unable to login with generated sshkey #64
-
|
Hi, I'm trying to use opkssh with Okta.
The browser opens, I authenticate to Okta, and the key is generated: Key information: SSH login: SSHd logs: |
Beta Was this translation helpful? Give feedback.
Answered by
EthanHeilman
Mar 31, 2025
Replies: 3 comments 4 replies
-
|
@gstorme Sorry I didn't see this until 5 minutes ago. I did not know anyone was using discussions and I don't get any notification when a discussion thread it created. Let's figure out what is going on Everything looks good in your ssh key. What do your auth_id policy and providers files look like? sudo cat /etc/opk/providers
sudo cat /etc/opk/auth_id
cat /home/gregory/.opk/auth_idCan you provide your opkssh logs? sudo tail -n 100 /var/logs/opkssh.logMake sure to change any strings that might be considered sensitive. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
/etc/opk/providers /etc/opk/auth_id Logfile |
Beta Was this translation helpful? Give feedback.
4 replies
-
|
Thanks that is very helpful. The error message: "Failed to create pk token verifier (likely bad configuration): unsupported issuer" is no longer in the code base it was removed in the PR #58 that added custom providers I believe you said you recompiled from main and used that on the server, but this error message points to it being an older version. Likely the install didn't take. I suspect that you are running release What was the exact command string you used to update the server binary? Let me know the values you get if you run: If you are running centos, I ran into a very strange issue once. I updated opkssh, but sshd somehow kept using an older version of opkssh. I believe I fixed it by restarting sshd: redhat/centos systemctl restart sshddebian/ubuntu systemctl restart sshI think that issue was caused by SELINUX, but I never confirmed that. Are you running an OS with SELINUX on it? I really should figure out a way to get the latest commit hash that opkssh was built from into the opkssh.log. |
Beta Was this translation helpful? Give feedback.
Answer selected by
EthanHeilman
-
|
You're right. It seems to do the verify twice, is that expected? |
Beta Was this translation helpful? Give feedback.
-
|
Glad to hear that works.
That is not expected and I did not realized that was happening. Thanks for that bug report, I created an issue to solve it here |
Beta Was this translation helpful? Give feedback.
-
|
Open any issues for any problems you run into |
Beta Was this translation helpful? Give feedback.
-
|
Closing as this resolved |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Thanks that is very helpful.
The error message: "Failed to create pk token verifier (likely bad configuration): unsupported issuer" is no longer in the code base it was removed in the PR #58 that added custom providers
https://github.com/openpubkey/opkssh/pull/58/files#diff-d33c3315a11b10bc71b8f039dd4c83a5b7127fb284659c2f2ad436661ca2d1caL93
I believe you said you recompiled from main and used that on the server, but this error message points to it being an older version. Likely the install didn't take. I suspect that you are running release
0.3.0rather than main which added this feature.What was the exact command string you used to update the server binary?
Let me know the values you ge…