OpenSSH 密钥文件不能采用 UTF-16 格式 - 上一篇：Windows (10) OpenSSH（微软风格）拒绝接受所有流行的公钥算法

Question

我一直在尝试在 Windows 10 上设置 OpenSSH 服务器。

问题出在公钥上，密码验证工作正常。

普通用户和管理用户的文件权限都不是问题 - 它们设置正确。服务器不接受任何类型的用户的密钥，我首先尝试了我的常规ssh-rsa密钥，然后ecdsa-sha2-nistp521，然后ssh-ed25519- 全部失败。

如果包来源对任何人来说都很重要，我会使用Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0PowerShell 命令。

该日志来自我上次尝试，但对于所有关键算法，错误都是相同的，只是算法名称/键值/哈希值发生了变化。

debug2: load_server_config: done config len = 284
debug2: parse_server_config: config __PROGRAMDATA__\\ssh/sshd_config len 284
debug3: __PROGRAMDATA__\\ssh/sshd_config:34 setting PubkeyAuthentication yes
debug3: __PROGRAMDATA__\\ssh/sshd_config:38 setting AuthorizedKeysFile .ssh/authorized_keys
debug3: __PROGRAMDATA__\\ssh/sshd_config:78 setting Subsystem sftp sftp-server.exe
debug3: checking syntax for 'Match Group administrators'
debug1: sshd version OpenSSH_for_Windows_8.1, LibreSSL 3.0.2
debug1: private host key #0: ssh-rsa SHA256:<host-key-hash-1>
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:<host-key-hash-2>
debug1: private host key #2: ssh-ed25519 SHA256:<host-key-hash-3>
debug1: rexec_argv[0]='C:\\WINDOWS\\System32\\OpenSSH\\sshd.exe'
debug1: rexec_argv[1]='-ddd'
debug2: fd 3 setting O_NONBLOCK
debug3: sock_set_v6only: set socket 3 IPV6_V6ONLY
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug2: fd 4 setting O_NONBLOCK
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug3: fd 5 is not O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug3: send_rexec_state: entering fd = 8 config len 284
debug3: ssh_msg_send: type 0
debug3: send_rexec_state: done
Connection from <client-ipv4> port 34468 on <server-ipv4> port 22
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.3
debug1: match: OpenSSH_9.3 pat OpenSSH* compat 0x04000000
debug2: fd 5 setting O_NONBLOCK
debug3: spawning "C:\\WINDOWS\\System32\\OpenSSH\\sshd.exe" -ddd -y
debug2: Network child is on pid 6384
debug3: send_rexec_state: entering fd = 4 config len 284
debug3: ssh_msg_send: type 0
debug3: send_rexec_state: done
debug3: ssh_msg_send: type 0
debug3: ssh_msg_send: type 0
debug3: preauth child monitor started
debug3: recv_rexec_state: entering fd = 3
debug3: ssh_msg_recv entering
debug3: recv_rexec_state: done
debug2: parse_server_config: config __PROGRAMDATA__\\ssh/sshd_config len 284
debug3: __PROGRAMDATA__\\ssh/sshd_config:34 setting PubkeyAuthentication yes
debug3: __PROGRAMDATA__\\ssh/sshd_config:38 setting AuthorizedKeysFile .ssh/authorized_keys
debug3: __PROGRAMDATA__\\ssh/sshd_config:78 setting Subsystem sftp sftp-server.exe
debug3: checking syntax for 'Match Group administrators'
debug1: sshd version OpenSSH_for_Windows_8.1, LibreSSL 3.0.2
debug3: recv_hostkeys_state: entering fd = 3
debug3: ssh_msg_recv entering
debug3: recv_hostkeys_state: done
debug3: recv_idexch_state: entering fd = 3
debug3: ssh_msg_recv entering
debug3: recv_idexch_state: done
debug2: fd 5 setting O_NONBLOCK
debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug3: send packet: type 20 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug3: receive packet: type 20 [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug2: local server KEXINIT proposal [preauth]
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1 [preauth]
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: compression ctos: none,[email protected] [preauth]
debug2: compression stoc: none,[email protected] [preauth]
debug2: languages ctos:  [preauth]
debug2: languages stoc:  [preauth]
debug2: first_kex_follows 0  [preauth]
debug2: reserved 0  [preauth]
debug2: peer client KEXINIT proposal [preauth]
debug2: KEX algorithms: [email protected],curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c [preauth]
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256 [preauth]
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] [preauth]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
debug2: compression ctos: none,[email protected],zlib [preauth]
debug2: compression stoc: none,[email protected],zlib [preauth]
debug2: languages ctos:  [preauth]
debug2: languages stoc:  [preauth]
debug2: first_kex_follows 0  [preauth]
debug2: reserved 0  [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ssh-ed25519 [preauth]
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug3: receive packet: type 30 [preauth]
debug3: mm_sshkey_sign entering [preauth]
debug3: mm_request_send entering: type 6 [preauth]
debug3: mm_sshkey_sign: waiting for MONITOR_ANS_SIGN [preauth]
debug3: mm_request_receive_expect entering: type 7 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 6
debug3: mm_answer_sign
debug3: mm_answer_sign: KEX signature <idk-what-that-is>(83)
debug3: mm_request_send entering: type 7
debug2: monitor_read: 6 used once, disabling now
debug3: send packet: type 31 [preauth]
debug3: send packet: type 21 [preauth]
debug2: set_newkeys: mode 1 [preauth]
debug1: rekey out after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: Sending SSH2_MSG_EXT_INFO [preauth]
debug3: send packet: type 7 [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug3: receive packet: type 21 [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug2: set_newkeys: mode 0 [preauth]
debug1: rekey in after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug3: receive packet: type 5 [preauth]
debug3: send packet: type 6 [preauth]
debug3: receive packet: type 50 [preauth]
debug1: userauth-request for user <username> service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug3: mm_getpwnamallow entering [preauth]
debug3: mm_request_send entering: type 8 [preauth]
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
debug3: mm_request_receive_expect entering: type 9 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 8
debug3: mm_answer_pwnamallow
debug2: parse_server_config: config reprocess config len 284
debug3: checking match for 'Group administrators' user <username> host <client-ipv4> addr <client-ipv4> laddr <server-ipv4> lport 22
debug3: get_user_token - i am running as <username>, returning process token
debug1: user <username> matched group list administrators at line 92
debug3: match found
debug3: reprocess config:93 setting AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 9
debug2: monitor_read: 8 used once, disabling now
debug2: input_userauth_request: setting up authctxt for <username> [preauth]
debug3: mm_inform_authserv entering [preauth]
debug3: mm_request_send entering: type 4 [preauth]
debug2: input_userauth_request: try method none [preauth]
debug3: user_specific_delay: user specific delay 0.000ms [preauth]
debug3: ensure_minimum_time_since: elapsed 12.988ms, delaying 4.193ms (requested 8.590ms) [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 4
debug3: mm_answer_authserv: service=ssh-connection, style=
debug2: monitor_read: 4 used once, disabling now
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug3: send packet: type 51 [preauth]
debug3: receive packet: type 50 [preauth]
debug1: userauth-request for user <username> service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug2: input_userauth_request: try method publickey [preauth]
debug2: userauth_pubkey: valid user <username> querying public key ssh-ed25519 <the-user-key-base64> [preauth]
debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:<appropriate-hash-for-the-user-key-from-above> [preauth]
debug3: mm_key_allowed entering [preauth]
debug3: mm_request_send entering: type 22 [preauth]
debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
debug3: mm_request_receive_expect entering: type 23 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 22
debug3: mm_answer_keyallowed entering
debug3: mm_answer_keyallowed: key_from_blob: <idk-what-that-is>
debug1: trying public key file __PROGRAMDATA__/ssh/administrators_authorized_keys
debug2: __PROGRAMDATA__/ssh/administrators_authorized_keys:1: check options: '\377\376s'
debug2: __PROGRAMDATA__/ssh/administrators_authorized_keys:1: advance: ''
debug3: mm_answer_keyallowed: publickey authentication test: ED25519 key is not allowed
Failed publickey for <username> from <client-ipv4> port 34468 ssh2: ED25519 SHA256:<appropriate-hash-for-the-user-key-from-above>
debug3: mm_request_send entering: type 23
debug2: userauth_pubkey: authenticated 0 pkalg ssh-ed25519 [preauth]
debug3: user_specific_delay: user specific delay 0.000ms [preauth]
debug3: ensure_minimum_time_since: elapsed 8.998ms, delaying 8.183ms (requested 8.590ms) [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug3: send packet: type 51 [preauth]
Connection closed by authenticating user <username> <client-ipv4> port 34468 [preauth]
debug1: do_cleanup [preauth]
debug1: monitor_read_log: child log fd closed
debug3: mm_request_receive entering
debug1: do_cleanup
debug1: Killing privsep child 6384

我不认为这整篇日志是必要的，但我不会拒绝任何人的帮助。如果你需要我的帮助，你必须发布整个日志' 人们。

我认为这ED25519 key is not allowed是最重要的。每当我更改内部密钥<user-home-dir>/.ssh/authorized_keys或(...)/administrators_authorized_keys文件以匹配所用密钥的算法时，密钥算法名称都会更改。

我不知道为什么 Windows 的 OpenSSH 不喜欢我的任何密钥。

Answer 1

钥匙不是问题。

我已经使用echo '<key>' > <key-file>PowerShell 命令复制了公钥，创建的文件文本格式是UTF-16 LE我一直没有弄清楚的，debug2: __PROGRAMDATA__/ssh/administrators_authorized_keys:1: check options: '\377\376s'直到现在我才开始思考这一行是什么意思。

尽管日志中没有详细说明文件编码/ASCII 文本文件中的意外字节是问题所在......

如果您遇到类似的奇怪问题，请检查您的文件编码！

我保证我在发布这篇文章之前的几个小时就试图弄清楚了这一点，只是......发布这篇文章以某种方式帮助我弄清楚了这一点......