User-provided auth certificate

[viccpp]

putty has this setting:

How do I specify it in NetBox?

[ssvine]

Use puttygen.exe to add the certificate to your private key. Then use the resulting key in NetBox as usual.

Key -> Add certificate to key -> select key-cert.pub -> save -> use

[viccpp]

They are generated automatically and regenerated often.

[viccpp]

Use puttygen.exe to add the certificate to your private key. Then use the resulting key in NetBox as usual.

Key -> Add certificate to key -> select key-cert.pub -> save -> use

This isn't working. NetBox does not use the cert when connecting.

[ssvine]

What version of NetBox do you use?

[viccpp]

Version 24.12.2 build 608

[ssvine]

And what version of ssh on the server?

[viccpp]

OpenSSH_8.0p1, OpenSSL 1.1.1k FIPS 25 Mar 2021

[viccpp]

putty shows the same error message w/o the specified cert, otherwise connects successfully

[ssvine]

Could you check that the key.ppk you use in NetBox starts with a line
PuTTY-User-Key-File-3: ssh-rsa-cert-v01@openssh.com
?

[viccpp]

PuTTY-User-Key-File-3: ssh-rsa-cert-v01@openssh.com
Encryption: none
Comment: teleport-generated-ppk
Public-Lines: 37
...

[ssvine]

Strange. There may be a problem with OpenSSH 7.x versions, but you have 8.0. I'll try to check certificate authentication with 8.0p1 later

[ssvine]

It seems that your OpenSSH server is configured with something like
HostKeyAlgorithms rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com

This is not fully supported at the moment. If you have a control over your OpenSSH server, you can comment HostKeyAlgorithms. This way you'll be able to connect.

They are generated automatically and regenerated often.

If this is a problem, you can use separate private key and certificate:

1. In "private key file" field use your plain private key (i.e. without added certificate)
2. Export the session (F5) to a file *.netbox
3. In the *.netbox file add a parameter
   <DetachedCertificate>C:/Path/to/user-key-cert.pub</DetachedCertificate>
   use / or %5C instead of \ in the path
4. Import back the *.netbox to the session list (F5)

[viccpp]

If you have a control over your OpenSSH server

I don't.

Export/Import isn't working (the same error message).

[ssvine]

Export and Import should work, it has nothing to do with connection.

Export: You go to the session list, put cursor to the session of interest and press F5 to export the session to some place.
You'll see something like this:

╔══════════════════════════════ Export ══════════════════════════════╗
║ Export session "root@my-serv" to:                                  ║
║ C:\work                                                           ↓║
╟────────────────────────────────────────────────────────────────────╢
║                         { OK } [ Cancel ]                          ║
╚════════════════════════════════════════════════════════════════════╝

[viccpp]

I mean Exported then Imported with <DetachedCertificate> config isn't working. Tried both / and %5C