[ssh_x509] ECDSA+cert key is not allowed

[ssh_x509 at roumenpetrov.info]

I have resolved the issue, once I enabled LogLevel DEBUG3 it gave me the
error.

The problem was w.r.t authorised keys file permission.

Now it seems so silly.

Thanks,
Chidanand

On Fri, 10 Oct, 2025, 6:15 pm , <ssh_x509 at roumenpetrov.info> wrote:

> Thanks Roumen for the quick reply.
>
> I have removed X509KeyAlgorithm as per your suggestion. There is no change
> in the result. I still see the same error.
>
> ---
> debug1: restore_uid: 0/0
> debug3: mm_answer_keyallowed: publickey authentication test: RSA+cert key
> is not allowed
> Failed publickey for user1 from 192.168.64.1 port 57864 ssh2: RSA+cert
> SHA256:k0ypgBOnHw6GkDjHn3MIp7CCKelNPYsi+JuFfRydT2Y
> debug3: mm_request_send: entering, type 23
> debug2: userauth_pubkey: authenticated 0 pkalg x509v3-rsa2048-sha256
> [preauth]
> ----
>
> I followed the README's and man pages which came with the package and have
> created the keys and certificates accordingly.
> The section below shows the procedure followed and server, client side
> config.
>
> I guess I am missing something very obvious and not able to make it out.
>
> 1. CA keys and certificates
>        a. Added ca-cert.pem to ca-bundle.crt
>
> 2. host keys and certificates
> a. Signed with ca
>   Issuer: C = IN, ST = KA, L = BLR, O = MyOrg, OU = PKI, CN = My PKIXSSH
> Root CA, emailAddress = ca-admin at myorg.com
>           Subject: C = IN, ST = KA, L = BLR, O = MyOrg, OU = Server, CN =
> mypkixhost.myorg.com, emailAddress = host-admin at myorg.com
> b. Created combined file with pvt key and cert
>   cat host-key.pem host-cert.pem > host-combined.pem
> c. Generate the .pub file
>   ssh-keygen -y -f host-combined.pem > host-combined.pem.pub
>
> 3. User keys and certificates
> a. Signed with ca
>   Issuer: C = IN, ST = KA, L = BLR, O = MyOrg, OU = PKI, CN = My PKIXSSH
> Root CA, emailAddress = ca-admin at myorg.com
>           Subject: C = IN, ST = KA, L = BLR, O = MyOrg, OU = Users, CN =
> user1, emailAddress = user1 at myorg.com
>
> b. Created combined file with pvt key and cert
>   cat user1-key.pem user1-cert.pem > user1-combined.pem
>
> c. Generate the .pub file
>   ssh-keygen -y -f user1-combined.pem > user1-combined.pem.pub
>
> d. Create an entry in authorized_keys/user1
>   x509v3-rsa2048-sha256 subject=
> /C=IN/ST=KA/L=BLR/O=MyOrg/OU=Users/CN=user1/emailAddress=user1 at myorg.com
>
> 4. Server config:
> Port 9922
> HostKey /home/adminuser/workdir/PKIXSSH/install/etc/hosts/host-combined.pem
> CACertificateFile
> /home/adminuser/workdir/PKIXSSH/install/etc/ca/ca-bundle.crt
> PubkeyAuthentication yes
> PasswordAuthentication no
> AllowUsers user1
> AllowedCertPurpose sslclient
> KeyAllowSelfIssued no
> MandatoryCRL no
> AuthorizedKeysFile
> /home/adminuser/workdir/PKIXSSH/install/etc/authorized_keys/%u
>
> 5. Client side config:
> Host pkixserver
>     HostName 192.168.64.2
>     Port 9922
>     User user1
>     IdentityFile /Users/Chidanand.Gangur at mypc/pkixuser1/user1-combined.pem
>     CACertificateFile /Users/Chidanand.Gangur at mypc
> /pkixuser1/ca/ca-bundle.crt
>     IdentitiesOnly yes
>     PubkeyAuthentication yes
>     UserKnownHostsFile /Users/Chidanand.Gangur at mypc/pkixuser1/known_hosts
>
>
> -------------
>
> Another observation, after I attached gdb and traced mm_answer_keyallowed
> function and here its BT:
>
> Breakpoint 3, user_key_command_allowed2 (authoptsp=<optimized out>,
> rdomain=<optimized out>, conn_id=<optimized out>,
> remote_host=0xaaaaaabd7ee0 "192.168.64.1",
>     remote_ip=0xaaaaaabd7ee0 "192.168.64.1", key=0xaaaaaabeefc0,
> user_pw=0xaaaaaabd82b0) at auth2-pubkey.c:816
> 816 success = user_key_command_allowed2(pw, key, remote_ip, remote_host,
> conn_id, rdomain, &opts);
> (gdb) bt
> #0  user_key_command_allowed2 (authoptsp=<optimized out>,
> rdomain=<optimized out>, conn_id=<optimized out>,
> remote_host=0xaaaaaabd7ee0 "192.168.64.1",
>     remote_ip=0xaaaaaabd7ee0 "192.168.64.1", key=0xaaaaaabeefc0,
> user_pw=0xaaaaaabd82b0) at auth2-pubkey.c:816
> #1  user_xkey_allowed (ssh=ssh at entry=0xaaaaaabe6680, pw=0xaaaaaabd82b0,
> ctx=ctx at entry=0xffffffffe970, auth_attempt=<optimized out>,
> authoptsp=authoptsp at entry=0xffffffffe968)
>     at auth2-pubkey.c:816
> #2  0x0000aaaaaaad4a94 in mm_answer_keyallowed (ssh=0xaaaaaabe6680, sock=5,
> m=0xaaaaaabe7d90) at monitor.c:1201
> #3  0x0000aaaaaaad5f04 in monitor_read (ssh=ssh at entry=0xaaaaaabe6680,
> pmonitor=pmonitor at entry=0xaaaaaabdb600, ent=0xaaaaaab80268
> <mon_dispatch_proto20+96>,
>     pent=pent at entry=0xffffffffea70) at monitor.c:515
> #4  0x0000aaaaaaad7504 in monitor_child_preauth (ssh=ssh at entry
> =0xaaaaaabe6680,
> pmonitor=0xaaaaaabdb600) at monitor.c:293
> #5  0x0000aaaaaaab43b8 in privsep_preauth (ssh=0xaaaaaabe6680) at
> /home/adminuser/workdir/PKIXSSH/pkixssh-16.0/sshd-session.c:263
> #6  main (ac=<optimized out>, av=<optimized out>) at sshd.c:1813
>
>
> user_key_command_allowed2 returns 0.
>
> 619 if (options.authorized_keys_command == NULL)
> 620 return 0;
>
> I do not intend to use autorized_keys_command . I have just added the
> subject line  as mentioned above in authorized_keys/user1 file.
>
> Appreciate your help here.
>
> Thanks,
> Chidanand
> _______________________________________________
> ssh_x509 mailing list
> ssh_x509 at roumenpetrov.info
> http://roumenpetrov.info/mailman/listinfo/ssh_x509_roumenpetrov.info
>