Tuesday, March 11, 2014

PuTTY -batch Authentication Denied

New system. PuTTY pscp is not working right. Normal pscp -v -batch in the code is failing with an unhelpful "Authentication Denied" message. Directly logging into the remote system with PuTTY is working fine.

What I learned to fix it:

1. Get the most current version of PuTTY. Googling the problem revealed that many online thought that there was a "bug" in version 0.60 that caused this, and upgrading to 0.62 (apparently the most recent version) fixes it. Here's a few links of many in which this assertion is made:

http://www.derkeiler.com/Newsgroups/comp.security.ssh/2009-02/msg00070.html
https://groups.google.com/forum/#!topic/comp.security.ssh/GbAEXzBD8hE
http://earthwithsun.com/questions/312197/putty-0-61-why-do-i-see-access-denied-message-after-i-enter-my-login-id

2. After performing the upgrade it still gets me Authentication Denied, but also better error messages. Now it also says "GSSAPI authentication request refused". Whatever the hell that is. From the following links, I learned that I mostly just need to disable GSSAPI authentication, and the best way to do this was through the PuTTY configuration:

http://superuser.com/questions/465709/getting-access-denied-error-in-putty-with-a-normal-user
http://superuser.com/questions/312197/putty-0-61-why-do-i-see-access-denied-message-after-i-enter-my-login-id
Here is the same explanation applied to a slightly different situation (not trying to use pscp):
http://nolabnoparty.com/en/access-denied-ssh-error-with-putty-in-windows-7/

3. I was able to make a PuTTY configuration that had GSSAPI turned off and pscp started working, but my configuration was poorly named. I had made two configurations, one named @ and the other being named . The one with GSSAPI turned off was @, and if I did pscp -v -batch -load @ it worked. After looking at how I had PuTTY configured on my other systems I realized that for pscp with the private key authentication to work automatically without having to feed it the parameter for which configuration to load, I needed the configuration to be set up with the user name as the default username in the Connection->Data parameters. So I deleted the @ configuration, and corrected the configuration to have the username as the default username, the private key selected under Connection->SSH->Auth and GSSAPI turned off under Connection->SSH->Auth->GSSAPI.

4. Now the new system is set up like my other systems. Except that arguably they are all wrong now; what I should have is a custom named configuration that the code calls using pscp -load rather than having the default pscp configuration for automatically using the username and keys.

5. I should upgrade PuTTY to version 0.63 now for security reasons:
http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html