Permission denied (publickey,gssapi-keyex,gssapi-with-mic)but my Ignition configuration is successfuly applied

[navman]

Hello everyone!

Id first like to say thank you for everyone contributing to this project, I’ve only just discovered Coreos after reading a Xen-Orchestra blog post detailing Xen’s support for docker environments via coreos.
Which is perfect as I want to run some SNMP monitoring software for a few servers, RAID cards and printers in such an environment.

But!

I’m 3 days in, have tried multiple configurations and am still unable to SSH with my private key.

Below I will detail my procedure with as much information and screenshots as available and hopefully someone can tell me where I am falling over.

1. Generating the key with Puttygen;

• 2048 Bits
• No passhprase

Saving the private key file for loading into putty session under
Connection → SSH → Auth-> Private key selected

Also copying the text box ssh-rsa for the Ignition configuration

2. File name: coreos.fcc

variant: fcos
version: 1.3.0
passwd:
users:
- name: orthia
groups:
- “sudo”
- “docker”
ssh_authorized_keys:
- “ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlLs8dyxjXfhjg3zVoaV3W91g6Y5jYh6z4RdWMohElTSCnotworriedaboutyouguysseeingthekeyimgonnagenerateanotheroneanyway<301VOEqeXe+jfNrKX4KDKVhkUlZupxg2qKfTYbmz3OGmRdUx7c8Tco5Igz4aNSo2XPKx1HBQhXNud6wOh2gFcGJqixxWjcWn2iOiGLnFjNpervxxzbJjfP5M5FeUeIeZkrIYaQCLDbjqDl6d3oLw==”
systemd:
units:
- name: docker.service
enabled: true
- name: containerd.service
enabled: true
- name: serial-getty@ttyS0.service
dropins:
- name: autologin-core.conf
contents: |
[Service]
# Override Execstart in main unit
ExecStart=
# Add new Execstart with - prefix to ignore failure
ExecStart=-/usr/sbin/agetty --autologin core --noclear %I $TERM
TTYVTDisallocate=no
storage:
files:
- path: /etc/hostname
mode: 0644
contents:
inline: |
orthia
- path: /etc/profile.d/systemd-pager.sh
mode: 0644
contents:
inline: |
# Tell systemd to not use a pager when printing information
export SYSTEMD_PAGER=cat
- path: /etc/sysctl.d/20-silence-audit.conf
mode: 0644
contents:
inline: |
# Raise console message logging level from DEBUG (7) to WARNING (4)
# to hide audit messages from the interactive console
kernel.printk=4

Have checked the YAML is valid with codebeautify’s yaml-validator.

3. On a Ubuntu VM I’m executing the following command.

podman run -i --rm Quay --pretty --strict < coreos.fcc > coreos.ign

As a result I’m left with the coreos.ign file

{
“ignition”: {
“version”: “3.2.0”
},
“passwd”: {
“users”: [
{
“groups”: [
“sudo”,
“docker”
],
“name”: “orthia”,
“sshAuthorizedKeys”: [
“ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlLs8dyxjXfhjg3zVoaV3W91g6<3co5Igz4aNSo2XPKx1HBQhXNud6wOh2gFcGJqixxWjcWn2iOiGLnFjNpervxxzbJjfP5M5FeUeIeZkrIYaQCLDbjqDl6d3oLw==”
]
}
]
},
“storage”: {
“files”: [
{
“path”: “/etc/hostname”,
“contents”: {
“source”: “data:,orthia%0A”
},
“mode”: 420
},
{
“path”: “/etc/profile.d/systemd-pager.sh”,
“contents”: {
“source”: “data:,%23%20Tell%20systemd%20to%20not%20use%20a%20pager%20when%20printing%20information%0Aexport%20SYSTEMD_PAGER%3Dcat%0A”
},
“mode”: 420
},
{
“path”: “/etc/sysctl.d/20-silence-audit.conf”,
“contents”: {
“source”: “data:,%23%20Raise%20console%20message%20logging%20level%20from%20DEBUG%20(7)%20to%20WARNING%20(4)%0A%23%20to%20hide%20audit%20messages%20from%20the%20interactive%20console%0Akernel.printk%3D4”
},
“mode”: 420
}
]
},
“systemd”: {
“units”: [
{
“enabled”: true,
“name”: “docker.service”
},
{
“enabled”: true,
“name”: “containerd.service”
},
{
“dropins”: [
{
“contents”: “[Service]\n# Override Execstart in main unit\nExecStart=\n# Add new Execstart with - prefix to ignore failure\nExecStart=-/usr/sbin/agetty --autologin core --noclear %I $TERM\nTTYVTDisallocate=no\n”,
“name”: “autologin-core.conf”
}
],
“name”: “serial-getty@ttyS0.service”
}
]
}
}

4. Server is running Cirtix HyperVisior version 8.2
   Loading the BareMetal ISO fedora-coreos-33.20210201.3.0-live.x86_64.iso

Live booting off the image, then running the following.

sudo coreos-installer install /dev/xvda --ignition-url https://example.com/coreos.ign

Reads disk without issues and begins installation.

• Writing Ignition config
• Install Complete

5. On reboot

Ignition: User provided config was applied
Ignition: wrote ssh authorized keys file for user: orthia

I have also tried with username core but still with no such luck!

The error when I try to putty in is

No supported authentication methods available (server send: publickey, gssapi-keyex,gssapi-with-mic)

Can provide direct link to config files if required, I’m sure the quoting system doesn’t preserve correct formatting.

Any help will be appreciated,

[bgilbert (Benjamin Gilbert)]

Your SSH client is likely too old. Fedora 33 and above no longer allow ssh-rsa authentication using a SHA1 message digest, due to security concerns. ssh-rsa keys are fine and can still be used, but the SSH client needs to use them with a newer SHA2-based authentication handshake. You might be able to fix this by upgrading your SSH client, or you could try switching to an ed25519 or ECDSA key.

[navman]

@bgilbert

Your SSH client is likely too old

Hello Benjamin,

Thank you for your prompt reply.
I’m running the latest version of putty Release 0.74 and puttygen Release 0.74

The RSA key generated is a RSA-2 key, I will how ever generate a ed25519 keypair and get back to you!

[navman]

@bgilbert

ECDSA key.

Hello Benjamin,

That did it.