You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Julien Nicoulaud <ju...@gmail.com> on 2019/01/29 14:49:50 UTC
Can't get SSH key to work
Hi,
Does Guacamole support Ed25519 SSH keys ?
I can't get it to work, I always get a key import failure message:
guacd_1 | guacd[6]: INFO: Creating new client for protocol "ssh"
guacd_1 | guacd[6]: INFO: Connection ID is
"$bb601e6d-3328-4fbb-9b1b-46f37d229015"
guacamole | 14:39:01.033 [http-nio-8080-exec-14] INFO
o.a.g.tunnel.TunnelRequestService - User "nicoulaj" connected to connection
"3".
guacd_1 | guacd[296]: DEBUG: Parameter "font-name" omitted.
Using default value of "monospace".
guacd_1 | guacd[296]: DEBUG: Parameter "font-size" omitted.
Using default value of 12.
guacd_1 | guacd[296]: DEBUG: Parameter "color-scheme" omitted.
Using default value of "".
guacd_1 | guacd[296]: DEBUG: Parameter "enable-sftp" omitted.
Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter "sftp-root-directory"
omitted. Using default value of "/".
guacd_1 | guacd[296]: DEBUG: Parameter "read-only" omitted.
Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter "typescript-name"
omitted. Using default value of "typescript".
guacd_1 | guacd[296]: DEBUG: Parameter "create-typescript-path"
omitted. Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter "recording-name"
omitted. Using default value of "recording".
guacd_1 | guacd[296]: DEBUG: Parameter
"recording-exclude-output" omitted. Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter
"recording-exclude-mouse" omitted. Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter "recording-include-keys"
omitted. Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter "create-recording-path"
omitted. Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter "server-alive-interval"
omitted. Using default value of 0.
guacd_1 | guacd[296]: DEBUG: Parameter "backspace" omitted.
Using default value of 127.
guacd_1 | guacd[296]: DEBUG: Parameter "terminal-type" omitted.
Using default value of "linux".
guacd_1 | guacd[296]: INFO: User
"@2ebfa878-493f-4411-bda6-a0ce307bf0af" joined connection
"$bb601e6d-3328-4fbb-9b1b-46f37d229015" (1 users now present)
guacd_1 | guacd[296]: DEBUG: Attempting private key import
(WITHOUT passphrase)
guacd_1 | guacd[296]: DEBUG: Initial import failed: (null)
guacd_1 | guacd[296]: DEBUG: Re-attempting private key import
(WITH passphrase)
guacd_1 | guacd[296]: ERROR: Auth key import failed: (null)
guacd_1 | guacd[296]: INFO: User
"@2ebfa878-493f-4411-bda6-a0ce307bf0af" disconnected (0 users remain)
guacd_1 | guacd[296]: INFO: Last user of connection
"$bb601e6d-3328-4fbb-9b1b-46f37d229015" disconnected
I am using guacamole official Docker images (latest 1.0.0), the key was
created using OpenSSH's "ssh-keygen -t ed25519" with a passphrase. I pasted
it with the header and footer and tried several variants (lines merged,
blank line after, etc)...
Any idea how to further debug this ?
Thanks,
Julien
Re: Can't get SSH key to work
Posted by Nick Couchman <vn...@apache.org>.
On Fri, Mar 1, 2019 at 4:18 PM Julien Nicoulaud <ju...@gmail.com>
wrote:
> I did some more digging and I found that:
>
> - RSA keys are only supported in PEM format. But since OpenSSH 7.8
> (2018), ssh-keygen changed its default format. I opened
> https://issues.apache.org/jira/browse/GUACAMOLE-745
> - ED25519 keys are definitely not supported, the key loading code
> explicitly looks for hardcoded RSA or DSA headers here:
> https://github.com/apache/guacamole-server/blob/master/src/common-ssh/key.c#L40
> I opened a feature request:
> https://issues.apache.org/jira/browse/GUACAMOLE-746
>
> But both need to wait for a new libssh2 release including this commit:
> https://github.com/libssh2/libssh2/commit/03092292597ac601c3f9f0c267ecb145dda75e4e
>
Thanks for the research, Julien!
-Nick
>
Re: Can't get SSH key to work
Posted by Julien Nicoulaud <ju...@gmail.com>.
I did some more digging and I found that:
- RSA keys are only supported in PEM format. But since OpenSSH 7.8
(2018), ssh-keygen changed its default format. I opened
https://issues.apache.org/jira/browse/GUACAMOLE-745
- ED25519 keys are definitely not supported, the key loading code
explicitly looks for hardcoded RSA or DSA headers here:
https://github.com/apache/guacamole-server/blob/master/src/common-ssh/key.c#L40
I opened a feature request:
https://issues.apache.org/jira/browse/GUACAMOLE-746
But both need to wait for a new libssh2 release including this commit:
https://github.com/libssh2/libssh2/commit/03092292597ac601c3f9f0c267ecb145dda75e4e
I guess error messages could be improved in the meanwhile though, as I will
probably not be the last one to hit these issues...
Le ven. 1 mars 2019 à 17:17, Nick Couchman <vn...@apache.org> a écrit :
> On Tue, Feb 26, 2019 at 2:57 PM Julien Nicoulaud <
> julien.nicoulaud@gmail.com> wrote:
>
>> No useful info in debug mode (see my first message, it has a log with
>> guacd debug logging)
>>
>
> Hmmm...not really sure what's going on, here. I'm able to successfully
> use it with the following steps:
> - Guacamole from git master, with JDBC module
> - On the destination system, under the account I want to log in under
> (testuser), do "ssh-keygen -t rsa -b 1024" and don't set a passphrase
> - Add the public key to the authorized_keys file (actually, there were no
> other authorized_keys entries, so just copied .ssh/id_rsa.pub to
> .ssh/authorized_keys
> - Configure Guacamole SSH connection to the host, with a fixed username,
> and pasting in the private key with header and footer
> - Start the connection
>
> It connects fine - no issues, here.
>
> -Nick
>
>>
Re: Can't get SSH key to work
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Feb 26, 2019 at 2:57 PM Julien Nicoulaud <ju...@gmail.com>
wrote:
> No useful info in debug mode (see my first message, it has a log with
> guacd debug logging)
>
Hmmm...not really sure what's going on, here. I'm able to successfully use
it with the following steps:
- Guacamole from git master, with JDBC module
- On the destination system, under the account I want to log in under
(testuser), do "ssh-keygen -t rsa -b 1024" and don't set a passphrase
- Add the public key to the authorized_keys file (actually, there were no
other authorized_keys entries, so just copied .ssh/id_rsa.pub to
.ssh/authorized_keys
- Configure Guacamole SSH connection to the host, with a fixed username,
and pasting in the private key with header and footer
- Start the connection
It connects fine - no issues, here.
-Nick
>
Re: Can't get SSH key to work
Posted by Julien Nicoulaud <ju...@gmail.com>.
No useful info in debug mode (see my first message, it has a log with guacd
debug logging)
Le mar. 26 févr. 2019 à 18:48, Nick Couchman <vn...@apache.org> a écrit :
>
>
> On Tue, Feb 26, 2019 at 12:37 PM Julien Nicoulaud <
> julien.nicoulaud@gmail.com> wrote:
>
>> Actually this is not due to ED25519, I can't get any SSH key to work,
>> guacd always fails with "Auth key import failed: (null)".
>>
>> Tried ED25519 keys, RSA 1024b, and RSA 4096b keys.
>> Tried keys with and without passphrase.
>> Tried setting the passphrase in the web UI or at the connection prompt.
>> Tried changing db from postgres to mysql.
>> Tried removing new lines from key / adding blank line before header or
>> after footer / converting between unix and windows new lines.
>>
>> Running out of ideas...
>>
>>
> Can you put guacd into debug logging (GUACD_LOG_LEVEL=debug) and get the
> logs and see if anything more useful is returned?
>
> -Nick
>
Re: Can't get SSH key to work
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Feb 26, 2019 at 12:37 PM Julien Nicoulaud <
julien.nicoulaud@gmail.com> wrote:
> Actually this is not due to ED25519, I can't get any SSH key to work,
> guacd always fails with "Auth key import failed: (null)".
>
> Tried ED25519 keys, RSA 1024b, and RSA 4096b keys.
> Tried keys with and without passphrase.
> Tried setting the passphrase in the web UI or at the connection prompt.
> Tried changing db from postgres to mysql.
> Tried removing new lines from key / adding blank line before header or
> after footer / converting between unix and windows new lines.
>
> Running out of ideas...
>
>
Can you put guacd into debug logging (GUACD_LOG_LEVEL=debug) and get the
logs and see if anything more useful is returned?
-Nick
Re: Can't get SSH key to work
Posted by Julien Nicoulaud <ju...@gmail.com>.
Actually this is not due to ED25519, I can't get any SSH key to work, guacd
always fails with "Auth key import failed: (null)".
Tried ED25519 keys, RSA 1024b, and RSA 4096b keys.
Tried keys with and without passphrase.
Tried setting the passphrase in the web UI or at the connection prompt.
Tried changing db from postgres to mysql.
Tried removing new lines from key / adding blank line before header or
after footer / converting between unix and windows new lines.
Running out of ideas...
Here is the docker-compose file I use, in case that rings a bell:
version: '2.2'
networks:
traefik:
external: true
guacamole:
external: true
services:
guacamole:
container_name: guacamole
image: guacamole/guacamole
restart: always
cpu_percent: 80
mem_limit: 1G
depends_on:
- guacd
- database
labels:
- traefik.enable=true
- traefik.docker.network=traefik
-
traefik.frontend.rule=Host:guacamole.XXXXXXXXXXX;AddPrefix:/guacamole
- traefik.frontend.auth.forward.address=https://XXXXXXXXXXXXXXXXXXXXXX
- traefik.port=8080
environment:
- GUACD_HOSTNAME=guacd
- GUACAMOLE_HOME=/etc/guacamole-home
- MYSQL_HOSTNAME=database
- MYSQL_DATABASE=guacamole
- MYSQL_USER=guacamole
- MYSQL_PASSWORD=XXXXXXXXXXX
volumes:
- ./home:/etc/guacamole-home:ro
- /etc/localtime:/etc/localtime:ro
networks:
- guacamole
- traefik
guacd:
container_name: guacamole_guacd
image: guacamole/guacd
restart: always
environment:
- GUACD_LOG_LEVEL=warning
volumes:
- /var/lib/guacamole/drive:/drive:rw
- /var/lib/guacamole/record:/record:rw
- /etc/localtime:/etc/localtime:ro
networks:
- guacamole
database:
container_name: guacamole_database
image: mariadb
restart: always
cpu_percent: 80
mem_limit: 128M
environment:
- MYSQL_DATABASE=guacamole
- MYSQL_USER=guacamole
- MYSQL_PASSWORD=XXXXXXXXXXX
- MYSQL_ROOT_PASSWORD=XXXXXXXXXXX
volumes:
- ./init:/docker-entrypoint-initdb.d:ro
- /var/lib/guacamole/database:/var/lib/mysql
- /etc/localtime:/etc/localtime:ro
networks:
- guacamole
Le mar. 29 janv. 2019 à 16:13, Nick Couchman <vn...@apache.org> a écrit :
> On Tue, Jan 29, 2019 at 9:58 AM Julien Nicoulaud <
> julien.nicoulaud@gmail.com> wrote:
>
>> Hi,
>>
>> Does Guacamole support Ed25519 SSH keys ?
>>
>
> This would more depend on whether or not libssh2 supports it, and in what
> version of libssh2 it exists. guacd leverages libssh2 for the underlying
> SSH functionality, so most of the issues that occur like this are due to
> (lack of) support in the underlying library.
>
> According to https://libssh2.org/ ssh-rsa and ssh-dss are supported.
>
> -Nick
>
Re: Can't get SSH key to work
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Jan 29, 2019 at 9:58 AM Julien Nicoulaud <ju...@gmail.com>
wrote:
> Hi,
>
> Does Guacamole support Ed25519 SSH keys ?
>
This would more depend on whether or not libssh2 supports it, and in what
version of libssh2 it exists. guacd leverages libssh2 for the underlying
SSH functionality, so most of the issues that occur like this are due to
(lack of) support in the underlying library.
According to https://libssh2.org/ ssh-rsa and ssh-dss are supported.
-Nick