auth with rsa privacy key. but have error: SSHAuthFailError(All authentication methods failed)

[openUmbrella]

this is log:

flutter: SSHTransport._sendKexInit
flutter: SSHTransport._processVersionExchange
flutter: SSHTransport._remoteVersion = "SSH-2.0-OpenSSH_6.4"
2
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeClearTextPacket
flutter: SSHTransport._handleMessageKexInit
flutter: SSHTransport._kexType: SSHKexType(ecdh-sha2-nistp521)
flutter: SSHTransport._hostkeyType: SSHHostkeyType(ssh-rsa)
flutter: SSHTransport._clientCipherType: SSHCipherType(aes128-ctr)
flutter: SSHTransport._serverCipherType: SSHCipherType(aes128-ctr)
flutter: SSHTransport._clientMacType: SSHMacType(hmac-sha1)
flutter: SSHTransport._serverMacType: SSHMacType(hmac-sha1)
flutter: SSHTransport._sendKexDHInit
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeClearTextPacket
flutter: SSHTransport._handleMessageKexReply
flutter: SSHTransport._consumeClearTextPacket
flutter: SSHTransport._handleMessageNewKeys
flutter: SSHTransport._sendNewKeys
flutter: SSHClient._onTransportReady
flutter: SSHClient._requestAuthentication
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeEncryptedPacket
flutter: SSHClient._startAuthentication
flutter: SSHClient._tryNextAuthenticationMethod
flutter: _currentAuthMethod = SSHAuthMethod.publicKey
flutter: SSHClient._authWithPublicKey
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeEncryptedPacket
flutter: SSHClient._handleUserauthFailure
flutter: SSHClient._tryNextAuthenticationMethod
flutter: _currentAuthMethod = SSHAuthMethod.none
flutter: SSHClient._authWithNone
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeEncryptedPacket
flutter: SSHClient._handleUserauthFailure
flutter: SSHClient._tryNextAuthenticationMethod
flutter: SSHTransport.closeWithError SSHAuthFailError(All authentication methods failed)

I try to use FileZilla to connect, it's fine.
So I don't know where I'm going wrong

[falrom]

The same problem as you, "All authentication methods failed"
And FileZilla works fine.

[HJ29]

same error, any solution?
same pem file works with filezilla and node app using https://github.com/mscdex/ssh2

debug: SSHTransport._sendKexInit
trace: -> _SSHNativeSocket(x.x.x.x:22): SSH_Message_KexInit(kexAlgorithms: [curve25519-sha256@libssh.org, ecdh-sha2-nistp521, ecdh-sha2-nistp384, ecdh-sha2-nistp256, diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1, diffie-hellman-group1-sha1], serverHostKeyAlgorithms: [ssh-ed25519, rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp521, ecdsa-sha2-nistp384, ecdsa-sha2-nistp256], encryptionClientToServer: [aes128-ctr, aes128-cbc, aes256-ctr, aes256-cbc], encryptionServerToClient: [aes128-ctr, aes128-cbc, aes256-ctr, aes256-cbc], macClientToServer: [hmac-sha1, hmac-sha2-256, hmac-sha2-512, hmac-md5], macServerToClient: [hmac-sha1, hmac-sha2-256, hmac-sha2-512, hmac-md5], compressionClientToServer: [none], compressionServerToClient: [none], languagesClientToServer: [], languagesServerToClient: [], firstKexPacketFollows: false)
debug: SSHTransport._processVersionExchange
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH-2.0-ReflectionforSecureIT_8.2.1 Build 1100
debug: SSHTransport._remoteVersion = "SSH-2.0-ReflectionforSecureIT_8.2.1 Build 1100"
debug: SSHTransport._processPackets
debug: SSHTransport._consumeClearTextPacket
debug: SSHTransport._handleMessageKexInit
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH_Message_KexInit(kexAlgorithms: [diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1, diffie-hellman-group-exchange-sha256], serverHostKeyAlgorithms: [ssh-rsa-sha2-256@attachmate.com, ssh-rsa], encryptionClientToServer: [aes128-ctr, aes192-ctr, aes256-ctr], encryptionServerToClient: [aes128-ctr, aes192-ctr, aes256-ctr], macClientToServer: [hmac-sha256, hmac-sha2-256, hmac-sha1, hmac-sha512, hmac-sha2-512], macServerToClient: [hmac-sha256, hmac-sha2-256, hmac-sha1, hmac-sha512, hmac-sha2-512], compressionClientToServer: [zlib, none], compressionServerToClient: [zlib, none], languagesClientToServer: [], languagesServerToClient: [], firstKexPacketFollows: false)
debug: SSHTransport._kexType: SSHKexType(diffie-hellman-group-exchange-sha256)
debug: SSHTransport._hostkeyType: SSHHostkeyType(ssh-rsa)
debug: SSHTransport._clientCipherType: SSHCipherType(aes128-ctr)
debug: SSHTransport._serverCipherType: SSHCipherType(aes128-ctr)
debug: SSHTransport._clientMacType: SSHMacType(hmac-sha1)
debug: SSHTransport._serverMacType: SSHMacType(hmac-sha1)
debug: SSHTransport._sendKexDHGexRequest
trace: -> _SSHNativeSocket(x.x.x.x:22): SSH_Message_KexDH_GexRequest(minN: 1024, preferredN: 2048, maxN: 8192)
debug: SSHTransport._processPackets
debug: SSHTransport._consumeClearTextPacket
debug: SSHTransport._handleMessageKexReply
debug: SSHTransport._handleMessageKexGexReply
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH_Message_KexDH_GexGroup(p: 24265446577633846575813468889658944748236936003103970778..., g: 2)
debug: SSHTransport._sendKexDHGexInit
trace: -> _SSHNativeSocket(x.x.x.x:22): SSH_Message_KexDH_Init(e: 39821409377347738502203960700211085538213483516657...)
debug: SSHTransport._processPackets
debug: SSHTransport._consumeClearTextPacket
debug: SSHTransport._handleMessageKexReply
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH_Message_KexDH_GexReply(hostPublicKey: [0, 0, 0, 7, 115, 115, 104, ...], f: 81701524925607001157746291846066777266148110960456148224999..., signature: [0, 0, 0, 7, 115, 115, 104, 45, 114, 115, 97, ...])
debug: SSHTransport._consumeClearTextPacket
debug: SSHTransport._handleMessageNewKeys
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH_Message_NewKeys
debug: SSHTransport._sendNewKeys
trace: -> _SSHNativeSocket(x.x.x.x:22): SSH_Message_NewKeys()
debug: SSHClient._onTransportReady
debug: SSHClient._requestAuthentication
trace: -> _SSHNativeSocket(x.x.x.x:22): SSH_Message_Service_Request{serviceName: ssh-userauth}
debug: SSHTransport._processPackets
debug: SSHTransport._consumeEncryptedPacket
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH_Message_Service_Accept{serviceName: ssh-userauth}
debug: SSHClient._startAuthentication
debug: SSHClient._tryNextAuthenticationMethod
debug: _currentAuthMethod = SSHAuthMethod.publicKey
debug: SSHClient._authWithPublicKey
trace: -> _SSHNativeSocket(x.x.x.x:22): SSH_Message_Userauth_Request(user: xxxxxxxx, serviceName: ssh-connection, methodName: publickey)
debug: SSHTransport._processPackets
debug: SSHTransport._consumeEncryptedPacket
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH_Message_Userauth_Failure(methodsLeft: [publickey], partialSuccess: false)
debug: SSHClient._handleUserauthFailure
debug: SSHClient._tryNextAuthenticationMethod
debug: _currentAuthMethod = SSHAuthMethod.none
debug: SSHClient._authWithNone
trace: -> _SSHNativeSocket(x.x.x.x:22): SSH_Message_Userauth_Request(user: xxxxxxxx, serviceName: ssh-connection, methodName: none)
debug: SSHTransport._processPackets
debug: SSHTransport._consumeEncryptedPacket
trace: <- _SSHNativeSocket(x.x.x.x:22): SSH_Message_Userauth_Failure(methodsLeft: [publickey], partialSuccess: false)
debug: SSHClient._handleUserauthFailure
debug: SSHClient._tryNextAuthenticationMethod
debug: SSHTransport.closeWithError SSHAuthFailError(All authentication methods failed)

[falrom]

I can use the same key file to connect on FileZilla, or directly using SSH:

ssh root@10.64.20.141 -p 1922 -i /home/username/id_rsa -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa

My dart code here:

import 'dart:convert';
import 'dart:io';
import 'dart:async';

import 'package:dartssh2/dartssh2.dart';

Future<void> main() async {
  final client = SSHClient(
    await SSHSocket.connect('10.64.20.141', 1922),
    username: 'root',
    identities: [
      // A single private key file may contain multiple keys.
      ...SSHKeyPair.fromPem(await File('/home/username/id_rsa').readAsString())
    ],
    printDebug: print,
    printTrace: print,
  );
  print(utf8.decode(await client.run("ls -lah /home")));
  client.close();

  return;
}

My log here:

Restarted application in 273ms.
flutter: SSHTransport._sendKexInit
flutter: -> _SSHNativeSocket(10.64.20.141:1922): SSH_Message_KexInit(kexAlgorithms: [curve25519-sha256@libssh.org, ecdh-sha2-nistp521, ecdh-sha2-nistp384, ecdh-sha2-nistp256, diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1, diffie-hellman-group1-sha1], serverHostKeyAlgorithms: [ssh-ed25519, rsa-sha2-512, rsa-sha2-256, ssh-rsa, ecdsa-sha2-nistp521, ecdsa-sha2-nistp384, ecdsa-sha2-nistp256], encryptionClientToServer: [aes128-ctr, aes128-cbc, aes256-ctr, aes256-cbc], encryptionServerToClient: [aes128-ctr, aes128-cbc, aes256-ctr, aes256-cbc], macClientToServer: [hmac-sha1, hmac-sha2-256, hmac-sha2-512, hmac-md5], macServerToClient: [hmac-sha1, hmac-sha2-256, hmac-sha2-512, hmac-md5], compressionClientToServer: [none], compressionServerToClient: [none], languagesClientToServer: [], languagesServerToClient: [], firstKexPacketFollows: false)
flutter: SSHTransport._processVersionExchange
flutter: <- _SSHNativeSocket(10.64.20.141:1922): SSH-2.0-OpenSSH_6.4
flutter: SSHTransport._remoteVersion = "SSH-2.0-OpenSSH_6.4"
flutter: SSHTransport._processPackets
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeClearTextPacket
flutter: SSHTransport._handleMessageKexInit
flutter: <- _SSHNativeSocket(10.64.20.141:1922): SSH_Message_KexInit(kexAlgorithms: [ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1], serverHostKeyAlgorithms: [ssh-rsa], encryptionClientToServer: [aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se], encryptionServerToClient: [aes128-ctr, aes192-ctr, aes256-ctr, arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, rijndael-cbc@lysator.liu.se], macClientToServer: [hmac-md5-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-ripemd160-etm@openssh.com, hmac-sha1-96-etm@openssh.com, hmac-md5-96-etm@openssh.com, hmac-md5, hmac-sha1, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96], macServerToClient: [hmac-md5-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-ripemd160-etm@openssh.com, hmac-sha1-96-etm@openssh.com, hmac-md5-96-etm@openssh.com, hmac-md5, hmac-sha1, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-ripemd160, hmac-ripemd160@openssh.com, hmac-sha1-96, hmac-md5-96], compressionClientToServer: [none, zlib@openssh.com], compressionServerToClient: [none, zlib@openssh.com], languagesClientToServer: [], languagesServerToClient: [], firstKexPacketFollows: false)
flutter: SSHTransport._kexType: SSHKexType(ecdh-sha2-nistp521)
flutter: SSHTransport._hostkeyType: SSHHostkeyType(ssh-rsa)
flutter: SSHTransport._clientCipherType: SSHCipherType(aes128-ctr)
flutter: SSHTransport._serverCipherType: SSHCipherType(aes128-ctr)
flutter: SSHTransport._clientMacType: SSHMacType(hmac-sha1)
flutter: SSHTransport._serverMacType: SSHMacType(hmac-sha1)
flutter: SSHTransport._sendKexDHInit
flutter: -> _SSHNativeSocket(10.64.20.141:1922): SSH_Message_KexECDH_Init(publicKey: 0400200072142202da82508dc286ffff70b796072ac65a4efcf2ecf934b958031f53dafc340af48b791c307a277880261a0f436dea201398b627cb144c9537615d8b270103f4f22066a61f841795bb974dc9fa48211b77f4b6de37cede43c39bd7244aeed8f6ae7e045b0431fafc2bd8770820f67609c4689c7135e126c10baf7085acd372)
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeClearTextPacket
flutter: SSHTransport._handleMessageKexReply
flutter: <- _SSHNativeSocket(10.64.20.141:1922): SSH_Message_KexECDH_Reply(hostPublicKey: 000000077373682d727361000000030100010000010100cc97ddb25353d9a36aa88892037553b20df256fb09a502c0f2f27006777698a59ce728bfedb8f32ada1f2c6623c0cd444de042d02888c3d76bf4cf04454e3949cc975fbd5816ed7e865e8fdba70693657c5a39400cb3b33f6618c3367aa08a89636bf3983d506506a529572080e097c52713b81cbce26aedd0a2e71ff18a589fdcacfacbc53f0dc2f54e277f634d677b4400d48987e4dd750a686357f8973582c28fb06e21f96cfcdbc355e573ab7b24754ef8cd898b7dba7ad91b4b274b1a0370b12acbceaba166f36b681d1e28efcf0489f353f25a19039cd467ea2b4444813d667d7fa5d72d7b2eaa1f6d6bc63f0793b21a8da2c885e3cbcbf3370bcdfbd5, ecdhPublicKey: 0401245513b22be87a06a15a837a975c0ac81711aa457928c782cfccb9526155809994f7a8aa38d56aff4830fe2f5af27d833b2ed97fee65215852a126876b5ae30bd700c9210824b54e99db4c84f26f803bb517607cc967a11b9911bb1921abfa9510dfe3b29a9ef922a63a1eb23c14748b67768a162205b65985eeade461c1ed4c74d175, signature: 000000077373682d72736100000100970857d783bdf7ea8e4c0039e5882bddb9c0945d4661980af65613fede56ecaab5f5db2c91d32811fb6e6aefc89cef6a83d9afd5911829a6e4aef30d37e73fc8c90da62b84d0f696758c0dbb6dedcd172d7e2eaf020d1a0cf88cced0f77ffe46ece1109d19070f267f4e9d736bd24cf145463df747fd216ef8fb6eb9c8a433751880986be96495338743f6adb2f028fe63855d66193ac60d86b96fa6c9d5aab6257a0f1532a0de58fa192b156c3528aebb4bcb746eaacab10866d57983cba65b2c7379074a5326053396c17be2f7c4e227a5bffef0a07845f9a465ddb1be025a1e9cab36a0733cdde8becc9e8031e3888a07c2055704f1d710e0758718ca346e)
flutter: SSHTransport._consumeClearTextPacket
flutter: SSHTransport._handleMessageNewKeys
flutter: <- _SSHNativeSocket(10.64.20.141:1922): SSH_Message_NewKeys
flutter: SSHTransport._sendNewKeys
flutter: -> _SSHNativeSocket(10.64.20.141:1922): SSH_Message_NewKeys()
flutter: SSHClient._onTransportReady
flutter: SSHClient._requestAuthentication
flutter: -> _SSHNativeSocket(10.64.20.141:1922): SSH_Message_Service_Request{serviceName: ssh-userauth}
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeEncryptedPacket
flutter: <- _SSHNativeSocket(10.64.20.141:1922): SSH_Message_Service_Accept{serviceName: ssh-userauth}
flutter: SSHClient._startAuthentication
flutter: SSHClient._tryNextAuthenticationMethod
flutter: _currentAuthMethod = SSHAuthMethod.publicKey
flutter: SSHClient._authWithPublicKey
flutter: -> _SSHNativeSocket(10.64.20.141:1922): SSH_Message_Userauth_Request(user: root, serviceName: ssh-connection, methodName: publickey)
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeEncryptedPacket
flutter: <- _SSHNativeSocket(10.64.20.141:1922): SSH_Message_Userauth_Failure(methodsLeft: [publickey, keyboard-interactive], partialSuccess: false)
flutter: SSHClient._handleUserauthFailure
flutter: SSHClient._tryNextAuthenticationMethod
flutter: _currentAuthMethod = SSHAuthMethod.none
flutter: SSHClient._authWithNone
flutter: -> _SSHNativeSocket(10.64.20.141:1922): SSH_Message_Userauth_Request(user: root, serviceName: ssh-connection, methodName: none)
flutter: SSHTransport._processPackets
flutter: SSHTransport._consumeEncryptedPacket
flutter: <- _SSHNativeSocket(10.64.20.141:1922): SSH_Message_Userauth_Failure(methodsLeft: [publickey, keyboard-interactive], partialSuccess: false)
flutter: SSHClient._handleUserauthFailure
flutter: SSHClient._tryNextAuthenticationMethod
flutter: SSHTransport.closeWithError SSHAuthFailError(All authentication methods failed)
[ERROR:flutter/runtime/dart_vm_initializer.cc(41)] Unhandled Exception: SSHAuthFailError(All authentication methods failed)
#0      SSHClient._tryNextAuthMethod
#1      SSHClient._handleUserauthFailure
#2      SSHClient._dispatchMessage
#3      SSHClient._handlePacket
#4      SSHTransport._handleMessage
#5      SSHTransport._processPackets
#6      SSHTransport._processData
#7      SSHTransport._onSocketData
#8      _RootZone.runUnaryGuarded (dart:async/zone.dart:1594:10)
#9      _BufferingStreamSubscription._sendData (dart:async/stream_impl.dart:339:11)
#10     _BufferingStreamSubscription._add (dart:async/stream_impl.dart:271:7)
#11     _SyncStreamControllerDispatch._sendData (dart:async/stream_controller.dart:776:19)
#12     _StreamController._add (dart:async/stream_controller.dart:650:7)
#13     _StreamController.add (dart:async/stream_controller.dart:598:5)
#14     _Socket._onData (dart:io-patch/socket_patch.dart:2368:41)
#15     _RootZone.runUnaryGuarded (dart:async/zone.dart:1594:10)
#16     _BufferingStreamSubscription._sendData (dart:async/stream_impl.dart:339:11)
#17     _BufferingStreamSubscription._add (dart:async/stream_impl.dart:271:7)
#18     _SyncStreamControllerDispatch._sendData (dart:async/stream_controller.dart:776:19)
#19     _StreamController._add (dart:async/stream_controller.dart:650:7)
#20     _StreamController.add (dart:async/stream_controller.dart:598:5)
#21     new _RawSocket.<anonymous closure> (dart:io-patch/socket_patch.dart:1886:33)
#22     _NativeSocket.issueReadEvent.issue (dart:io-patch/socket_patch.dart:1343:14)
#23     _microtaskLoop (dart:async/schedule_microtask.dart:40:21)
#24     _startMicrotaskLoop (dart:async/schedule_microtask.dart:49:5)
flutter: SSHClient._onTransportClosed

[falrom]

Is there any way to specify HostKeyAlgorithms like in the SSH command? I tried modifying the values of the algorithms list, but it doesn't seem to work.

[falrom]

It looks like -o PubkeyAcceptedKeyTypes=+ssh-rsa did the trick.

[lrqq]

The same problem as you, "All authentication methods failed" And FileZilla works fine.

I also encountered the same problem. Is there any solution now?

[AlonShahaf]

@falrom were you able to modify this package to connect with your ssh-rsa type?

Update:
In case anyone is interested, rsa authentication was deprecated and replaced with rsa-sha2-256 in this commit.
You can revert to version 2.7.0 before this was merged.

[vicajilau]

Thanks for the detailed reports.

This looks like a legacy interoperability case where some servers only accept ssh-rsa (SHA-1) for public key authentication.

We should not enable ssh-rsa by default for security reasons, but an explicit opt-in compatibility mode would be reasonable.

Proposed direction:

• keep secure defaults (rsa-sha2-256/512)
• add optional ssh-rsa auth signature fallback for legacy servers
• document the security tradeoff clearly

We will keep this issue open as a compatibility enhancement candidate.
If anyone can share a minimal reproducible setup (server/version + accepted pubkey algorithms), that will help validate and test the implementation.