Create Azure VM with ssh key through API - azure

So I spent the better part of a day trying to navigate through the Azure API docs and finally I'm at a stage where I've got my VM up.
For the last couple of hours I've been trying to create a VM with a public key so I can ssh into it. However, it doesn't seem to be able to authenticate me.
Here's my code:
This adds the certificate to the service:
cert_path = "/home/rohan/temp/mycert.pem"
with open(cert_path, "rb") as bfile:
cert_data = base64.b64encode(bfile.read()).decode() # decode to make sure this is a str and not a bstr
cert_format = 'pfx'
cert_password = ''
cert_res = sms.add_service_certificate(service_name=hosted_service_name,
data=cert_data,
certificate_format=cert_format,
password=cert_password)
This is to create the VM with the ssh_key:
linux_config = LinuxConfigurationSet(vm_name, 'xxxx', 'yyyyy', True)
SERVICE_CERT_THUMBPRINT = "1058XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
linux_config.ssh = SSH()
pair = KeyPair(SERVICE_CERT_THUMBPRINT, '/home/xxxx/temp/mycert.pub')
linux_config.ssh.key_pairs.key_pairs.append(pair)
sms.create_virtual_machine_deployment(service_name=hosted_service_name,
deployment_name=hosted_service_name,
deployment_slot='production',
label=hosted_service_name,
role_name=hosted_service_name,
system_config=linux_config,
os_virtual_hard_disk=os_hd,
role_size='Small')
When I try to ssh into the machine, I get the following log:
ssh -i mycert.key -v rohan#dw9y1qzwp2.cloudapp.net
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to dw9y1qzwp2.cloudapp.net [104.208.26.98] port 22.
debug1: Connection established.
debug1: identity file mycert.key type -1
debug1: identity file mycert.key-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6p1 Ubuntu-2
debug1: match: OpenSSH_6.6p1 Ubuntu-2 pat OpenSSH_6.5*,OpenSSH_6.6* compat 0x14000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm#openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm#openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA a2:80:7e:dc:b6:47:c5:d7:97:0a:7b:9c:75:c6:1f:85
debug1: Host 'dw9y1qzwp2.cloudapp.net' is known and matches the ECDSA host key.
debug1: Found key in /home/rohan/.ssh/known_hosts:22
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: xxxx#gmail.com
debug1: Authentications that can continue: publickey
debug1: Trying private key: mycert.key
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).
I'm absolutely stumped and would love Any ideas or suggestions.

Probably not exactly what you were looking for, but in terms of "getting a VM up and running and connecting via ssh", it should do the trick (using the Azure CLI: https://azure.microsoft.com/en-us/documentation/articles/xplat-cli-install/):
azure vm quick-create -g nsglinuxrg -n nsglinuxvm -l westus --os-type Linux -Q Canonical:UbuntuServer:14.04.4-LTS:latest -z Standard_D1 -u negat -p <YOUR_PWORD> -M ~/.ssh/id_rsa.pub
After doing this, I can successfully connect using:
ssh negat#<PUBLIC_IP> -i ~/.ssh/id_rsa
where I discovered the PUBLIC_IP from the FQDN spat out by the first command.

Related

Unable to ssh into EC2 instance

I first tried to ssh into my EC2 instance and I got this:
###########################################################
# WARNING: UNPROTECTED PRIVATE KEY FILE! #
###########################################################
Permissions 0644 for '/Users/SidRama/Downloads/ec2.pem.txt' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "~/Downloads/ec2.pem.txt": bad permissions
Permission denied (publicly).
So I ran:
sudo chmod 400 ~/Downloads/ec2.pem.txt
Then I executed this
ssh -i ~/Downloads/ec2.pem.txt ec2-user#ec2-52-35-59-123.us-west-2.compute.amazonaws.com -v
But I get Permission denied (publicly) as below:
OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 20: Applying options for *
debug1: /etc/ssh/ssh_config line 53: Applying options for *
debug1: Connecting to ec2-52-35-59-123.us-west-2.compute.amazonaws.com [52.35.59.111] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file ~/Downloads/ec2.pem.txt type -1
debug1: key_load_public: No such file or directory
debug1: identity file ~/Downloads/ec2.pem.txt-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Authenticating to ec2-52-35-59-123.us-west-2.compute.amazonaws.com:22 as 'ec2-user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305#openssh.com none
debug1: kex: client->server chacha20-poly1305#openssh.com none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:ZJbD9iVRP/8EbzmhyBvrC+Vg2W15k+A5cB6dea3+BAA
The authenticity of host 'ec2-52-35-59-123.us-west-2.compute.amazonaws.com (52.35.59.111)' can't be established.
ECDSA key fingerprint is SHA256:ZJbD9iVRP/8EbzmhyBvrC+Vg2W15k+A5cB6dea3+BAA.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'ec2-52-35-59-123.us-west-2.compute.amazonaws.com,52.35.59.111' (ECDSA) to the list of known hosts.
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: ~/Downloads/ec2.pem.txt
debug1: Authentications that can continue: publickey
debug1: Trying private key: ~/Downloads/ec2.pem.txt
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).
I have been trying for some time now. Any help would be deeply appreciated. Thanks in advance.
A few things I would do:
In Amazon, create an elastic IP and assign it to your instance
Use an absolute path and try a different syntax, I usually just do
:
sudo ssh -i /somepath/key.pem ec2-user#51.62.132.180
Reset the known hosts from where you are trying to connect:
sudo ssh-keygen -R 51.62.132.180
sudo ssh-keyscan -H 51.62.132.180 >> ~/.ssh/known_hosts
Double check the IP of the instance and the path to the key
Remove the .txt extension from the key file

Permission denied (publickey) ssh

I am attempting to ssh into a a EC2 machine and ssh has stopped working. I'm not sure how I broke it but it is now unable to connect. I already tried creating a new key but it is not helping.
$ ssh -vT ****#****.****-2.compute.amazonaws.com
OpenSSH_6.6.1, OpenSSL 1.0.1i 6 Aug 2014
debug1: Reading configuration data /etc/ssh_config
debug1: Connecting to ec2-****.****-2.compute.amazonaws.com [****] port 22.
debug1: Connection established.
debug1: identity file /home/Brad/.ssh/id_rsa type 1
debug1: identity file /home/Brad/.ssh/id_rsa-cert type -1
debug1: identity file /home/Brad/.ssh/id_dsa type -1
debug1: identity file /home/Brad/.ssh/id_dsa-cert type -1
debug1: identity file /home/Brad/.ssh/id_ecdsa type -1
debug1: identity file /home/Brad/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/Brad/.ssh/id_ed25519 type -1
debug1: identity file /home/Brad/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm#openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm#openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA ****
debug1: Host '****.****-2.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /home/Brad/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/Brad/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/Brad/.ssh/id_dsa
debug1: Trying private key: /home/Brad/.ssh/id_ecdsa
debug1: Trying private key: /home/Brad/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).
I have replaced all of the personal info with *.
Thank you
Nowhere in your command you are referring the ssh private key. Try running command as below:
ssh -i <path_to_the_private_key> ubuntu#<EC2_Hostname>
In above command, note that I have used the username as ubuntu. Depending on which AMI you are using, you should change the username which corresponds to that AMI.

GitLab SSH requests password and ignoring SSH Keys

I have a fresh gitlab-omnibus installation on a CentOS 6 box, I have configured it correctly and can access the web interface, I've added my SSH key however when I try to Git Clone a newly setup repo, I am asked for a password for the Git user via SSH. I have tried this with three different machines and three different accounts, and still the issue persists.
Here is the output from a verbose SSH
╭─jacobclark#Jacobs-MacBook-Pro ~
╰─$ ssh -vT git#gitlab 130 ↵
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to gitlab [37.26.93.221] port 22.
debug1: Connection established.
debug1: identity file /Users/jacobclark/.ssh/id_rsa type 1
debug1: identity file /Users/jacobclark/.ssh/id_rsa-cert type -1
debug1: identity file /Users/jacobclark/.ssh/id_dsa type -1
debug1: identity file /Users/jacobclark/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA a1:62:aa:51:0c:20:f3:3e:10:17:c7:20:a4:0b:7b:16
debug1: Host 'gitlab.' is known and matches the RSA host key.
debug1: Found key in /Users/jacobclark/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/jacobclark/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /Users/jacobclark/.ssh/id_dsa
debug1: Next authentication method: password
git#gitlab's password:
You need to turn off selinux: setenforce 0
I had the exact same issue on CentOs, turned out to be due to Centrify being used to manage ssh keys, which is non standard, but part of our corporate server management processes.
I'm not overly familiar with Centrify as its managed by another team, but I resolved this issue by creating a sym link from the gitlab authorised-keys file into /etc/sshd/auth-keys/git.
The authorizedkeys file value gave me the location the sym link needed to go to, determined with sshd -T
Resulting in this resolving my issue:
ln -s /var/opt/gitlab/.ssh/authorized_keys /etc/ssh/auth-keys/git

Remove publickey from ssh login

I'm trying to connect to an embedded board of mine through ssh. But upon trying to connect through ssh -v -l root user#xx.xx.xx.xx, I get a series of debug comments:
dico#lithya:~$ sudo ssh -v -l root dico#foxboard2
OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 22: Applying options for *
debug1: Connecting to foxboard2 [10.251.145.180] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.5p1 Debian-6
debug1: match: OpenSSH_5.5p1 Debian-6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 18:14:33:1e:88:5f:ad:13:78:9f:36:10:b9:d2:27:e4
debug1: Host 'foxboard2' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: No more authentication methods to try.
Permission denied (publickey,password).
The connection is being established through port 22 so that isn't the problem. So, clearly there is a problem with public/private key authentication. Therefore, how can I make sure that the private/public keys through both my machine and the board are in sync? Or better yet, how do I solve this issue or completely remove any keys?
UPDATE
I've tried to connect to the board by specifying no public key authentication by ssh -o PubkeyAuthentication=no dico#foxboard2, but now it's asking me for a password. I've checked the site but the password I type is incorrect. How can I remove a password request?
You can copy your public key to the server using:
ssh-copy-id user#xx.xx.xx.xx
It is always better to use keys than passwords.
Make sure your ~/.ssh directory is set to mode 700 (chmod 700 ~/.ssh) and your ~/.ssh/authorized_keys is set to mode 600 (chmod 600 ~/.ssh/authorized_keys).
In your /etc/ssh/sshd_config file set PasswordAuthentication no to turn off password logins.

Can't scp to AWS

I can ssh to my linux instance using the following:
ssh -i dj_mongo.pem -v ec2-user#xxx.compute-1.amazonaws.com
But whenever I am trying to copy file from the local computer to server, I am getting the following errors:
scp -i dj_mongo.pem ck.pem root#xxx.compute-1.amazonaws.com:/
Please login as the ec2-user user rather than root user.
scp -i dj_mongo.pem ck.pem ec2-user#xxx.compute-1.amazonaws.com:/
Permission denied (publickey).
lost connection
Both dj_mongo-pem and ck.pem has permissions 600.
Output from terminal is copied below:
Applying options for *
debug1: Connecting to xxx.compute-1.amazonaws.com [xxx] port 22.
debug1: Connection established.
debug1: identity file dj_mongo.pem type -1
debug1: identity file dj_mongo.pem-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'xxx.compute-1.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /Users/sadmin/.ssh/known_hosts:6
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/sadmin/.ssh/github_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: dj_mongo.pem
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).
lost connection
How can I proceed with that?
Please help.
EDITED
Now I can't ssh anymore. I am using the same key as yesterday.
In a typical verbose scp output
debug1: Trying private key: dj_mongo.pem
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to your.server.com ([i.p.v.4]:22).
In your output, after reading the private PEM key, it is skipping it.
Few obvious things -
Was the server launched with a same key corresponding to dj_mongo.pem?
Are you connecting to the same server?
I wasn't able to find out what was a reason of my problem.
I ended it up by creating new Linux Instance, and attaching the EBS of my old instance that stopped responding to it.
I could be wrong, but many flavors of linux block SSH/SCP access via root user. Especially if you're using Amazon AMI, they set up a root user known as ec2-user, which you should have already uploaded your pem key to, so you should be all set on logging in as this user.

Resources