Context
I’m using paramiko 3.4.0 to establish an SFTP connection and authenticate using an ssh-rsa key. While I can successfully connect using the terminal with sftp -i /path/to/private/key username@host_name, the same authentication fails with paramiko, showing Authentication (publickey) failed.
This paramiko implementation works for various servers, including a legacy FTP server, but fails for a recently implemented SFTP server. This server accepts ssh-rsa keys.
Implementation
The following code illustrates the basic components used to establish the SFTP connection:
ssh = SSHClient()
ssh.load_host_keys(known_hosts_file)
# Create a key object (io.StringIO), to create a file-like object from a string.
private_key = paramiko.RSAKey.from_private_key(io.StringIO(private_key))
ssh.connect(
host,
port=port,
# If host is a legacy SSH server which doesn't support
# rsa-sha2-256/512 signatures, disable them.
disabled_algorithms={"pubkeys": ["rsa-sha2-256", "rsa-sha2-512"]},
username=username,
pkey=private_key,
allow_agent=False,
look_for_keys=False,
)
sftp = ssh.open_sftp()
This implementation expects all public and private keys used to authenticate to the servers to be of a ssh-rsa key type. The SSH server does accept ssh-rsa key types for public keys.
Client Logs
Upon execution of the code containing the basic components above, the following client side logs are displayed:
2024-05-24 15:16:52,505-DEBUG-paramiko.transport::transport|1909:: starting thread (client mode): 0x818a36d0
2024-05-24 15:16:52,506-DEBUG-paramiko.transport::transport|1909:: Local version/idstring: SSH-2.0-paramiko_3.4.0
2024-05-24 15:16:52,524-DEBUG-paramiko.transport::transport|1909:: Remote version/idstring: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
2024-05-24 15:16:52,524-INFO-paramiko.transport::transport|1909:: Connected (version 2.0, client OpenSSH_8.9p1)
2024-05-24 15:16:52,526-DEBUG-paramiko.transport::transport|1909:: === Key exchange possibilities ===
2024-05-24 15:16:52,526-DEBUG-paramiko.transport::transport|1909:: kex algos: curve25519-sha256, [email protected], ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, [email protected], diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256, [email protected]
2024-05-24 15:16:52,527-DEBUG-paramiko.transport::transport|1909:: server key: rsa-sha2-512, rsa-sha2-256, ecdsa-sha2-nistp256, ssh-ed25519
2024-05-24 15:16:52,527-DEBUG-paramiko.transport::transport|1909:: client encrypt: aes128-ctr, aes192-ctr, aes256-ctr, [email protected], [email protected]
2024-05-24 15:16:52,527-DEBUG-paramiko.transport::transport|1909:: server encrypt: aes128-ctr, aes192-ctr, aes256-ctr, [email protected], [email protected]
2024-05-24 15:16:52,527-DEBUG-paramiko.transport::transport|1909:: client mac: [email protected], [email protected], [email protected], [email protected], hmac-sha2-256, hmac-sha2-512
2024-05-24 15:16:52,527-DEBUG-paramiko.transport::transport|1909:: server mac: [email protected], [email protected], [email protected], [email protected], hmac-sha2-256, hmac-sha2-512
2024-05-24 15:16:52,527-DEBUG-paramiko.transport::transport|1909:: client compress: none, [email protected]
2024-05-24 15:16:52,528-DEBUG-paramiko.transport::transport|1909:: server compress: none, [email protected]
2024-05-24 15:16:52,528-DEBUG-paramiko.transport::transport|1909:: client lang: <none>
2024-05-24 15:16:52,528-DEBUG-paramiko.transport::transport|1909:: server lang: <none>
2024-05-24 15:16:52,528-DEBUG-paramiko.transport::transport|1909:: kex follows: False
2024-05-24 15:16:52,528-DEBUG-paramiko.transport::transport|1909:: === Key exchange agreements ===
2024-05-24 15:16:52,528-DEBUG-paramiko.transport::transport|1909:: Strict kex mode: True
2024-05-24 15:16:52,528-DEBUG-paramiko.transport::transport|1909:: Kex: [email protected]
2024-05-24 15:16:52,529-DEBUG-paramiko.transport::transport|1909:: HostKey: ssh-ed25519
2024-05-24 15:16:52,529-DEBUG-paramiko.transport::transport|1909:: Cipher: aes128-ctr
2024-05-24 15:16:52,529-DEBUG-paramiko.transport::transport|1909:: MAC: hmac-sha2-256
2024-05-24 15:16:52,529-DEBUG-paramiko.transport::transport|1909:: Compression: none
2024-05-24 15:16:52,529-DEBUG-paramiko.transport::transport|1909:: === End of kex handshake ===
2024-05-24 15:16:52,579-DEBUG-paramiko.transport::transport|1909:: Resetting outbound seqno after NEWKEYS due to strict mode
2024-05-24 15:16:52,580-DEBUG-paramiko.transport::transport|1909:: kex engine KexCurve25519 specified hash_algo <built-in function openssl_sha256>
2024-05-24 15:16:52,580-DEBUG-paramiko.transport::transport|1909:: Switch to new keys ...
2024-05-24 15:16:52,581-DEBUG-paramiko.transport::transport|1909:: Resetting inbound seqno after NEWKEYS due to strict mode
2024-05-24 15:16:52,581-DEBUG-paramiko.transport::transport|1909:: Got EXT_INFO: {'server-sig-algs': b'ssh-ed25519,[email protected],ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected]', '[email protected]': b'0'}
2024-05-24 15:16:52,582-DEBUG-paramiko.transport::transport|1909:: Trying SSH key b'26bdb6d7dd6f3459c4131b73925757de'
2024-05-24 15:16:52,624-DEBUG-paramiko.transport::transport|1909:: userauth is OK
2024-05-24 15:16:52,625-DEBUG-paramiko.transport::transport|1909:: Finalizing pubkey algorithm for key of type 'ssh-rsa'
2024-05-24 15:16:52,625-DEBUG-paramiko.transport::transport|1909:: Our pubkey algorithm list: ['ssh-rsa']
2024-05-24 15:16:52,625-DEBUG-paramiko.transport::transport|1909:: Server-side algorithm list: ['ssh-ed25519', '[email protected]', 'ssh-rsa', 'rsa-sha2-256', 'rsa-sha2-512', 'ssh-dss', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', '[email protected]', '[email protected]']
2024-05-24 15:16:52,625-DEBUG-paramiko.transport::transport|1909:: Agreed upon 'ssh-rsa' pubkey algorithm
2024-05-24 15:16:52,658-INFO-paramiko.transport::transport|1909:: Authentication (publickey) failed.
The logs indicate that the connection to the server was successfully established, and the key exchange was completed. However, the authentication using the ssh-rsa public key failed.
Server Logs
The corresponding server side logs follow, where [server_name], [username] and [ip_address] are redacted:
May 24 15:16:56 [server_name] sshd[140982]: Connection closed by authenticating user [username] [ip_address] port 46310 [preauth]
Unfortunately the combination of logs provide little insight into the underlying authentication issue, since paramiko raises the generic Authentication failed. exception when the transport layer has no saved exceptions and the client isn’t authenticated.
Questions
- What could be the reason for the
Authentication (publickey) failederror? - How can I debug this further to identify the underlying issue (which is possibly client or server side)?