[Proftpd-user] ProFTPD 1.3.7rc4 : SFTP authentication via 'rsa-sha2-512' public key failed

"De Gaaij, Pieter" <[email protected]>
Newsgroups gmane.network.proftpd.user
Message-ID <[email protected]> 
Hello,

I have compiled and installed the newest version of ProFTPD 1.3.7 rc4 
dating from 14-apr-2020 on a Red Hat 7.5 server with OpenSSL 1.0.2k.

When I use scp or sftp from on the dropserver itself using a RSA-keypair 
to authenticate myself to the ProFTPD server, it fails using the 
SSH-key, scp/sftp prompt then for a password.


The error messages in ProFTD's log files are :

*
*

*Server log: *

USER <username> (Login failed): authentication via 'rsa-sha2-512' public 
key failed

*sftp log*:

2020-04-16 19:39:29,692 mod_sftp/1.0.1[52182]: sent server version 
'SSH-2.0-ProFTPD RHEL Test Dropserver-SFTP'

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]: received client version 
'SSH-2.0-OpenSSH_7.4'

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]: handling connection from 
SSH2 client 'OpenSSH_7.4'

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session key exchange: 
ecdh-sha2-nistp256

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session server 
hostkey: rsa-sha2-512

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session 
client-to-server encryption: aes128-ctr

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session 
server-to-client encryption: aes128-ctr

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session 
client-to-server MAC: [email protected] <mailto:[email protected]>

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session 
server-to-client MAC: [email protected] <mailto:[email protected]>

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session 
client-to-server compression: none

2020-04-16 19:39:29,693 mod_sftp/1.0.1[52182]:  + Session 
server-to-client compression: none

2020-04-16 19:39:29,697 mod_sftp/1.0.1[52182]: sending acceptable 
userauth methods: password,publickey

2020-04-16 19:39:29,705 mod_sftp/1.0.1[52182]: public key SHA256 
fingerprint: 
40:85:ad:26:00:23:e4:7c:dc:dd:3f:34:88:91:8e:6b:47:74:e1:43:7a:14:dc:c4:d3:9a:d4:22:74:d4:b5:9c

2020-04-16 19:39:29,707 mod_sftp/1.0.1[52182]: error verifying RSA 
signature:

   (1) error:04091064:rsa routines:INT_RSA_VERIFY:algorithm mismatch

2020-04-16 19:39:29,707 mod_sftp/1.0.1[52182]: failed to verify 
'rsa-sha2-512' signature on public key auth request for user '<username>'

2020-04-16 19:39:29,707 mod_sftp/1.0.1[52182]: sending userauth failure; 
remaining userauth methods: password,publickey

2020-04-16 19:39:46,870 mod_sftp/1.0.1[52182]: disconnecting client 
(received EOF)

**

*ProFTPD -V:*

Compile-time Settings:

   Version: 1.3.7rc4 (git)

   Platform: LINUX [Linux 3.10.0-862.11.6.el7.x86_64 x86_64]

   Built: Wed Apr 15 2020 17:55:16 CEST

   Built With:

     configure '--disable-sendfile' '--localstatedir=/var/run' 
'--enable-ctrls' '--enable-openssl' '--enable-quotatab' '--enable-nls' 
'--enable-dso' '--with-lastlog=<basedir>/var/lastlog' 
'--with-modules=mod_readme:mod_ifsession:mod_ident' 
'--with-shared=mod_sql:mod_sql_sqlite:mod_sftp:mod_tls:mod_auth_otp:mod_ctrls_admin:mod_quotatab:mod_quotatab_file:mod_ban:' 
'--prefix=/usr/local'

   CFLAGS: -g2 -O2 -Wall -fno-omit-frame-pointer 
-Werror=implicit-function-declaration

   LDFLAGS: -L$(top_srcdir)/lib -L$(top_builddir)/lib  -rdynamic

   LIBS:  -lssl -lcrypto -lsupp -lnsl -lresolv -lresolv -lcrypt -ldl

   Files:

     Configuration File:

/usr/local/etc/proftpd.conf

     Pid File:

/var/run/proftpd.pid

     Scoreboard File:

/var/run/proftpd.scoreboard

     Header Directory:

/usr/local/include/proftpd

     Shared Module Directory:

       /usr/local/libexec

   Info:

     + Max supported UID: 4294967295

     + Max supported GID: 4294967295

   Features:

     - Autoshadow support

     + Controls support

     + curses support

     - Developer support

     + DSO support

     + IPv6 support

     + Largefile support

     + Lastlog support

     - Memcache support

     + ncursesw support

     + NLS support

     + OpenSSL support (OpenSSL 1.0.2k  26 Jan 2017, FIPS enabled)

     - PCRE support

     - POSIX ACL support

     - Redis support

     + Shadow file support

     - Sendfile support

     - Sodium support

     + Trace support

     + xattr support

   Tunable Options:

PR_TUNABLE_BUFFER_SIZE = 1024

PR_TUNABLE_DEFAULT_RCVBUFSZ = 8192

PR_TUNABLE_DEFAULT_SNDBUFSZ = 8192

     PR_TUNABLE_ENV_MAX = 2048

PR_TUNABLE_GLOBBING_MAX_MATCHES = 100000

PR_TUNABLE_GLOBBING_MAX_RECURSION = 8

PR_TUNABLE_HASH_TABLE_SIZE = 40

     PR_TUNABLE_LOGIN_MAX = 256

PR_TUNABLE_NEW_POOL_SIZE = 512

     PR_TUNABLE_PATH_MAX = 4096

PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80

PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30

PR_TUNABLE_SELECT_TIMEOUT = 30

PR_TUNABLE_TIMEOUTIDENT = 10

PR_TUNABLE_TIMEOUTIDLE = 600

  PR_TUNABLE_TIMEOUTLINGER = 10

PR_TUNABLE_TIMEOUTLOGIN = 300

PR_TUNABLE_TIMEOUTNOXFER = 300

PR_TUNABLE_TIMEOUTSTALLED = 3600

PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10

In the ProFTPD config file:
# Default Values

# channelPacketSize 32KB channelWindowSize 4GB sftpProtocolVersion 1-6

#SFTPClientMatch WinSCP|ClientSftp sftpProtocolVersion 1-3

SFTPClientMatch ".*ClientSftp" sftpProtocolVersion 3  #CuteFTPPro8

SFTPClientMatch ".*WinSCP.*" sftpProtocolVersion 3    #upload/download 
fix for WinSCP

# General fixes from the mod_sftp forum

SFTPClientMatch ".*WS_FTP.*" channelWindowSize 1GB    #WS_FTP initial 
window size

# SecureBlackbox (SSH-2.0-SecureBlackbox.7)

# http://www.eldos.com/sbb/download-release.php

SFTPClientMatch ".*SecureBlackbox.*" sftpProtocolVersion 3

# JaSFtp (SSH-2.0-J2SSH_Maverick_1.2.10_Sterling Commerce)

# http://www.hiteksoftware.com/jasf/

SFTPClientMatch ".*J2SSH_Maverick.*" channelWindowSize 1GB

# Robo-FTP (SSH-2.0-WeOnlyDo)

# http://www.robo-ftp.com/

SFTPClientMatch ".*WeOnlyDo.*" sftpProtocolVersion 3 channelWindowSize 1GB

# Network Automation (SSH-2.0-EldoS.SSHBlackbox.3)

# http://www.networkautomation.com/

SFTPClientMatch ".*EldoS.SSHBlackbox.3.*" sftpProtocolVersion 3 
channelWindowSize 1GB

# Software BizTalk SFTP Receive (SSH-2.0-IP*Works! SSH Client v8.0)

# http://www.nsoftware.com/products/biztalk/adapters/sftp.aspx

SFTPClientMatch ".*IP.Works.*" channelWindowSize 1GB

# JSch - Java Secure Channel (SSH-2.0-JSCH-0.1.39)

# http://www.jcraft.com/jsch/

SFTPClientMatch "JSCH.*" channelWindowSize 1GB

# SecureFX - SSH2 client 'SecureFX_2_2_5_225 SecureFX'

# http://www.vandyke.com/products/securefx/

SFTPClientMatch "SecureFX.*" sftpProtocolVersion 3

# GlobalScape FTP application (SSH2 client 'GSSFTP1.0') - (needs v2)

# http://www.globalscape.com/downloads/

# GoAnywhere (SSH-2.0-1.0)

# http://www.goanywheremft.com/products/

SFTPClientMatch "1.0" sftpProtocolVersion 2 channelWindowSize 1GB

# CoreFTP LE (free version 2.2)  can not support normal channel 4GB.

SFTPClientMatch CoreFTP channelWindowSize 1GB

# SSH-2.0-Sun_SSH_1.0.1

SFTPClientMatch ".*Sun_SSH.*" channelWindowSize 1GB

# SSH-2.0-SharpSSH-1.1.1.13-JSCH-0.1.28

SFTPClientMatch ".*SharpSSH.*" channelWindowSize 256MB

# SSH-2.0-1.30

SFTPClientMatch "1.30" channelWindowSize 256MB channelPacketSize 16KB

# Software Axway Suite Receive (SSH2 client 'XFB.Gateway Windows') 
Version 6.13

# Vo-Client Customer: AGINSURANCE

SFTPClientMatch ".*XFB.*" channelWindowSize 10MB

<IfModule mod_auth_pam.c>

AuthPAM off

</IfModule>

# Configure both the RSA and DSA host keys, using the same host key

# files that OpenSSH uses.

SFTPHostKey <basedir>/etc/ssh_host_dsa_key

SFTPHostKey <basedir>/etc/ssh_host_rsa_key

# Configure the file used for comparing authorized public keys of users.

SFTPAuthMethods password publickey

SFTPAuthorizedUserKeys file:<basedir>/authorized_keys/%u

# Enable compression

SFTPCompression delayed

SFTPOptions IgnoreSFTPUploadPerms IgnoreSCPUploadPerms 
IgnoreSFTPSetOwners IgnoreSFTPSetPerms

FSOptions IgnoreExtendedAttributes

SFTPKeyLimits MinimumECSize 0 MinimumDSASize 0 MinimumRSASize 0

SFTPKeyBlacklist <basedir>/etc/blacklist.dat

SFTPDHParamFile <basedir>/etc/dhparams.pem

When I use a DSA key-pair, no problem occurred.

The SSH-keypair is created with ssh-keygen -t rsa.
The id_rsa.pub key is converted toRFC4716 format and placed in the 
<basedir>/authorized_keys/<user> file


I saw in the NEWS file :
- Issue 907 - Implemented support for RSA SHA-2 publickey signatures in  
mod_sftp, per RFC 8332.

Does anyone of you has a clue about the reason.

Thanks in advance.

Best regards,

**

*Pieter de Gaaij*
<http://www.dxc.technology/>

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.