they are “public” keys and won’t let anyone else in anyway (unless a they have a suitable cracking tool and a lot of processing power – and I mean a lot). Only your private key needs to be a secret. The only stipulation is that they must only writeable by the user – 0644 is okay, 0664 or 0666 isn’t.
But as I mentioned yesterday, you MUST ensure that your home directory is also not world-writable! You mustn’t have 0777 permissions! 0755 is okay, as is 0711. I’ve not seen this documented anyway, but it’s true for FreeBSD 7.0 to 9.0.
Myth: OpenSSH requires the authorized_keys file to be owned by the user trying to log in
Again no – it simply doesn’t. It has to be readable to that user (not just root) – this may be because it’s world readable or group readable for the user in question. It might as well be owned by root:wheel as long as it’s Other read bit is set.
Myth: If you’re using SSH2, you need a file called authorized_keys2
This might be true on some installations, but not current ones! I’ve no reason to believe that this file would even be considered, never mind required. The file used is defined in the /etc/ssh/sshd_config, and on current versions of FreeBSD (7.0-9.0) it’s definitely authorized_keys
Myth: You must generate the keys using the OpenSSH keygen utility on FreeBSD – puttygen doesn’t work
Well, there’s a bit of truth in this, but not much. Put simply, the format is different, but this only extends as far as the header and comment.
OpenSSH keys look like this:
ssh-rsa AAAAB3NzaC1y… very long line … sXi+fF noone@example.com
PuTTYGen Keys look like this:
---- BEGIN SSH2 PUBLIC KEY ---- Comment: "no one@example.com" AAAAB3NzaC1y … long line, possibly with breaks … sXi+fF ---- END SSH2 PUBLIC KEY ----
You can convert one to the other using any text editor of your choice, as long as it handles long lines properly (like vi).
I can see there could be all sorts of fun and games if you simply cut/pasted these end ended up with extra line breaks, spaces or truncation – but the key data and its encoding is exactly the same, and that’s the bit that makes it work or not.
If you generate your key using OpenSSH tools you will need to load it into PuTTY Gen and write a Private .ppk key on your Windoze box. Or not. It’s just a text file and you could put the appropriate wrapper on it, but you might as well just use PuTTY Gen.
Myth: You need to edit /etc/ssh/sshd_conf to enable certificate login
No you don’t. The default values as shipped work just fine. Because the file consists of commented out lines of parameters with their default values, I suspect people though that some have been confused about whether the ‘#’ needed to be removed before the parameter came in to effect. They don’t – you only need to remove the comment if you want to change the default value. If you do remove the comment, but don’t edit the value, it’ll make no difference to anything.
What’s Real
In my experience, problems are almost always down to either directory permissions (see above) or errors transcribing public keys from one machine to another – and chaos and confusion caused by the abovementioned myths!