Ok.... I wonder if it has something to do with the domain difference then. How do I specify the domain in the sftp command line?
Maybe the solution is to identify the user like you suggested and the domain.
Main Topics
Browse All TopicsI am trying to setup a file transfer between two windows boxes. It looks like SFTP is the right solution.
I installed the OPENSSH server on machine "A". I setup the users that I want. Then I installed the client on machine "B". These two machines are on different windows domains which is why I am using SFTP to move the files.
I can connect manaully using username and password without an issue. I used the open ssh key gen to generate an RSA key on the client using the right acoount. I added the pub key the .ssh folder on the host machine and appended the key the the authorized_key file as well.
I also configured my SSHD_CONFIG file as noted below.
When I try to connect it disconnects right away without an error. So I tried to connect again with this connection line
sftp -v -oidentityfile=rsakey SERVERA
Here's the output
--------------------------
C:\Program Files\OpenSSH\bin>sftp -v -oidentityfile=RSAKEY
SERVERA
Connecting to SERVERA...
OpenSSH_3.8.1p1, OpenSSL 0.9.7d 17 Mar 2004
debug1: Connecting to SERVERA [10.2.117.60] port 22.
debug1: Connection established.
debug1: identity file RSAKEY type 1
debug1: Remote protocol version 2.0, remote software version OpenSSH_3.8.1p1
debug1: match: OpenSSH_3.8.1p1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUES
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'SERVERA' is known and matches the RSA host key.
debug1: Found key in /home/backupops/.ssh/known
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
****USAGE WARNING****
This is a private computer system. This computer system, including all
related equipment, networks, and network devices (specifically including
Internet access) are provided only for authorized use. This computer system
may be monitored for all lawful purposes, including to ensure that its use
is authorized, for management of the system, to facilitate protection against
unauthorized access, and to verify security procedures, survivability, and
operational security. Monitoring includes active attacks by authorized entities
to test or verify the security of this system. During monitoring, information
may be examined, recorded, copied and used for authorized purposes. All
information, including personal information, placed or sent over this system
may be monitored.
Use of this computer system, authorized or unauthorized, constitutes consent
to monitoring of this system. Unauthorized use may subject you to criminal
prosecution. Evidence of unauthorized use collected during monitoring may be
used for administrative, criminal, or other adverse action. Use of this system
constitutes consent to monitoring for these purposes.
debug1: Authentications that can continue: publickey,password,keyboar
ve
debug1: Next authentication method: publickey
debug1: Offering public key: RSAKEY
debug1: Server accepts key: pkalg ssh-rsa blen 149
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending subsystem: sftp
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 0.5 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0
debug1: Exit status 255
Connection closed
Why can I connect with username and password and not RSA Key Authentication?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If you use cygwin, then in the /etc/passwd file the link is made between a 'cygwin' user (as mentioned on the ssh commandlines) and a windows user. Cygwin provides tools for generating the /etc/passwd file.
The so called GCOS field is filled with the security identifier of the relevant account, and this is used both ways to identify users.
There is no other link between the user environment (unix side) that uses uid & gid and the windows side that uses security id's.
An ssh certificate has no username in it ==> if you connect with
Youre logged on as MrX on system B
and you specify ssh -v serverA, you will attempt to logon as MrX (whether password or certificate).
if you specify ssh -v MrZ@serverA you will attempt to login as MrZ (wether password or certificate).
So you are comparing logging on as username@SERVERA with password with loging on as your local username MrX@SERVERA with a certificate.... and if run from a service process, as the owner of that service process.
if you don't supply a username on the commandline then your local username is sent to the other side to be used as username.
So if you are user1 on system 1 and want to connect to user1 on system2
you can use either:
ssh system2 <-- using default local username
ssh user1@system2 <-- using explicit username
So if you are user1 on system 1 and want to connect to user2 on system2
you can only use:
ssh user2@system2 <-- using explicit username
Then there is authentication, you can use various methods,
- gssapi / Kerberos ticket (not enabled on your system)
- certificate with matching private/public keys
- keyboard (= password)
So if you specify -oIdentityFile that is a certificate that can be used instead of a password, if that fails a password will be used as backup.
So specifying a certificate without the username it probably fails to get to the right user.
here is the security log of when authenticaiton attempts. I'm sorry it took so long but with all my messing around I was not able to even start the server. I have reinstalled and gotten myself back to the same issue. Please advise if there is other logging that I can attach
Logon Failure:
Reason: An error occurred during logon
User Name: USERNAME
Domain: DOMAIN
Logon Type: 3
Logon Process: Cygwin.1
Authentication Package: MICROSOFT_AUTHENTICATION_P
Workstation Name:
Status code: 0xC000007A
Substatus code: 0x0
Caller User Name: HOSTNAME$
Caller Domain: ENT
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 6452
Transited Services: -
Source Network Address: -
Source Port: -
have you allready tried running the server in debug mode?
It will only handle one call then but you could try:
sshd -d -e [ and the other options if needed ]
then it will wait for a connection and you should be able to why the activation of sftp fails.
If -d is not enough information try '-d -d' or even '-d -d -d' instead.
The output will be printed to stdout, so maybe use
sshd -d -e [ and the other options if needed ]>logfile
to capture the output.
Thanks for you help... but i figured it out... I was running the server as the local system account (as per the standard install)
I found a guide that suggested moving it to a local admin account and setting some special local polices including allowing the "create token" right.
After that, I restarted the server, and TA-DA! it works!
Thanks,
Business Accounts
Answer for Membership
by: nociPosted on 2009-09-16 at 06:33:09ID: 25345384
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending subsystem: sftp
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
You do get authenticated..., and then something fails when it tries to starts sftp on the remote host.
You need to check loggin on the SERVERA system (either /var/log, or eventvwr) depending on configuration options.
The problem might well be that the /etc/passwd file is not quite correctly built with the correct host security identifiers)
Also if you don't supply a username, your current username is sent across, based on the local /etc/passwd. So maybe you need:
sftp -v -oidentityfile=rsakey target-username@SERVERA
All this assumes you use a cygwin based openssh. ;-)