Hi all,
I'm having trouble getting the x2go client to authenticate with
passwordless login options other than kerberos. Specifically, I've
tried auto login (via SSH agent) and supplying the path to my OpenSSH
private key (which is an ECDSA key).
Kerberos works for me as long (as I have a valid ticket), but I want
to connect using the the ECDSA key, for reasons I'll explain below.
I suspect that the ECDSA format key is not supported by my current
client version, but if someone could confirm (or deny) that, I would
appreciate it; and if it's possible that it might work with a more up
to date client build / build against an updated LibSSH or something,
that would be good to know too. I don't currently have the wherewithal
to build my own copy of the client for MacOS, but that might provide
some incentive for me to try sometime soon.
Some background: I'm using x2go at work to connect from my Macbook Pro
to a Linux server. To connect using Kerberos, I need a valid ticket,
and to get a valid ticket, I need to first connect to the corporate
VPN. However, I don't need to connect to the VPN in order to use SSH
(from a terminal), thanks to a proxy software (a ProxyCommand in my
~/.ssh/config).
If I already have a valid Kerberos ticket, the X2go client will
connect using Kerberos, without VPN (that is, the ProxyCommand seems
to work). However, I don't want to have to connect to the VPN just to
renew my kerberos ticket when ssh itself will work using the ECDSA key
I obtain. (It will also work using my password, but that is a
temporary measure... my employer is phasing out password-based ssh in
favor of requiring U2F).
To be clear, the proxy command doesn't seem to be the issue; I
encounter the same problem when I'm connected to the VPN.
I've attached two files (with usernames and hostnames substituted),
one the output of ssh -vvv (succes) and the other the output from
/Applications/x2goclient.app/Contents/MacOS/x2goclient --debug
(failed). Both were run while connected to the VPN. The x2go session
was set up with "Try auto login" checked, Kerberos 5 unchecked, and
"Use RSA/DSA key" left blank (the log also shows that the contents of
my ssh agent were valid in the terminal). Trying after supplying a
path to my ~/.ssh/id_ecdsa file under "Use RSA/DSA key" has the same
result.