openssh unix dev - Jun 2019 - OpenSSH public key authentication does not work from Windows client if private key was added to SSH agent

Hey guys,

I installed OpenSSH 7.9p1 on Windows Server 2016 and generated a SSH key pair
with ssh-keygen on my Windows 10 Client (OpenSSH 7.6p1). I can connect to the
server with "ssh user at domain@servername -i id_rsa". But as soon as
I add the private key to the SSH agent by "ssh-add id_rsa" this does
not work anymore and aborts with the message "Permission denied
(publickey,keyboard-interactive)". The ssh command without "-i
id_rsa" leads to the same error. As soon as I remove the private key from
the ssh agent, public key authentication works again like a charm.
If I add the public key on my Ubuntu Server 18.04 LTS to the SSH agent and
establish a connection, this works without any problems. SSH client version on
Ubuntu is also OpenSSH 7.6p1.
I noticed further, if I add my key id_rsa to the SSH agent on Windows and copy
the key file to id_rsa_new the connection can be established by "ssh user
at domain@servername -i id_rsa_new" without any problems, but not with
"-i id_rsa".
I think this is strange and not the expected behavior. Any ideas what's
wrong?

Regards,
Patrick
Ich weise Sie darauf hin, dass Ihnen gem. Art. 13 Datenschutz-Grundverordnung
verschiedene Rechte als betroffene Person bei der Verarbeitung von
personenbezogenen Daten durch die Stadt Osnabr?ck zustehen. Eine ausf?hrliche
Information, welche Rechte dies im Einzelnen sind und wie Ihre Daten verarbeitet
werden, k?nnen Sie unter folgenden Link abrufen:
https://www.osnabrueck.de/datenschutz.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7396 bytes
Desc: not available
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20190619/24d1cf84/attachment.p7s>

On Wed, 19 Jun 2019, Steinforth, Patrick wrote:
> Hey guys,
> 
> I installed OpenSSH 7.9p1 on Windows Server 2016 and generated a SSH key
pair with ssh-keygen on my Windows 10 Client (OpenSSH 7.6p1). I can connect to
the server with "ssh user at domain@servername -i id_rsa". But as soon
as I add the private key to the SSH agent by "ssh-add id_rsa" this
does not work anymore and aborts with the message "Permission denied
(publickey,keyboard-interactive)". The ssh command without "-i
id_rsa" leads to the same error. As soon as I remove the private key from
the ssh agent, public key authentication works again like a charm.
> If I add the public key on my Ubuntu Server 18.04 LTS to the SSH agent and
establish a connection, this works without any problems. SSH client version on
Ubuntu is also OpenSSH 7.6p1.
> I noticed further, if I add my key id_rsa to the SSH agent on Windows and
copy the key file to id_rsa_new the connection can be established by "ssh
user at domain@servername -i id_rsa_new" without any problems, but not with
"-i id_rsa".
> I think this is strange and not the expected behavior. Any ideas what's
wrong?
Could you send the output of ssh with debugging enabled for both a working
and failing connection? I.e. "ssh -vvv host"

It should show what is going on.

-d

Hey Damien,

thank you for your reply. I posted the debug information at
https://pastebin.com/40esNPED and replaced some sensitive information before
(usernames, servernames, domainnames, IP addresses). In addition I commented
some lines with a message like "### <my message> ###".

Patrick

-----Urspr?ngliche Nachricht-----
Von: Damien Miller <djm at mindrot.org>
Gesendet: Freitag, 21. Juni 2019 06:40
An: Steinforth, Patrick <Steinforth at osnabrueck.de>
Cc: openssh-unix-dev at mindrot.org
Betreff: Re: OpenSSH public key authentication does not work from Windows client
if private key was added to SSH agent

On Wed, 19 Jun 2019, Steinforth, Patrick wrote:
> Hey guys,
>
> I installed OpenSSH 7.9p1 on Windows Server 2016 and generated a SSH key
pair with ssh-keygen on my Windows 10 Client (OpenSSH 7.6p1). I can connect to
the server with "ssh user at domain@servername -i id_rsa". But as soon
as I add the private key to the SSH agent by "ssh-add id_rsa" this
does not work anymore and aborts with the message "Permission denied
(publickey,keyboard-interactive)". The ssh command without "-i
id_rsa" leads to the same error. As soon as I remove the private key from
the ssh agent, public key authentication works again like a charm.
> If I add the public key on my Ubuntu Server 18.04 LTS to the SSH agent and
establish a connection, this works without any problems. SSH client version on
Ubuntu is also OpenSSH 7.6p1.
> I noticed further, if I add my key id_rsa to the SSH agent on Windows and
copy the key file to id_rsa_new the connection can be established by "ssh
user at domain@servername -i id_rsa_new" without any problems, but not with
"-i id_rsa".
> I think this is strange and not the expected behavior. Any ideas what's
wrong?
Could you send the output of ssh with debugging enabled for both a working and
failing connection? I.e. "ssh -vvv host"

It should show what is going on.

-d

Ich weise Sie darauf hin, dass Ihnen gem. Art. 13 Datenschutz-Grundverordnung
verschiedene Rechte als betroffene Person bei der Verarbeitung von
personenbezogenen Daten durch die Stadt Osnabr?ck zustehen. Eine ausf?hrliche
Information, welche Rechte dies im Einzelnen sind und wie Ihre Daten verarbeitet
werden, k?nnen Sie unter folgenden Link abrufen:
https://www.osnabrueck.de/datenschutz.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7396 bytes
Desc: not available
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20190621/ceadaba4/attachment.p7s>