Solved SSH connection with private key fails

[RubenFixit]

I've been trying to get a connection to work using SSH and private key for authentication. No matter what kind of ssh private key I use (with or without passphrase or different encryption method) I always get the same errors:

Feb 24 13:13:18 guacd[318]: DEBUG: Attempting private key import (WITHOUT passphrase)
Feb 24 13:13:18 guacd[318]: DEBUG: Initial import failed: (null)
Feb 24 13:13:18 guacd[318]: DEBUG: Re-attempting private key import (WITH passphrase)
Feb 24 13:13:53 guacd[318]: ERROR: Auth key import failed: (null)

I believe the issue is related to this: https://issues.apache.org/jira/browse/GUACAMOLE-1540

The suggested solution is to update the guacamole-server docker build to use libssh2 1.9.0-3.

Currently it is using libssh2 1.8.0-2

Can you please update the dockerfile to use the newer version of libssh2?

[girish]

It seems support for the newer keys was just merged in Jan - https://github.com/apache/guacamole-server/commit/23612720ce3738e2fc579f57acd9d19eedf198fc . So, we have to wait for a new guacamole release. Until then, just use -m PEM to generate old style keys.

[girish]

@RubenFixit Will look into this. Since Cloudron's docker images are based on ubuntu 20.04, we have to see if the library is available readily.

[girish]

@RubenFixit Got the time to look into this now. I can confirm guac is not able to connect with the latest SSH key format. You can identify the "latest" key format by looking into the private key file. The header will say -----BEGIN OPENSSH PRIVATE KEY----- . The old keys have the format -----BEGIN RSA PRIVATE KEY-----.

To generate an old key use ssh-keygen -m PEM. With that, I can confirm it works:

It then connects:

[girish]

It seems support for the newer keys was just merged in Jan - https://github.com/apache/guacamole-server/commit/23612720ce3738e2fc579f57acd9d19eedf198fc . So, we have to wait for a new guacamole release. Until then, just use -m PEM to generate old style keys.

[RubenFixit]

@girish Thanks for looking into this!

In the mean time I've also been able to get the connection to work by using the "old key" method.