I have been unsuccessful at getting public key authentication to work per Cisco Systems on any of our ASA5505 or ASA5506 routers. Despite my best research and efforts, I still get challenged for a password.
Update: After input from FrameHowitzer, I tried connecting using Putty and that worked fine. So the issue appears to be with OpenSSH_8.9p1.
Our ASA5505s are running ASA 9.2(4) and ASA5506s are running ASA 9.8(2). All have the Security Plus License.
Typical configuration for a 5505:
ssh scopy enable no ssh stricthostkeycheck ssh timeout 60 ssh version 2 ssh key-exchange group dh-group14-sha1 ssh 10.2.0.0 255.255.255.0 TempMgmt username scp password OpenSezzaMe privilege 15 aaa authentication ssh console LOCAL username scp attributes ssh authentication pkf ---- BEGIN SSH2 PUBLIC KEY ---- AAAAB3NzaC1yc2EAAAADAQABAAAAgQDJf/+4DKo2g64611G5iyK5Qh24ytbCqOlAKlrDp7 AwxpVcrtBUCKu131Sj7B9RCV6QG9Jg4lOGx53zfBxRcE1cJ0p2n26nHwfIRHIhEeS4B8J1 o8DOmAQ8oJWGesadx2Kq4mzEYJ7XrW8lgNTJCe+yJ6MMos6XGVFRqyaaheHUEQ== ---- END SSH2 PUBLIC KEY ---- quit
If I enable debugging for ssh and log in:
Device ssh opened successfully. SSH0: SSH client: IP = '10.2.0.2' interface # = 2 SSH: host key initialised SSH0: starting SSH control process SSH0: Exchanging versions - SSH-2.0-Cisco-1.25 SSH0: send SSH message: outdata is NULL server version string:SSH-2.0-Cisco-1.25 SSH0: receive SSH message: 83 (83) SSH0: client version is - SSH-2.0-OpenSSH_8.9p1 Ubuntu-3 client version string:SSH-2.0-OpenSSH_8.9p1 Ubuntu-3 SSH2 0: SSH2_MSG_KEXINIT sent SSH2 0: SSH2_MSG_KEXINIT received SSH2: kex: client->server aes128-ctr hmac-sha1 none SSH2: kex: server->client aes128-ctr hmac-sha1 none SSH2 0: expecting SSH2_MSG_KEXDH_INIT SSH2 0: SSH2_MSG_KEXDH_INIT received SSH2 0: signature length 143 SSH2: kex_derive_keys complete SSH2 0: newkeys: mode 1 SSH2 0: SSH2_MSG_NEWKEYS sent SSH2 0: waiting for SSH2_MSG_NEWKEYS SSH2 0: newkeys: mode 0 SSH2 0: SSH2_MSG_NEWKEYS receivedSSH(scp): user authen method is 'use AAA', aaa server group ID = 1 SSH(scp): user authen method is 'use AAA', aaa server group ID = 1 SSH2 0: authentication successful for scp SSH2 0: channel open request SSH2 0: pty-req request SSH2 0: requested tty: xterm-256color, height 26, width 140 SSH2 0: env request SSH2 0: shell request SSH2 0: shell message received
user authen method is 'use AAA', aaa server group ID = 1 looks wrong to me. It should not be using aaa, I would think. But I can find no means of defining user authentication methods.
I have tried:
- using "nopassword" - still get prompted for a password (which is "").
- disabling aaa - I still get prompted for a password only, of course, it no longer works.
- various client keypair lengths: 1024,2048,4096
- various ASA keypair lengths (up to 2048)
We no longer have service agreements with Cisco and I would not reestablish them solely to fix this nagging issue.