Certificates support? #1608
-
|
Are there any plans to offer user authentication by SSH certificate? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 2 replies
-
|
Libssh2 supports several types of cert auth, what specifically are you looking for? |
Beta Was this translation helpful? Give feedback.
-
|
Hi Will,
Many thanks for replying.
On Mon, 02 Jun 2025 14:44:47 -0700 Will Cosgrove ***@***.***> wrote:
Libssh2 supports several types of cert auth, what specifically are you looking for?
#1608 (comment)
Message ID: ***@***.***>
I need the sort where a user SSH certificate, i.e. a user's public key signed by a Certificate Authority, can be sent to the SSH server and thus authenticate that user.
I tried, on the off chance, calling libssh2_userauth_publickey_frommemory, and supplying the certificate as the public key parameter, but no go, it returned LIBSSH2_ERROR_AUTHENTICATION_FAILED. Is there some way round this? Can't find any mention in the doco.
Cheers,
Austin.
|
Beta Was this translation helpful? Give feedback.
-
|
We use More generally, when encountering |
Beta Was this translation helpful? Give feedback.
-
|
I was doing what you suggest, but I suspect that my (older) version of libssh2 doesn't support all the certificate standards. Anyway, I started from scratch, using ECDSA throughout instead of RSA, and it's going nicely now. Many thanks again for your help, which has allowed me to fix the problems I was having. It might be good if the documentation mentioned the use of |
Beta Was this translation helpful? Give feedback.
We use
libssh2_userauth_publickey_frommemoryto authenticate using[email protected],[email protected], and[email protected]certificates. The trick is to read the accompanying -cert.pubfile into memory and supply it as the public key data in the call tolibssh2_userauth_publickey_frommemory.More generally, when encountering
LIBSSH2_ERROR_AUTHENTICATION_FAILED, you need to determine why the authentication failed. Logging can help here. You can set the logging level withlibssh2_trace(session, IBSSH2_TRACE_KEX | LIBSSH2_TRACE_AUTH | LIBSSH2_TRACE_PUBLICKEY | LIBSSH2_TRACE_ERROR)and then set a logging handler withlibssh2_trace_sethandler.