az ssh arc connection issue using Service Principal

Describe the bug

When logged in as a Service Principal, the "az ssh arc" command only functions when .azure/msal_token_cache.json is either empty or absent. The issue can be resolved by either deleting the .azure/msal_token_cache.json file, or specifically removing the entry "-login.microsoftonline.com-accesstoken-redacted-redacted-https://pas.windows.net/checkmyaccess/linux/.default" from within the .azure/msal_token_cache.json file

Related command

$ az login --service-principal -u redacted -p redacted --tenant redacted

$ az ssh arc --resource-group MYRESOURCEGROUP --name my-linux-server-rocky8

Errors

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Permissions 0644 for '/tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub' are too open.

Issue script & Debug output

cli.knack.cli: Command arguments: ['ssh', 'arc', '--resource-group', 'MYRESOURCEGROUP', '--name', 'my-linux-server-rocky8', '--debug'] cli.knack.cli: init debug log: Enable color in terminal. cli.knack.cli: Event: Cli.PreExecute [] cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f9d777d0040>, <function OutputProducer.on_global_arguments at 0x7f9d7777e160>, <function CLIQuery.on_global_arguments at 0x7f9d777b7c40>] cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate [] cli.azure.cli.core: Modules found from index for 'ssh': ['azext_ssh'] cli.azure.cli.core: Loading command modules: cli.azure.cli.core: Name Load Time Groups Commands cli.azure.cli.core: Total (0) 0.000 0 0 cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next'] cli.azure.cli.core: Loading extensions: cli.azure.cli.core: Name Load Time Groups Commands Directory cli.azure.cli.core: ssh 0.067 1 4 /home/service-principal/.azure/cliextensions/ssh cli.azure.cli.core: Total (1) 0.067 1 4 cli.azure.cli.core: Loaded 1 groups, 4 commands. cli.azure.cli.core: Found a match in the command table. cli.azure.cli.core: Raw command : ssh arc cli.azure.cli.core: Command table: ssh arc cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f9d76a79c60>] cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/service-principal/.azure/commands/2024-04-25.11-34-46.ssh_arc.3588.log'. az_command_data_logger: command args: ssh arc --resource-group {} --name {} --debug cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7f9d76891f80>] cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad [] cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7f9d76892020>, <function register_cache_arguments..add_cache_arguments at 0x7f9d76892160>] cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded [] cli.knack.cli: Event: CommandInvoker.OnPreParseArgs [] cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f9d7777e200>, <function CLIQuery.handle_query_parameter at 0x7f9d777b7ce0>, <function register_ids_argument..parse_ids_arguments at 0x7f9d768920c0>] az_command_data_logger: extension name: ssh az_command_data_logger: extension version: 2.0.3 cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient cli.azure.cli.core.auth.persistence: build_persistence: location='/home/service-principal/.azure/service_principal_entries.json', encrypt=False cli.azure.cli.core.auth.persistence: build_persistence: location='/home/service-principal/.azure/msal_token_cache.json', encrypt=False cli.azure.cli.core.auth.binary_cache: load: /home/service-principal/.azure/msal_http_cache.bin urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None) msal.authority: openid_config = {'token_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com//discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com//v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com//kerberos', 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'} msal.application: Broker enabled? None cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} cli.azure.cli.core.auth.msal_authentication: ServicePrincipalCredential.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} msal.telemetry: Generate or reuse correlation_id: 86935138-1bd8-4c92-98ce-9c277b116bfa urllib3.connectionpool: Starting new HTTPS connection (1): login.microsoftonline.com:443 urllib3.connectionpool: https://login.microsoftonline.com:443 "POST //oauth2/v2.0/token HTTP/1.1" 200 1473 msal.token_cache: event={ "client_id": "586ecbe2-8c2b-4370-83e7-", "data": { "claims": "{\"access_token\": {\"xms_cc\": {\"values\": [\"CP1\"]}}}", "scope": [ "https://management.core.windows.net//.default" ] }, "environment": "login.microsoftonline.com", "grant_type": "client_credentials", "params": null, "response": { "access_token": "****", "expires_in": 3599, "ext_expires_in": 3599, "token_type": "Bearer" }, "scope": [ "https://management.core.windows.net//.default" ], "token_endpoint": "https://login.microsoftonline.com//oauth2/v2.0/token" } cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions//resourceGroups/MYRESOURCEGROUP/resources?$filter=name%20eq%20%27my-linux-server-rocky8%27&api-version=2022-09-01' cli.azure.cli.core.sdk.policies: Request method: 'GET' cli.azure.cli.core.sdk.policies: Request headers: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json' cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '' cli.azure.cli.core.sdk.policies: 'CommandName': 'ssh arc' cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--resource-group --name --debug' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.59.0 (DEB) azsdk-python-core/1.28.0 Python/3.11.8 (Linux-5.15.146.1-microsoft-standard-WSL2-x86_64-with-glibc2.31)' cli.azure.cli.core.sdk.policies: 'Authorization': '' cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: This request has no body urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443 urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions//resourceGroups/MYRESOURCEGROUP/resources?$filter=name%20eq%20%27my-linux-server-rocky8%27&api-version=2022-09-01 HTTP/1.1" 200 433 cli.azure.cli.core.sdk.policies: Response status: 200 cli.azure.cli.core.sdk.policies: Response headers: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache' cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache' cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8' cli.azure.cli.core.sdk.policies: 'Expires': '-1' cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '11998' cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'caa30191-66f6-4fc5-bf3e-b917189b8cf7' cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'caa30191-66f6-4fc5-bf3e-b917189b8cf7' cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'FRANCESOUTH:20240425T093446Z:caa30191-66f6-4fc5-bf3e-b917189b8cf7' cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains' cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff' cli.azure.cli.core.sdk.policies: 'Date': 'Thu, 25 Apr 2024 09:34:45 GMT' cli.azure.cli.core.sdk.policies: 'Content-Length': '433' cli.azure.cli.core.sdk.policies: Response content: cli.azure.cli.core.sdk.policies: {"value":[{"id":"/subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8","name":"my-linux-server-rocky8","type":"Microsoft.HybridCompute/machines","location":"francecentral","identity":{"principalId":"","tenantId":"","type":"SystemAssigned"},"tags":{}}]} cli.azext_ssh.resource_type_utils: Target Resource Type: Microsoft.HybridCompute/machines urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None) msal.authority: openid_config = {'token_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com//discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com//v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com//kerberos', 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'} msal.application: Broker enabled? None cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} cli.azure.cli.core.auth.msal_authentication: ServicePrincipalCredential.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} msal.application: Cache hit an AT msal.telemetry: Generate or reuse correlation_id: 3accb4bc-c521-496e-be3c-f9a28b13d01b cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8?api-version=2022-11-10' cli.azure.cli.core.sdk.policies: Request method: 'GET' cli.azure.cli.core.sdk.policies: Request headers: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json' cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '' cli.azure.cli.core.sdk.policies: 'CommandName': 'ssh arc' cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--resource-group --name --debug' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.59.0 (DEB) azsdk-python-core/1.28.0 Python/3.11.8 (Linux-5.15.146.1-microsoft-standard-WSL2-x86_64-with-glibc2.31)' cli.azure.cli.core.sdk.policies: 'Authorization': '' cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: This request has no body urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443 urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8?api-version=2022-11-10 HTTP/1.1" 200 2994 cli.azure.cli.core.sdk.policies: Response status: 200 cli.azure.cli.core.sdk.policies: Response headers: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache' cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache' cli.azure.cli.core.sdk.policies: 'Content-Length': '2994' cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8' cli.azure.cli.core.sdk.policies: 'Expires': '-1' cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '11999' cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains' cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'd4fbcb37-772b-4d29-942d-99657f7dd9a6' cli.azure.cli.core.sdk.policies: 'Server': 'Kestrel' cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'd79770b5-8f9d-4dcb-84ba-5738e4d7e888' cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'FRANCESOUTH:20240425T093447Z:d79770b5-8f9d-4dcb-84ba-5738e4d7e888' cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff' cli.azure.cli.core.sdk.policies: 'Date': 'Thu, 25 Apr 2024 09:34:46 GMT' cli.azure.cli.core.sdk.policies: Response content: cli.azure.cli.core.sdk.policies: {"id":"/subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8","name":"my-linux-server-rocky8","location":"francecentral","tags":{},"identity":{"type":"SystemAssigned","principalId":"","tenantId":""},"type":"Microsoft.HybridCompute/machines","properties":{"provisioningState":"Succeeded","agentVersion":"1.39.02628.1431","status":"Connected","lastStatusChange":"2024-04-25T09:28:19.0852132Z","errorDetails":[],"displayName":"my-linux-server-rocky8","machineFqdn":"my-linux-server-rocky8","osName":"linux","osVersion":"4.18.0-477.27.1.el8_8.x86_64","osType":"linux","osProfile":{"computerName":"my-linux-server-rocky8"},"vmId":"9f12c7e7-5e53-46c3-87b8-42701e713e29","vmUuid":"624fbf78-b321-4357-b178-6920e6c91d21","clientPublicKey":"MIIBCgKCAQEAtleHU/g5TSMxg5GQ4ydtXHVpDPMkwjVXH45PS4apWcT8eDPHtY1tnGwaiGM1IbuIVK4Bv44IKKAeRRhHcbWVGhifjYXq4OEyCPuL3p8aFX8yNJYuR2Uq384kUKQJQV5OuvhKGPzCWgjdmDujeO9boe1XzAETs1zhEQYSTdmLZLvMTanVM9wsSadLzSPTzRv3qIG34/SaaxGX+jAV8GeWtv0mw640MJibRV8iKkfrQsO7+nyo/KFlHJtn+Ah7XMgfzeasnv5AN8CofgQrYc0tAuRXC6Hb/kxiAY68iKAYmKuZNtLV0i93WAY39T6UEV+L5w1pedPk+eoW2Z1HqHNDxQIDAQAB","osSku":"Rocky Linux 8.8 (Green Obsidian)","domainName":"unknown","adFqdn":"unknown","dnsFqdn":"my-linux-server-rocky8.emea-west-pdc-z01.uc.internal","mssqlDiscovered":"false","cloudMetadata":{"provider":"N/A"},"detectedProperties":{"cloudprovider":"N/A","coreCount":"1","logicalCoreCount":"1","manufacturer":"OpenStack Foundation","model":"OpenStack Nova","mssqldiscovered":"false","processorCount":"1","processorNames":"Intel(R) Xeon(R) Gold 6252N CPU @ 2.30GHz","productType":"unknown","serialNumber":"unknown","totalPhysicalMemoryInBytes":"3848085504","totalPhysicalMemoryInGigabytes":"3"},"agentConfiguration":{"proxyUrl":"","incomingConnectionsPorts":[],"extensionsAllowList":[],"extensionsBlockList":[],"proxyBypass":[],"extensionsEnabled":"true","guestConfigurationEnabled":"true","configMode":"full"},"serviceStatuses":{"extensionService":{"status":"active","startupType":"enabled"},"guestConfigurationService":{"status":"active","startupType":"enabled"}}},"resources":[{"id":"/subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8/extensions/AADSSHLogin","name":"AADSSHLogin","type":"Microsoft.HybridCompute/machines/extensions","location":"francecentral","properties":{"publisher":"Microsoft.Azure.ActiveDirectory","type":"AADSSHLoginForLinux","typeHandlerVersion":"1.0.2644.1","autoUpgradeMinorVersion":false,"enableAutomaticUpgrade":true,"settings":{},"provisioningState":"Succeeded","instanceView":{"name":"AADSSHLogin","type":"AADSSHLoginForLinux","typeHandlerVersion":"1.0.2644.1","status":{"code":"0","level":"Information","message":"Extension Message: Done"}}}}]} cli.azext_ssh.target_os_utils: Target OS Type: linux cli.azext_ssh.ssh_utils: Running ssh-keygen command ssh-keygen -f /tmp/aadsshcert40pdyv7c/id_rsa -t rsa -q -N urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None) msal.authority: openid_config = {'token_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com//discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com//v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com//kerberos', 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'} msal.application: Broker enabled? None cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://pas.windows.net/CheckMyAccess/Linux/.default',), kwargs={'data': {'token_type': 'ssh-cert', 'req_cnf': '{"kty": "RSA", "n": "", "e": "AQAB", "kid": "1a4135d15efc56baef04a7105a280394404131354d3a9e0b5a3be9c746784cc8"}', 'key_id': '1a4135d15efc56baef04a7105a280394404131354d3a9e0b5a3be9c746784cc8'}} cli.azure.cli.core.auth.msal_authentication: ServicePrincipalCredential.get_token: scopes=('https://pas.windows.net/CheckMyAccess/Linux/.default',), kwargs={'data': {'token_type': 'ssh-cert', 'req_cnf': '{"kty": "RSA", "n": "", "e": "AQAB", "kid": "1a4135d15efc56baef04a7105a280394404131354d3a9e0b5a3be9c746784cc8"}', 'key_id': '1a4135d15efc56baef04a7105a280394404131354d3a9e0b5a3be9c746784cc8'}} msal.application: Cache hit an AT msal.telemetry: Generate or reuse correlation_id: 93b43d2b-9af3-4991-97b1-3299774a4663 cli.azext_ssh.custom: Generating certificate /tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub cli.azext_ssh.ssh_utils: Running ssh-keygen command ssh-keygen -L -f /tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub cli.azext_ssh.ssh_utils: Running ssh-keygen command ssh-keygen -L -f /tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub cli.azext_ssh.connectivity_utils: Platform OS: Linux cli.azext_ssh.connectivity_utils: Platform architecture: x86_64 urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None) msal.authority: openid_config = {'token_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com//discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com//v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com//kerberos', 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'} msal.application: Broker enabled? None cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} cli.azure.cli.core.auth.msal_authentication: ServicePrincipalCredential.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} msal.application: Cache hit an AT msal.telemetry: Generate or reuse correlation_id: 2a7d29f1-e27d-4d9d-8dcd-dda157e80cda cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8/providers/Microsoft.HybridConnectivity/endpoints/default/listCredentials?expiresin=3600&api-version=2023-03-15' cli.azure.cli.core.sdk.policies: Request method: 'POST' cli.azure.cli.core.sdk.policies: Request headers: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json' cli.azure.cli.core.sdk.policies: 'Accept': 'application/json' cli.azure.cli.core.sdk.policies: 'Content-Length': '22' cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '' cli.azure.cli.core.sdk.policies: 'CommandName': 'ssh arc' cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--resource-group --name --debug' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.59.0 (DEB) azsdk-python-core/1.28.0 Python/3.11.8 (Linux-5.15.146.1-microsoft-standard-WSL2-x86_64-with-glibc2.31)' cli.azure.cli.core.sdk.policies: 'Authorization': '' cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: {"serviceName": "SSH"} urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443 urllib3.connectionpool: https://management.azure.com:443 "POST /subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8/providers/Microsoft.HybridConnectivity/endpoints/default/listCredentials?expiresin=3600&api-version=2023-03-15 HTTP/1.1" 200 3583 cli.azure.cli.core.sdk.policies: Response status: 200 cli.azure.cli.core.sdk.policies: Response headers: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache' cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache' cli.azure.cli.core.sdk.policies: 'Content-Length': '3583' cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8' cli.azure.cli.core.sdk.policies: 'Expires': '-1' cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-writes': '1199' cli.azure.cli.core.sdk.policies: 'x-ms-providerhub-traffic': 'True' cli.azure.cli.core.sdk.policies: 'mise-correlation-id': '160dacee-08ea-4c6e-8bc4-85403e3e7a51' cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains' cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '7d1c05b0-a96d-4297-b55c-a236a9b5aa3a' cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'a8a34e91-e77d-4e0e-b8c2-d0fcfd447845' cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'FRANCESOUTH:20240425T093502Z:a8a34e91-e77d-4e0e-b8c2-d0fcfd447845' cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff' cli.azure.cli.core.sdk.policies: 'Date': 'Thu, 25 Apr 2024 09:35:02 GMT' cli.azure.cli.core.sdk.policies: Response content: cli.azure.cli.core.sdk.policies: {"relay":{"namespaceName":"azgn-francecentral-public-1p-fcpar20-003","namespaceNameSuffix":"servicebus.windows.net","hybridConnectionName":"microsoft.hybridcompute/machines/6af86a579a88611e322649ed2d161c335772ee093e9af9fdaeee907ceb509d6c/1714037702628715008/v2","accessKey":"SharedAccessSignature sr=http%3A%2F%2Fazgn-francecentral-public-1p-fcpar20-003.servicebus.windows.net%2Fmicrosoft.hybridcompute%2Fmachines%2F6af86a579a88611e322649ed2d161c335772ee093e9af9fdaeee907ceb509d6c%2F1714037702628715008%2Fv2%2F&sig=iVTYf6s2f2KB%2FF5uZAHPU%2BOx%2BynUIr1ToQBJbFcvFKI%3D&se=1714041902&skn=sender20240423","expiresOn":1714041302,"serviceConfigurationToken":""}} urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None) msal.authority: openid_config = {'token_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com//discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com//v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com//oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com//kerberos', 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'} msal.application: Broker enabled? None cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} cli.azure.cli.core.auth.msal_authentication: ServicePrincipalCredential.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} msal.application: Cache hit an AT msal.telemetry: Generate or reuse correlation_id: 27037091-cea0-42a2-961f-aef31a71f5fa cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8/providers/Microsoft.HybridConnectivity/endpoints/default/serviceConfigurations/SSH?api-version=2023-03-15' cli.azure.cli.core.sdk.policies: Request method: 'GET' cli.azure.cli.core.sdk.policies: Request headers: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json' cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '' cli.azure.cli.core.sdk.policies: 'CommandName': 'ssh arc' cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--resource-group --name --debug' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.59.0 (DEB) azsdk-python-core/1.28.0 Python/3.11.8 (Linux-5.15.146.1-microsoft-standard-WSL2-x86_64-with-glibc2.31)' cli.azure.cli.core.sdk.policies: 'Authorization': '' cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: This request has no body urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443 urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8/providers/Microsoft.HybridConnectivity/endpoints/default/serviceConfigurations/SSH?api-version=2023-03-15 HTTP/1.1" 200 680 cli.azure.cli.core.sdk.policies: Response status: 200 cli.azure.cli.core.sdk.policies: Response headers: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache' cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache' cli.azure.cli.core.sdk.policies: 'Content-Length': '680' cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8' cli.azure.cli.core.sdk.policies: 'Expires': '-1' cli.azure.cli.core.sdk.policies: 'ETag': '"95004b39-0000-0e00-0000-661564b40000"' cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '11999' cli.azure.cli.core.sdk.policies: 'x-ms-providerhub-traffic': 'True' cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'aa00661a-ffd0-49aa-918a-8e8012295a84' cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'b7c2c8de-a7f1-4ffe-8c9e-16c048fce6fb' cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'FRANCESOUTH:20240425T093503Z:b7c2c8de-a7f1-4ffe-8c9e-16c048fce6fb' cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains' cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff' cli.azure.cli.core.sdk.policies: 'Date': 'Thu, 25 Apr 2024 09:35:02 GMT' cli.azure.cli.core.sdk.policies: Response content: cli.azure.cli.core.sdk.policies: {"id":"/subscriptions//resourceGroups/MYRESOURCEGROUP/providers/Microsoft.HybridCompute/machines/my-linux-server-rocky8/providers/Microsoft.HybridConnectivity/endpoints/default/serviceconfigurations/SSH","name":"SSH","type":"microsoft.hybridconnectivity/endpoints/serviceconfigurations","systemData":{"createdBy":"586ecbe2-8c2b-4370-83e7-","createdByType":"Application","createdAt":"2024-04-08T14:01:53.0453591Z","lastModifiedBy":"586ecbe2-8c2b-4370-83e7-","lastModifiedByType":"Application","lastModifiedAt":"2024-04-09T15:54:27.4660206Z"},"properties":{"serviceName":"SSH","port":22,"provisioningState":"Succeeded"}} cli.azext_ssh.ssh_utils: Running ssh command ssh my-linux-server-rocky8 -l 586ecbe2-8c2b-4370-83e7- -o ProxyCommand="/home/service-principal/.clientsshproxy/sshProxy_linux_amd64_1_3_026031" -i /tmp/aadsshcert40pdyv7c/id_rsa -o CertificateFile="/tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub" -vvv OpenSSH_8.2p1 Ubuntu-4ubuntu0.11, OpenSSL 1.1.1f 31 Mar 2020 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/.conf matched no files debug1: /etc/ssh/ssh_config line 21: Applying options for debug1: Executing proxy command: exec "/home/service-principal/.clientsshproxy/sshProxy_linux_amd64_1_3_026031" debug1: identity file /tmp/aadsshcert40pdyv7c/id_rsa type 0 debug1: certificate file /tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub type 4 debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.11 debug1: Remote protocol version 2.0, remote software version OpenSSH_8.0 debug1: match: OpenSSH_8.0 pat OpenSSH* compat 0x04000000 debug2: fd 5 setting O_NONBLOCK debug2: fd 4 setting O_NONBLOCK debug1: Authenticating to my-linux-server-rocky8:22 as '586ecbe2-8c2b-4370-83e7-' debug3: hostkeys_foreach: reading file "/home/service-principal/.ssh/known_hosts" debug3: record_hostkey: found key type ECDSA in file /home/service-principal/.ssh/known_hosts:1 debug3: load_hostkeys: loaded 1 keys from my-linux-server-rocky8 debug3: order_hostkeyalgs: have matching best-preference key type ecdsa-sha2-nistp256-cert-v01@openssh.com, using HostkeyAlgorithms verbatim debug3: send packet: type 20 debug1: SSH2_MSG_KEXINIT sent debug3: receive packet: type 20 debug1: SSH2_MSG_KEXINIT received debug2: local client KEXINIT proposal debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: compression ctos: none,zlib@openssh.com,zlib debug2: compression stoc: none,zlib@openssh.com,zlib debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug2: peer server KEXINIT proposal debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,kex-strict-s-v00@openssh.com debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 debug2: ciphers ctos: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc debug2: ciphers stoc: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 debug2: compression ctos: none,zlib@openssh.com debug2: compression stoc: none,zlib@openssh.com debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug3: will use strict KEX ordering debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: compression: none debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: compression: none debug3: send packet: type 30 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug3: receive packet: type 31 debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5rV76Y/SwZqXW/m/1aZ3N28nET3aV3BRd7ljD7rkHMQ debug3: hostkeys_foreach: reading file "/home/service-principal/.ssh/known_hosts" debug3: record_hostkey: found key type ECDSA in file /home/service-principal/.ssh/known_hosts:1 debug3: load_hostkeys: loaded 1 keys from my-linux-server-rocky8 debug1: Host 'my-linux-server-rocky8' is known and matches the ECDSA host key. debug1: Found key in /home/service-principal/.ssh/known_hosts:1 debug3: send packet: type 21 debug1: resetting send seqnr 3 debug2: set_newkeys: mode 1 debug1: rekey out after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: receive packet: type 21 debug1: resetting read seqnr 3 debug1: SSH2_MSG_NEWKEYS received debug2: set_newkeys: mode 0 debug1: rekey in after 134217728 blocks debug1: Will attempt key: /tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub RSA-CERT SHA256:+mDqglCYejp0BhsStvj3Q5J+6oSO+9Z7+tFt2sTek3c explicit debug1: Will attempt key: /tmp/aadsshcert40pdyv7c/id_rsa RSA SHA256:gp4o/8A+O7IB9V89mh6mwltOsK0lJsfud7SdZ53oysI explicit debug2: pubkey_prepare: done debug3: send packet: type 5 debug3: receive packet: type 7 debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521> debug3: receive packet: type 6 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug3: send packet: type 50 debug3: receive packet: type 53 debug3: input_userauth_banner This is a private computing system network for professional use only.

Private IP:

debug3: receive packet: type 51 debug1: Authentications that can continue: publickey debug3: start over, passed a different list publickey debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering public key: /tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub RSA-CERT SHA256:+mDqglCYejp0BhsStvj3Q5J+6oSO+9Z7+tFt2sTek3c explicit debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 60 debug1: Server accepts key: /tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub RSA-CERT SHA256:+mDqglCYejp0BhsStvj3Q5J+6oSO+9Z7+tFt2sTek3c explicit debug3: sign_and_send_pubkey: RSA-CERT SHA256:+mDqglCYejp0BhsStvj3Q5J+6oSO+9Z7+tFt2sTek3c debug1: sign_and_send_pubkey: no separate private key for certificate "/tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub" debug3: sign_and_send_pubkey: signing using rsa-sha2-512-cert-v01@openssh.com SHA256:+mDqglCYejp0BhsStvj3Q5J+6oSO+9Z7+tFt2sTek3c @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Permissions 0644 for '/tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub' are too open.

It is required that your private key files are NOT accessible by others. This private key will be ignored. Load key "/tmp/aadsshcert40pdyv7c/id_rsa.pub-aadcert.pub": bad permissions debug1: Offering public key: /tmp/aadsshcert40pdyv7c/id_rsa RSA SHA256:gp4o/8A+O7IB9V89mh6mwltOsK0lJsfud7SdZ53oysI explicit debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey debug2: we did not send a packet, disable method debug1: No more authentication methods to try. 586ecbe2-8c2b-4370-83e7-@my-linux-server-rocky8: Permission denied (publickey).

Expected behavior

az ssh arc is supposed to work without issue if the .azure/msal_token_cache.json file exists.

Environment Summary

azure-cli 2.61.0 core 2.61.0 telemetry 1.1.0 Extensions: ssh 2.0.3 Dependencies: msal 1.28.0 azure-mgmt-resource 23.1.1 Python location '/opt/az/bin/python3' Extensions directory '/home/sp-azure-arc-linux-pilot/.azure/cliextensions' Python (Linux) 3.11.8 (main, May 16 2024, 03:47:41) [GCC 9.4.0] Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

Azure / azure-cli