Teleport ECMWF user@jump.ecmwf.int: Permission denied (publickey) version 2

When trying to connect to the ECMWF server, I get the error

$ ssh ecs-login
km4h@jump.ecmwf.int: Permission denied (publickey).
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

See here for the full log.

Even after following the steps in #61 (closed) the problem persists.

assigned to @blaschm7

following these instructions: documentation changed the error to:

$ ssh ecs-login
sign_and_send_pubkey: signing failed for RSA "teleport:marina.duetsch@univie.ac.at" from agent: agent refused operation
km4h@jump.ecmwf.int: Permission denied (publickey).
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

The certificates from teleport are valid, renewal does not change a thing.

Valid until: 2024-10-08 01:41:47 +0200 CEST [valid for 11h45m0s]

restarting the ssh-agent or fixing permissions of .ssh does not change a thing.

Error in verbose log:

...
/srvfs/home/mduetsch/.tsh/keys/jump.ecmwf.int/marina.duetsch@univie.ac.at-ssh/jump.ecmwf.int-cert.pub RSA-CERT SHA256:qoNAO3RANqY5P0t544WZdZsvbPusQoKXkl8JHtRarek explicit
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: /srvfs/home/mduetsch/.tsh/keys/jump.ecmwf.int/marina.duetsch@univie.ac.at-ssh/jump.ecmwf.int-cert.pub RSA-CERT SHA256:qoNAO3RANqY5P0t544WZdZsvbPusQoKXkl8JHtRarek explicit
debug2: sign_and_send_pubkey: using private key "/srvfs/home/mduetsch/.tsh/keys/jump.ecmwf.int/marina.duetsch@univie.ac.at" from agent for certificate
sign_and_send_pubkey: signing failed for RSA "/srvfs/home/mduetsch/.tsh/keys/jump.ecmwf.int/marina.duetsch@univie.ac.at": agent refused operation

for some reason the agent refused the operation?

checking loaded modules:

$ module list
Currently Loaded Modulefiles:
 1) teleport/10.3.3

or $PATH or $LD_LIBRARY_PATH does help.

the server journal reveals:

Oct 07 14:58:22 aurora.img.univie.ac.at ssh-agent[3460389]: error: process_sign_request2: sshkey_sign: error in libcrypto

whatever that means?

added SRVX ecmwf labels

On jet it works!

this is related to AlmaLinux 9, Rocky Linux 9, OpenSSH_8.7p1 (OpenSSL 3.0.7 1 Nov 2022). Changing the cryptopolicies manually by editing these files:

/etc/crypto-policies/back-ends/openssh.config /etc/crypto-policies/back-ends/opensshserver.config

does not work. still agent refused operation.

ok. I found the fix. using update-crypto-policies --set LEGACY does the trick or a minor setback: update-crypto-policies --set DEFAULT:SHA1.

Source: RHEL9 Security

closed