Unable to setup proper passwordless SSH connection to PINN

[drotciv]

Hello,

I am attempting to connect remotely to PINN via a SSH key. I need to do this because I would not like to leave the connection unsecure, as I may need to access to system from the internet.

I have been following the instructions in the README_PINN.md under “How to access the shell or SSH into PINN”

I can properly SSH to PINN with the user/password method without trouble. However after I add my public key to /settings/.ssh/authorized_keys and switch to passwordless connection on my client, it states that the key cannot be found.

I am pretty sure I did add the key properly as per the instructions, and I did it several times. I also decided to chmod the .ssh directory and the authorized_keys file to be sure, but it did not change anything.

I do have “ssh” in the recovery.cmdline file and I know the key is correct as it is working fine to connect to another system on the same machine.

Is there anything I am doing wrong?

Thank you for your time!

[procount]

I didn't add any explicit instructions for creating the ssh keys and installing them, so perhaps there is a mistake in the expected format.
What SSH client are you using (e.g. putty?) and how are you generating your keys (puttygen?)
I probably need to write some more detailed instructions in the Wiki.

[drotciv]

Hello,

Thank you for your prompt answer!

I am looking for a mobile solution, so I have tried with Termius and Shortcuts, both on iOS. From both, the password connection works fine.

The keys were generated automatically by either Termius or Shortcuts. As I mentioned above, the Shortcuts keys are known to be working, as I can use them to remotely connect to RPi OS or LibreElec on the same machine for example.

Keys are ed25519 for both apps, if that may give a clue.

[procount]

I am documenting the process more fully for Windows using Putty/Puttygen.
I'm sorry, but I don't have any iOS devices, but it should be similar.
Try using RSA keys of 2048 bits as that is most common.
I shall post some examples of the keys as it might help you ensure you are using the correct formats.

[drotciv]

Hello,

I have installed Putty on a Windows VM on my mac to be able to try again.

So far, I made a new key pair in RSA 2048 as instructed, then added the public one to authorized_keys in /settings/.ssh and tried to connect from Putty to no avail.

When it connects, it states "Server refused our key" and then I can enter the regular password, and it works normally. Still, I am unable to use the key system.

I did not mention it earlier, but I used the PINN files found on https://pinn.mjh.nz/ form a custom setup I made for myself, if that may be an issue. I will try with a fresh PINN set of files on a clean SD card tomorrow to see if there is any difference.

I am looking forward to your examples and additional info you'll add to the README.

[procount]

If you're getting "Server refused our key", then that at least means that Putty is sending a key. So probably just a key format issue.

Using files from Matt's pinn/mjh.nz site should be ok, provided you have enabled ssh, which you seem to have done.

Please have a look at: https://github.com/procount/pinn/wiki/Secure-SSH-with-Putty particularly the public key part for the RPi

[drotciv]

Hello,

I have tried again on a clean install of PINN straight from the RPi imager and the behaviour is the same.

I can connect fine with user/password, but get the same error message when trying the keys.

I checked permissions with ls -la on both the directory and the file as instructed and it is identical.

I have not yet been able to try Putty but will get back to you once I have.

Is it working without issue on your end with Putty as well? Is it just on my side?

I have not mentioned the hardware, so here it is a RPi 3B.

[procount]

Yes it works fine for me.
I documented the steps I took to get it working with Putty on the Wiki, with example keys.

[drotciv]

Hello!

I finally had the opportunity to try with Putty. I did several things and finally got it to work!

First I tried on a clean PINN with a RSA 2048 key and then a 4096 and it worked.
I then tried on the custom PINN with a 4096, and it did not!

I opened the config file once more and compared all the settings... except for the settings obviously related to the custom PINN, I reverted everything else to default.

After doing that and restarting, and adding the 4096 properly again, it worked!

So while I was at it, I wondered if PINN could take the first key I tried, the ed25519.
I created a specific key in that format on Putty and put it on both the clean PINN and my custom PINN, and it does not work.

I suspect you were right from the start with the format, but I would go even further and say that SSH to PINN with an ed25519 key is not supported or does not work. At least that is what I could get from what I tried.

So I'll stick to RSA 4096 keys from now on!

Thank you for all your answers and the time you took to update the README "specially for me"! I really appreciate it!

[procount]

PINN uses a version of dropbear from 2015. I don't think it supported edd25519 until 2020 onwards.