SSH to Azure VM with short lived key

My mistake, I should not post that in feature requests. Can somebody delete this post and I will properly post this in Support
Thanks and kind regards,
Sebastijan

Hello,

No problem, I will transfer this to the RDM support forum.

Based on the logs you've provided, the SSH authentication is failing because the server does not accept the SSH certificate you're using for authentication.
Would it be possible to try recreating the certificate and see if the issue persists?

Best regards,

Hello!

>No problem, I will transfer this to the RDM support forum.
Thanks for fixing my mess 😅

>Would it be possible to try recreating the certificate and see if the issue persists?
Certificate is created each time by running this:
az ssh config --ip <host IP> --file <userprofiledir>\config --overwrite

This creates <userprofiledir>\config file with following content:

Host <host IP>
	User user@domain.com
	CertificateFile "<userprofiledir>\az_ssh_config\<host IP>\id_rsa.pub-aadcert.pub"
	IdentityFile "<userprofiledir>\az_ssh_config\<host IP>\id_rsa"

Following two files are also created:

• <userprofiledir>\az_ssh_config\<host IP>\id_rsa.pub-aadcert.pub
• <userprofiledir>\az_ssh_config\<host IP>\id_rsa

I can use config file directly, which works, so certificate must be OK:

ssh -F <userprofiledir>\config -l user@domain.com <host IP>

But if I user RDM and put "<userprofiledir>\az_ssh_config\<host IP>\id_rsa" as SSH key and <userprofiledir>\az_ssh_config\<host IP>\id_rsa.pub-aadcert.pub as certificate I get error above.

Obviously I am putting wrong things to wrong places, so this is my configuration (sensitive data redacted, but I used absolute paths to files):



Kind regards,
Sebastijan

Hello,

Thank you for your patience.

While RDM does support RSA keys, the issue likely stems from how RDM handles OpenSSH certificates associated with those keys. OpenSSH certificates are different from standard public keys and seems to require specific handling.

I will contact the development team to see if there is anything we can do to address your issue.

In the meantime, as a workaround, could you try creating a Windows Terminal entry and use the following command: 
`ssh -F <userprofiledir>\config -l user@domain.com <host IP>` 
Please let me know if the issue still occurs using this method instead of an SSH session.

Best regards,

Hello

To help us better understand and resolve the issue, could you please check whether the authorized_keys file on your Azure VM includes a line similar to the following:

cert-authority ssh-rsa AAAAB3...rest_of_ca_public_key... comment

This line is crucial because it allows the server to recognize and accept SSH certificates signed by a specific Certificate Authority (CA). If this entry is missing or not properly configured, the server may reject the SSH certificate provided by RDM.

Best regard

In the meantime, as a workaround, could you try creating a Windows Terminal entry and use the following command: 
`ssh -F <userprofiledir>\config -l user@domain.com <host IP>` 
Please let me know if the issue still occurs using this method instead of an SSH session.

That works, but unfortunately with Windows Terminal I cannot use stuff like "Post login" commands.

To help us better understand and resolve the issue, could you please check whether the authorized_keys file on your Azure VM includes a line similar to the following:

cert-authority ssh-rsa AAAAB3...rest_of_ca_public_key... comment

This line is crucial because it allows the server to recognize and accept SSH certificates signed by a specific Certificate Authority (CA). If this entry is missing or not properly configured, the server may reject the SSH certificate provided by RDM.

There is actually no ~/.ssh/authorized_keys file at all... I know that servers are added to Active Directory, so I am wondering if this might be stored somewhere else...

On the other hand, would it be easier if I would have ppk file instead? For example I have already successfully set up WinSCP, where in addition to 'az ssh config ...' I also run this to convert certificate to PPK:

$winscpargs = '/keygen "<userprofiledir>\az_ssh_config\$HOST$\id_rsa" /certificate="<userprofiledir>\az_ssh_config\<host IP>\id_rsa.pub-aadcert.pub" /output="<userprofiledir>\az_ssh_config\<host IP>\id_rsa.ppk"'
Start-Process -Wait -FilePath "<userprofiledir>\Documents\Tools\WinSCP-Portable\WinSCP.com" -ArgumentList $winscpargs

Then I just point ssh key setting of winscp entry to this ppk file and scp works (protocol in entry is set to SCP):


But if I try to do same in SSH (set PPK as in "SSH key"->General and no certificate in "SSK key"->Certificate, I again get error.

Hello,

Thank you for your patience.

Unfortunately, we currently do not have the setup required to reproduce the issue. However, we will work on recreating it and keep you updated on any progress.

Best regards,