You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@mina.apache.org by "liuziyu1226 (via GitHub)" <gi...@apache.org> on 2024/12/27 07:04:59 UTC
[I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
liuziyu1226 opened a new issue, #650:
URL: https://github.com/apache/mina-sshd/issues/650
### Version
2.8.0
### Bug description
I overwrote the authenticate function of the PublickeyAuthenticator.java and registered it with the ssh server.
`sshServer.setPublickeyAuthenticator(publicKeyAuth);`
But when the client provides the key and certificate, MINA SSHD displays an error:
`2024-12-25 17:29:30.882 sshd-SshServer[53600a30](port=2222)-nio2-thread-5 WARN org.apache.sshd.server.session.ServerUserAuthService.warn - handleUserAuthRequestMessage(ServerSessionImpl[null@/127.0.0.1:56562]) Failed (InvalidKeyException) to authenticate using factory method=publickey: Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance`
After debugging, I found that the problem is that when MINA SSHD initializes the signature verifier of the public key, the public key passed in is of type OpenSshCertificateImpl, while Signature expects an RSAPublicKey object. Why does this problem occur? How can I solve it?
### Actual behavior
My ssh server configuration：
`sshServer = SshServer.setUpDefaultServer();
sshServer.setPort(2222);
sshServer.setKeyPairProvider(ResolveServerKeys.getKey());
sshServer.setPasswordAuthenticator(passwordAuth);
sshServer.setKeyboardInteractiveAuthenticator(interactiveAuth);
sshServer.setPublickeyAuthenticator(publicKeyAuth);
sshServer.setShellFactory(jumperShellFactory);
...
`
### Expected behavior
I expect that when the client uses public key authentication, it can enter the authenticate function I overwrote to verify it and return the result, but it has not entered my method yet and an exception is thrown when initializing the signature verifier.
### Relevant log output
_No response_
### Other information
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "liuziyu1226 (via GitHub)" <gi...@apache.org>.
liuziyu1226 closed issue #650: Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance
URL: https://github.com/apache/mina-sshd/issues/650
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "liuziyu1226 (via GitHub)" <gi...@apache.org>.
liuziyu1226 commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2594784601
OK, I will write my PR in the next few weeks after work, and I hope my work can make a small contribution to this open source project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "liuziyu1226 (via GitHub)" <gi...@apache.org>.
liuziyu1226 commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2575092369
Yes, the fundamental problem is that when initializing Signature, instead of getting cert publickey from OpenSshCertificate, OpenSshCertificate is directly passed in as the public key.
I tested the above method and found two problems:
1. It can only adapt to certs with RSA encryption algorithm
2. Even if the initVerifier() function of all encryption algorithms is rewritten, the signature will fail when the encryption method of cert is different from that of cert publickey.
Can I please raise a PR to fix the issue in UserAuthPublicKey?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "calderonth (via GitHub)" <gi...@apache.org>.
calderonth commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2749086056
Here the full debug log.
Could it be that it's because it's using the `CachingPublicKeyAuthenticator`?
We clearly see in the logs that at least the auth seems to succeed once but then it explodes after that.
```
==> /var/tmp/gerrit-site/logs/error_log <==
[2025-03-24T14:36:28.694-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-6] DEBUG org.apache.sshd.common.io.nio2.Nio2Acceptor : setOption(SO_REUSEADDR)[true] from property=Property[socket-reuseaddr](Boolean]
[2025-03-24T14:36:28.695-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-6] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : Creating IoSession on /192.168.0.1:29418 from /192.168.0.1:35308 via /0.0.0.0:29418
[2025-03-24T14:36:28.695-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-6] DEBUG org.apache.sshd.common.session.helpers.SessionTimeoutListener : sessionCreated(ServerSessionImpl[null@/192.168.0.1:35308]) tracking
[2025-03-24T14:36:28.695-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-6] DEBUG org.apache.sshd.server.session.ServerSessionImpl : sendIdentification(ServerSessionImpl[null@/192.168.0.1:35308]): SSH-2.0-GerritCodeReview_3.11.1-45-g13f11a459a-dirty (APACHE-SSHD-2.15.1-SNAPSHOT)
[2025-03-24T14:36:28.695-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-6] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 84 bytes
[2025-03-24T14:36:28.698-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doReadIdentification(ServerSessionImpl[null@/192.168.0.1:35308]) line='SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3'
[2025-03-24T14:36:28.711-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : readIdentification(ServerSessionImpl[null@/192.168.0.1:35308]) client version string: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3
[2025-03-24T14:36:28.712-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : sendKexInit(ServerSessionImpl[null@/192.168.0.1:35308]) Send SSH_MSG_KEXINIT
[2025-03-24T14:36:28.712-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #0 sending command=20[SSH_MSG_KEXINIT] len=1049
[2025-03-24T14:36:28.712-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 1064 bytes
[2025-03-24T14:36:28.712-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #0 SSH_MSG_KEXINIT
[2025-03-24T14:36:28.712-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : handleKexInit(ServerSessionImpl[null@/192.168.0.1:35308]) SSH_MSG_KEXINIT
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : negotiate(ServerSessionImpl[null@/192.168.0.1:35308]) strict KEX=true client=true server=true
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : negotiate(ServerSessionImpl[null@/192.168.0.1:35308]) ignore missing value for KEX option=C2SLANG
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : negotiate(ServerSessionImpl[null@/192.168.0.1:35308]) ignore missing value for KEX option=S2CLANG
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: kex algorithms = curve25519-sha256
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: server host key algorithms = ecdsa-sha2-nistp256
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: encryption algorithms (client to server) = chacha20-poly1305@openssh.com
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: encryption algorithms (server to client) = chacha20-poly1305@openssh.com
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: mac algorithms (client to server) = aead
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: mac algorithms (server to client) = aead
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: compression algorithms (client to server) = none
[2025-03-24T14:36:28.713-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-7] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setNegotiationResult(ServerSessionImpl[null@/192.168.0.1:35308]) Kex: compression algorithms (server to client) = none
[2025-03-24T14:36:28.714-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #1 30
[2025-03-24T14:36:28.714-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.kex.DHGServer : next(DHGServer[curve25519-sha256])[ServerSessionImpl[null@/192.168.0.1:35308]] process command=SSH_MSG_KEXDH_INIT
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.kex.DHGServer : next(DHGServer[curve25519-sha256])[ServerSessionImpl[null@/192.168.0.1:35308]] Send SSH_MSG_KEXDH_REPLY
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #1 sending command=31[31] len=249
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 264 bytes
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : handleKexMessage(ServerSessionImpl[null@/192.168.0.1:35308])[curve25519-sha256] KEX processing complete after cmd=30
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : sendNewKeys(ServerSessionImpl[null@/192.168.0.1:35308]) Send SSH_MSG_NEWKEYS
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : prepareNewKeys(ServerSessionImpl[null@/192.168.0.1:35308]) session ID=a0:70:39:8f:39:1f:38:54:3c:fd:1f:4d:b2:e5:f4:29:09:90:67:a9:3b:1c:30:2c:3b:b0:16:12:d5:eb:b4:12
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #2 sending command=21[SSH_MSG_NEWKEYS] len=1
[2025-03-24T14:36:28.716-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 16 bytes
[2025-03-24T14:36:28.717-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setOutputEncoding(ServerSessionImpl[null@/192.168.0.1:35308]): strict KEX resets output message sequence number from 3 to 0
[2025-03-24T14:36:28.717-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setOutputEncoding(ServerSessionImpl[null@/192.168.0.1:35308]): cipher chacha20-poly1305; mac null; compression none[Deflater/-1]; blocks limit 134217728
[2025-03-24T14:36:28.717-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.common.kex.extension.DefaultServerKexExtensionHandler : collectExtensions(ServerSessionImpl[null@/192.168.0.1:35308])[NEWKEYS]: extension info server-sig-algs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ecdsa-sha2-nistp256@openssh.com,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
[2025-03-24T14:36:28.717-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.common.kex.extension.DefaultServerKexExtensionHandler : sendKexExtensions(ServerSessionImpl[null@/192.168.0.1:35308])[NEWKEYS]: sending SSH_MSG_EXT_INFO with 1 info records
[2025-03-24T14:36:28.717-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #0 sending command=7[7] len=419
[2025-03-24T14:36:28.717-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 452 bytes
[2025-03-24T14:36:28.717-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-8] DEBUG org.apache.sshd.server.session.ServerSessionImpl : handleNewKeys(ServerSessionImpl[null@/192.168.0.1:35308]) No pending packets to flush at end of KEX
[2025-03-24T14:36:28.721-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-9] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #2 SSH_MSG_NEWKEYS
[2025-03-24T14:36:28.722-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-9] DEBUG org.apache.sshd.server.session.ServerSessionImpl : handleNewKeys(ServerSessionImpl[null@/192.168.0.1:35308]) SSH_MSG_NEWKEYS command=SSH_MSG_NEWKEYS
[2025-03-24T14:36:28.722-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-9] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setInputEncoding(ServerSessionImpl[null@/192.168.0.1:35308]): strict KEX resets input message sequence number from 3 to 0
[2025-03-24T14:36:28.722-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-9] DEBUG org.apache.sshd.server.session.ServerSessionImpl : setInputEncoding(ServerSessionImpl[null@/192.168.0.1:35308]): cipher chacha20-poly1305; mac null; compression none[Inflater/-1]; blocks limit 134217728
[2025-03-24T14:36:28.884-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #0 SSH_MSG_SERVICE_REQUEST
[2025-03-24T14:36:28.884-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerSessionImpl : handleServiceRequest(ServerSessionImpl[null@/192.168.0.1:35308]) SSH_MSG_SERVICE_REQUEST 'ssh-userauth'
[2025-03-24T14:36:28.885-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerUserAuthService : ServerUserAuthService(ServerSessionImpl[null@/192.168.0.1:35308]) authorized authentication methods: publickey
[2025-03-24T14:36:28.885-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerSessionImpl : handleServiceRequest(ServerSessionImpl[null@/192.168.0.1:35308]) Accepted service ssh-userauth
[2025-03-24T14:36:28.885-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #1 sending command=6[SSH_MSG_SERVICE_ACCEPT] len=17
[2025-03-24T14:36:28.885-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 52 bytes
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #1 SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Received SSH_MSG_USERAUTH_REQUEST user=tcalderon, service=ssh-connection, method=none
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Authenticating user 'tcalderon' with service 'ssh-connection' and method 'none' (attempt 0 / 6)
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) no authentication factory for method=none
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleAuthenticationFailure(null@ServerSessionImpl[null@/192.168.0.1:35308]) SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleAuthenticationFailure(null@ServerSessionImpl[null@/192.168.0.1:35308]) remaining methods: publickey
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #2 sending command=51[SSH_MSG_USERAUTH_FAILURE] len=15
[2025-03-24T14:36:28.886-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-10] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 44 bytes
[2025-03-24T14:36:28.887-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #2 SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.887-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Received SSH_MSG_USERAUTH_REQUEST user=tcalderon, service=ssh-connection, method=publickey
[2025-03-24T14:36:28.887-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Authenticating user 'tcalderon' with service 'ssh-connection' and method 'publickey' (attempt 1 / 6)
[2025-03-24T14:36:28.889-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.auth.pubkey.UserAuthPublicKey : doAuth(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) verify key type=ecdsa-sha2-nistp256-cert-v01@openssh.com, factories=ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ecdsa-sha2-nistp256@openssh.com,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa, fingerprint=SHA256:2fqpKRZHyXP0F6yCRGpSEJhqfmJSPmxYoy5XGs/czTw
[2025-03-24T14:36:28.889-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] ERROR com.google.gerrit.sshd.DatabasePubKeyAuth : Will check enableSSHUserCerts config
[2025-03-24T14:36:28.889-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] ERROR com.google.gerrit.sshd.DatabasePubKeyAuth : Starting checkSSHUserCerts
[2025-03-24T14:36:28.890-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.auth.pubkey.AuthorizedKeyEntriesPublickeyAuthenticator : authenticate(tcalderon)[ServerSessionImpl[null@/192.168.0.1:35308]] match found
[2025-03-24T14:36:28.890-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] ERROR com.google.gerrit.sshd.DatabasePubKeyAuth : SSH user cert auth successfull
[2025-03-24T14:36:28.894-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] ERROR com.google.gerrit.sshd.DatabasePubKeyAuth : Returning a success
[2025-03-24T14:36:28.895-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.auth.pubkey.UserAuthPublicKey : doAuth(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) key type=ecdsa-sha2-nistp256-cert-v01@openssh.com, fingerprint=SHA256:2fqpKRZHyXP0F6yCRGpSEJhqfmJSPmxYoy5XGs/czTw - authentication result: true
[2025-03-24T14:36:28.895-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.auth.pubkey.UserAuthPublicKey : doAuth(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) send SSH_MSG_USERAUTH_PK_OK for key type=ecdsa-sha2-nistp256-cert-v01@openssh.com, fingerprint=SHA256:2fqpKRZHyXP0F6yCRGpSEJhqfmJSPmxYoy5XGs/czTw
[2025-03-24T14:36:28.895-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #3 sending command=60[60] len=673
==> /var/tmp/gerrit-site/logs/sshd_log <==
[2025-03-24T14:36:28.894-04:00] a70b867f [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] tcalderon a/1000001 LOGIN FROM 192.168.0.1
==> /var/tmp/gerrit-site/logs/error_log <==
[2025-03-24T14:36:28.895-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 708 bytes
[2025-03-24T14:36:28.895-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-11] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleAuthenticationInProgress(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.979-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #3 SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.979-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Received SSH_MSG_USERAUTH_REQUEST user=tcalderon, service=ssh-connection, method=publickey
[2025-03-24T14:36:28.979-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Authenticating user 'tcalderon' with service 'ssh-connection' and method 'publickey' (attempt 2 / 6)
[2025-03-24T14:36:28.981-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.server.auth.pubkey.UserAuthPublicKey : doAuth(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) verify key type=ecdsa-sha2-nistp256-cert-v01@openssh.com, factories=ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ecdsa-sha2-nistp256@openssh.com,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa, fingerprint=SHA256:2fqpKRZHyXP0F6yCRGpSEJhqfmJSPmxYoy5XGs/czTw
[2025-03-24T14:36:28.981-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] WARN org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Failed (IllegalStateException) to authenticate using factory method=publickey: null
java.lang.IllegalStateException
at com.google.common.base.Preconditions.checkState(Preconditions.java:496)
at com.google.gerrit.sshd.DatabasePubKeyAuth.authenticate(DatabasePubKeyAuth.java:147)
at org.apache.sshd.server.auth.pubkey.CachingPublicKeyAuthenticator.authenticate(CachingPublicKeyAuthenticator.java:59)
at org.apache.sshd.server.auth.pubkey.UserAuthPublicKey.doAuth(UserAuthPublicKey.java:148)
at org.apache.sshd.server.auth.AbstractUserAuth.auth(AbstractUserAuth.java:70)
at org.apache.sshd.server.session.ServerUserAuthService.handleUserAuthRequestMessage(ServerUserAuthService.java:331)
at org.apache.sshd.server.session.ServerUserAuthService.process(ServerUserAuthService.java:163)
at org.apache.sshd.common.session.helpers.CurrentService.process(CurrentService.java:109)
at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:634)
at org.apache.sshd.common.session.helpers.AbstractSession.lambda$handleMessage$0(AbstractSession.java:555)
at org.apache.sshd.common.util.threads.ThreadUtils.runAsInternal(ThreadUtils.java:68)
at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:554)
at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1738)
at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:515)
at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:76)
at org.apache.sshd.common.io.nio2.Nio2Session.handleReadCycleCompletion(Nio2Session.java:409)
at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:382)
at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:377)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.lambda$completed$0(Nio2CompletionHandler.java:38)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:319)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.completed(Nio2CompletionHandler.java:37)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:125)
at java.base/sun.nio.ch.Invoker$1.run(Invoker.java:217)
at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:113)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1570)
[2025-03-24T14:36:28.981-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleAuthenticationFailure(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.981-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleAuthenticationFailure(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) remaining methods: publickey
[2025-03-24T14:36:28.982-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #4 sending command=51[SSH_MSG_USERAUTH_FAILURE] len=15
[2025-03-24T14:36:28.982-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-12] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 44 bytes
[2025-03-24T14:36:28.982-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.server.session.ServerSessionImpl : doHandleMessage(ServerSessionImpl[null@/192.168.0.1:35308]) process #4 SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.983-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Received SSH_MSG_USERAUTH_REQUEST user=tcalderon, service=ssh-connection, method=publickey
[2025-03-24T14:36:28.983-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Authenticating user 'tcalderon' with service 'ssh-connection' and method 'publickey' (attempt 3 / 6)
[2025-03-24T14:36:28.983-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.server.auth.pubkey.UserAuthPublicKey : doAuth(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) verify key type=ssh-ed25519, factories=ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ecdsa-sha2-nistp256@openssh.com,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa, fingerprint=SHA256:fXraQLcglzp4M1DPnC/CqvaDHkmFAbCLj0L3QWfm12U
[2025-03-24T14:36:28.983-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] WARN org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/192.168.0.1:35308]) Failed (IllegalStateException) to authenticate using factory method=publickey: null
java.lang.IllegalStateException
at com.google.common.base.Preconditions.checkState(Preconditions.java:496)
at com.google.gerrit.sshd.DatabasePubKeyAuth.authenticate(DatabasePubKeyAuth.java:147)
at org.apache.sshd.server.auth.pubkey.CachingPublicKeyAuthenticator.authenticate(CachingPublicKeyAuthenticator.java:59)
at org.apache.sshd.server.auth.pubkey.UserAuthPublicKey.doAuth(UserAuthPublicKey.java:148)
at org.apache.sshd.server.auth.AbstractUserAuth.auth(AbstractUserAuth.java:70)
at org.apache.sshd.server.session.ServerUserAuthService.handleUserAuthRequestMessage(ServerUserAuthService.java:331)
at org.apache.sshd.server.session.ServerUserAuthService.process(ServerUserAuthService.java:163)
at org.apache.sshd.common.session.helpers.CurrentService.process(CurrentService.java:109)
at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:634)
at org.apache.sshd.common.session.helpers.AbstractSession.lambda$handleMessage$0(AbstractSession.java:555)
at org.apache.sshd.common.util.threads.ThreadUtils.runAsInternal(ThreadUtils.java:68)
at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:554)
at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1738)
at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:515)
at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:76)
at org.apache.sshd.common.io.nio2.Nio2Session.handleReadCycleCompletion(Nio2Session.java:409)
at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:382)
at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:377)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.lambda$completed$0(Nio2CompletionHandler.java:38)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:319)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.completed(Nio2CompletionHandler.java:37)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:125)
at java.base/sun.nio.ch.Invoker$1.run(Invoker.java:217)
at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:113)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1570)
[2025-03-24T14:36:28.984-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleAuthenticationFailure(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) SSH_MSG_USERAUTH_REQUEST
[2025-03-24T14:36:28.984-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.server.session.ServerUserAuthService : handleAuthenticationFailure(tcalderon@ServerSessionImpl[null@/192.168.0.1:35308]) remaining methods: publickey
[2025-03-24T14:36:28.984-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.server.session.ServerSessionImpl : encode(ServerSessionImpl[null@/192.168.0.1:35308]) packet #5 sending command=51[SSH_MSG_USERAUTH_FAILURE] len=15
[2025-03-24T14:36:28.984-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-13] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : writeBuffer(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) writing 44 bytes
[2025-03-24T14:36:28.986-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : handleReadCycleCompletion(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) Socket has been disconnected (result=-1), closing IoSession now
[2025-03-24T14:36:28.986-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : close(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) Closing immediately
[2025-03-24T14:36:28.986-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : doCloseImmediately(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) closing socket=sun.nio.ch.UnixAsynchronousSocketChannelImpl[connected local=/192.168.0.1:29418 remote=/192.168.0.1:35308]
[2025-03-24T14:36:28.986-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : doCloseImmediately(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]) socket=sun.nio.ch.UnixAsynchronousSocketChannelImpl[closed] closed
[2025-03-24T14:36:28.986-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.io.nio2.Nio2Acceptor : unmapSession(id=119): Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308]
[2025-03-24T14:36:28.986-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.server.session.ServerSessionImpl : close(ServerSessionImpl[null@/192.168.0.1:35308]) Closing immediately
[2025-03-24T14:36:28.987-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.session.helpers.SessionTimeoutListener : sessionClosed(ServerSessionImpl[null@/192.168.0.1:35308]) un-tracked
[2025-03-24T14:36:28.987-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.server.session.ServerUserAuthService : close(org.apache.sshd.server.session.ServerUserAuthService@15c4f946) Closing immediately
[2025-03-24T14:36:28.987-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.server.session.ServerUserAuthService : close(org.apache.sshd.server.session.ServerUserAuthService@15c4f946)[Immediately] closed
[2025-03-24T14:36:28.987-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : close(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308])[Immediately] state already Closed
[2025-03-24T14:36:28.987-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.util.closeable.SequentialCloseable : doClose(org.apache.sshd.common.util.closeable.SequentialCloseable$1@623dc76b) signal close complete immediately=true
[2025-03-24T14:36:28.988-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.server.session.ServerSessionImpl : close(ServerSessionImpl[null@/192.168.0.1:35308])[Immediately] closed
[2025-03-24T14:36:28.988-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] DEBUG org.apache.sshd.common.io.nio2.Nio2Session : close(Nio2Session[local=/192.168.0.1:29418, remote=/192.168.0.1:35308])[Immediately] closed
==> /var/tmp/gerrit-site/logs/sshd_log <==
[2025-03-24T14:36:28.987-04:00] a70b867f [sshd-SshDaemon[687313e1](port=22)-nio2-thread-14] tcalderon a/1000001 LOGOUT
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "calderonth (via GitHub)" <gi...@apache.org>.
calderonth commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2749010933
Yes, I have of course modified gerrit to use the CA keys so that the validation happen and this seems to work as per logs:
```
try {
Path authorizedKeys = FileSystems.getDefault().getPath("/tmp/" , "ssh_user_key.pub");
PublickeyAuthenticator authenticator =
new AuthorizedKeyEntriesPublickeyAuthenticator(
authorizedKeys,
session,
AuthorizedKeyEntry.readAuthorizedKeys(authorizedKeys),
PublicKeyEntryResolver.FAILING
);
return authenticator.authenticate(username, suppliedKey, session);
```
With the format being:
```
cert-authority ecdsa-sha2-nistp256 AAAAE2...
```
However, somehow the session seems to be in a broken state.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "calderonth (via GitHub)" <gi...@apache.org>.
calderonth commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2748952180
Are we sure this is fully fixed @tomaswolf ?
I am using the 2.15.1-SNAPSHOT JAR and I am still not fully able to use ssh user certificates against Apache SSHD Mina implementation.
It seems to work partially but it might be missing something to bubble up the fact that authentication has succeeded in the session.
I am trying to add suppor to gerrit and you can see from the `sshd_log` that it successfully authed me with a cert (great) but somehow then `sshd` still throws an error complaining about the state.
```
==> /var/tmp/gerrit-site/logs/sshd_log <==
[2025-03-24T13:39:47.249-04:00] a70ce66f [sshd-SshDaemon[687313e1](port=22)-nio2-thread-27] tcalderon a/1000001 LOGIN FROM 10.20.91.29
==> /var/tmp/gerrit-site/logs/error_log <==
[2025-03-24T13:39:47.342-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-28] WARN org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/10.20.91.29:36060]) Failed (IllegalStateException) to authenticate using factory method=publickey: null
[2025-03-24T13:39:47.343-04:00] [sshd-SshDaemon[687313e1](port=22)-nio2-thread-28] WARN org.apache.sshd.server.session.ServerUserAuthService : handleUserAuthRequestMessage(ServerSessionImpl[null@/10.20.91.29:36060]) Failed (IllegalStateException) to authenticate using factory method=publickey: null
==> /var/tmp/gerrit-site/logs/sshd_log <==
[2025-03-24T13:39:47.346-04:00] a70ce66f [sshd-SshDaemon[687313e1](port=22)-nio2-thread-29] tcalderon a/1000001 LOGOUT
```
Any insights into what's missing?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "calderonth (via GitHub)" <gi...@apache.org>.
calderonth commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2749327795
So it turns out it works fine, there was a hard check for the session to be null in gerrit code base (https://github.com/GerritCodeReview/gerrit/blob/145c46ce177dfc646bc6a161dfc5f00d336b9136/java/com/google/gerrit/sshd/DatabasePubKeyAuth.java#L113) which was causing the issue above.
Adding checks surrounding this made the behavior go away and I was successful in using SSH user cert with gerrit 🥳 .
Sorry for the noise.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2575134939
Sure, if you can provide a PR with the fix and tests with different certificates/key types, that'd be great.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf closed issue #650: Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance
URL: https://github.com/apache/mina-sshd/issues/650
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2748995885
No, from this info I cannot tell what might be wrong. Try debugging. The changes done for OpenSSH user certificate include unit tests that successfully authenticate at a server.
One thing: what do you upload as public key at the Gerrit server? There would need to be a way to upload the CA public key (not the certificate itself!) to Gerrit, and tell Gerrit that it is a CA pubkey. Gerrit's `PublickeyAuthenticator` would then have to check the certificates CA key against that uploaded CA key.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] Supplied key (org.apache.sshd.common.config.keys.OpenSshCertificateImpl) is not a RSAPublicKey instance [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf commented on issue #650:
URL: https://github.com/apache/mina-sshd/issues/650#issuecomment-2566993238
The server side of user authentication with OpenSshCertificates was not fully implemented, and apparently is lacking tests.
See issue [SSHD-1161](https://issues.apache.org/jira/browse/SSHD-1161).
The real cause of the problem you encounter is in
https://github.com/apache/mina-sshd/blob/7b19f6b678a72bb1ac02a8a852ec301d6791024c/sshd-core/src/main/java/org/apache/sshd/server/auth/pubkey/UserAuthPublicKey.java#L95
and
https://github.com/apache/mina-sshd/blob/7b19f6b678a72bb1ac02a8a852ec301d6791024c/sshd-core/src/main/java/org/apache/sshd/server/auth/pubkey/UserAuthPublicKey.java#L132
If the key is an OpenSshCertificate, `initVerifier` should be called with `key.getCertPubKey()`, not with `key`.
So, to answer your questions: it happens because there is a bug. There are no dangers to your modification, but it'll work only for RSA keys. The real fix has to be in `UserAuthPublicKey` (server side) so that it works for all key types. Similar to how it's done in https://github.com/apache/mina-sshd/blob/7b19f6b678a72bb1ac02a8a852ec301d6791024c/sshd-core/src/main/java/org/apache/sshd/client/kex/DHGClient.java#L184-L186 and https://github.com/apache/mina-sshd/blob/7b19f6b678a72bb1ac02a8a852ec301d6791024c/sshd-core/src/main/java/org/apache/sshd/client/kex/DHGClient.java#L222 Plus there needs to be a test for this.
Note that there are other bits of authenticating with a certificate missing on the server side: https://github.com/apache/mina-sshd/blob/7b19f6b678a72bb1ac02a8a852ec301d6791024c/sshd-core/src/main/java/org/apache/sshd/server/auth/pubkey/UserAuthPublicKey.java#L108-L110
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org