Hi all,

     First time poster to Dell forums, so please excuse any noobness.  I'm having some severe issues getting Single Sign On working through Public key authentication; specifically, it just plain doesn't seem to work at all.  Setting up SSH wasn't any problem, and once i found the joy of "quotes" importing my public key to my administrative user account on the switch also wasn't an issue.  what is happening is that when i ssh from my terminal to the switch, it checks the key, accepts the key, "Authenticated with partial success" and then decides to ask for a password anyway.  Long story short, how can i get the switch to stop auto asking for a password?  This user was setup with nopassword (just cause) so simply hitting enter lets you in, but why the hell is it asking in the first place if it public key authenticated me?  Also, just because i've been bashing my head against this for days, i tried signing in with the wrong key, and 'lo and behold, the public key fails.....but procedes to ask for a password anyway, and if you enter the right password (i.e. none) it lets you in!?!  I'm having some trouble with this.

 

Here is what SSH verbose is spitting back out for me:

$ ssh -i id_dsa 10.10.10.11 -vvv
OpenSSH_5.2p1, OpenSSL 0.9.8r 8 Feb 2011
debug1: Reading configuration data /etc/ssh_config
debug1: Applying options for *
debug3: cipher ok: blowfish-cbc [blowfish-cbc]
debug3: ciphers ok: [blowfish-cbc]
debug2: ssh_connect: needpriv 0
debug1: Connecting to 10.10.10.11 [10.10.10.11] port 22.
debug1: Connection established.
debug3: Not a RSA1 key file id_dsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug1: identity file id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_4.3
debug1: match: OpenSSH_4.3 pat OpenSSH_4*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: blowfish-cbc
debug2: kex_parse_kexinit: blowfish-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client blowfish-cbc hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server blowfish-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 132/256
debug2: bits set: 1007/2048
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: filename /Users/jbw/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 3
debug1: Host '10.10.10.11' is known and matches the RSA host key.
debug1: Found key in /Users/jbw/.ssh/known_hosts:3
debug2: bits set: 1013/2048
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: id_dsa (0x0)
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: id_dsa
debug1: read PEM private key done: type DSA
debug3: sign_and_send_pubkey
debug2: we sent a publickey packet, wait for reply
Authenticated with partial success.
debug1: Authentications that can continue: password
debug3: start over, passed a different list password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup password
debug3: remaining preferred: ,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
jbw@10.10.10.11's password:

debug3: packet_send2: adding 8 (len 48 padlen 8 extra_pad 64)
debug2: we sent a password packet, wait for reply
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug2: callback start
debug2: x11_get_proto: /usr/X11R6/bin/xauth  list /tmp/launch-R6A2wW/:0 2>/dev/null
Warning: No xauth data; using fake authentication data for X11 forwarding.
debug1: Requesting X11 forwarding with authentication spoofing.
debug2: channel 0: request x11-req confirm 0
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug2: channel 0: request shell confirm 1
debug2: fd 3 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 131072
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0

console>

 

AND just because i know you can't wait to see it, here is my switch config (light and sparse i know, but that's cause i'm trying to fix this one issue)

console#show running-config
!Current Configuration:
!System Description "PowerConnect 6248, 3.3.1.10, VxWorks 6.5"
!System Software Version 3.3.1.10
!Cut-through mode is configured as disabled
!
configure
stack
member 1 2
exit
ip address 10.10.10.11 255.0.0.0
no passwords min-length
username "admin" password a7ad134c2b7cdb2fd906a573e14b58be level 15 encrypted
username "jbw" password d41d8cd98f00b204e9800998ecf8427e level 15 encrypted
crypto key pubkey-chain ssh
user-key "jbw" dsa
key-string row  AAAAB3NzaC1kc3MAAACBAIkMYpQ7OBLdzn60VhO9FuHj7ZE9zoWSdS0Kczslrrb9SGmTNYRHogxmczWa4KInWCPziUziX7uY19GcxCZmx+ZMo4kbGiJ+UlQMrfpgsntlr7q/pufWJ9Qt439IeyJ2u20Wbyv8hgoCe4gIFj1t43Q/r7rfXmqNptKGPZUT/DO/AAAAFQD8Uc9Il8DgOmOpIribCXiytmnqvwAAAIApSliT0w/4xtP93g/fAmGhQe6rZTmegJgCCURi3eBix1muVIV2slDL19RfjqP2Dl0cU/YK2qO2u4YpXNOz1Mi74xN1h4w5mWxADRyZ/neF/mxT+q1kWcslHhcKC/qxb7uh3k86BxgYyQD8Q4Ykoc9PBGzViaWg+XW5zd5hfpexZQAAAIBx1v6Tc92/XWiSUwFFG/UFnBm93Gy3TJEc+A13sGbpz36bBEwaalIGMdkQVQWclzSbpDh1T8bSdNyQ5kWqYLQ/N1R/IBooiaiVpq/QT5EGoV12Y/yh4fmWlGhIMl5swxQiPDA6Y9ElG8CRfgO8++4APpZZOKHVxHTl1/9KeT1uew==
exit
exit
ip ssh server
ip ssh pubkey-auth
exit

 

 

So, i ask you, no i implore you, please tell me what stupid error i'm making that is preventing me from getting public key to work properly.  Thanks in advance.