SSH Server Common Issues

General SSH checklist

• Make sure gateway can reach ssh server on port 22

• Check authorized_keys file for the correct public key

• Check permissions for ssh folder(700) and authorized_keys file(600)

• Look at ssh server log for auth errors grep 'sshd' /var/log/auth.log

• Check openssl version. 8.2+ does not support ssh-rsa any longer

• Check sshd_config file for AuthenticationMethods line, comment out for default to allow any auth

• Check sshd_config file for AuthorizedPrincipalsFile line and if it’s configured to use the incorrect user.

Enable SSH Client and Server for Windows Server (Use with Powershell or WinSCP)

1. Open a Powershell in Administrator Mode

2. Run the following command to see if the openssh client and server are installed Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

3. Install OpenSSH Client if not installed Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

4. Install OpenSSH Server if not installed Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

5. Start the sshd service: Start-Service sshd

6. Set the service to start automatically: Set-Service -Name sshd -StartupType 'Automatic'

7. sshd-agent service is disabled by default, set it to start automatically before starting it: Set-Service -Name sshd -StartupType 'Automatic'

8. Start the sshd-agent service: Start-Service ‘ssh-agent’

9. Edit the following 3 lines in the %PROGRAMDATA%/ssh/sshd_config

1. Add a new file with no txt extension at %PROGRAMDATA%/ssh/administrators_authorized_keys

2. Generate an ssh pubkey resource in strongDM Admin UI

3. Copy public key into the administrators_authorized_keys file

4. Open Services and restart the OpenSSHServer service

5. Run healthcheck on the new ssh resource