1

Our Junipers will not accept my ssh keys when I provide them from my favorite Windows client.

On a FreeBSD machine, I would restart sshd with the -d flag and just watch the output to discover why the keys were not palatable.

Can I do something similar on JunOS?

  • 1
    show log messages | match ssh may give you some hints on what's wrong. I don't think you can run sshd in debug mode. – Teun Vink Oct 19 '16 at 11:24
  • Bingo! "error: key_read: uudecode .... failed" Re-copying in key fixed it. – ericx Oct 19 '16 at 15:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 1:33
2

Unfortunately there are no traceoptions for SSH that I'm aware of. If you have access to a *nix machine with your SSH keys loaded, you could try connecting with:

ssh -vvv user@router

and see which keys are offered and which identities are matched.

If you're using PuTTY, then right-click on the window title and select Event Log to get similar output.

  • PuTTY works. openssh from FreeBSD machines work. The only thing that fails is SecureCRT and the trace from that application shows nothing untoward (key-xchange algorithm, keys offered, auth failed). However, SecureCRT auths fine to ciscos and Cienas. The Juniper doesn't like what SecureCRT is offering and I think I need the sshd on the Juniper to tell me why. – ericx Oct 19 '16 at 11:44
  • What does "show configuration system services ssh" say? – Jordan Head Oct 19 '16 at 14:17
  • root-login deny-password; protocol-version [ v2 v1 ]; connection-limit 5; rate-limit 10; – ericx Oct 19 '16 at 15:16
1

For the record, Teun Vink's comment above provided the necessary clue.

show log messages | match ssh

revealed:

error: key_read: uudecode .... failed

The key had been mis-copied into the config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.