Password Auth Works but Key Based Fails (One Way Trust Relationship)

[sarobanares]

"OpenSSH for Windows" version OpenSSH_for_Windows_8.6p1, LibreSSL 3.3.3

Server OperatingSystem Windows Server 2019

Client OperatingSystem Windows Server 2019

What is failing

• Both server and client are in our AD environment (mycompany.com.azure) in Azure
• This Azure AD has one-way trust to our on-prem AD (Trusted domain)
• Using Windows IDs from the on-prem AD via password authentication is working but not key-based
• Key based auth only works if the Windows ID is in the Azure AD or local account in the server.

Expected output

• Key based authentication works since password authentication is working

Actual output 4252 2021-11-24 13:18:30.804 debug1: trying public key file C:\Users\d_nlds_sql\.ssh/authorized_keys 4252 2021-11-24 13:18:30.804 debug1: C:\Users\d_nlds_sql\.ssh/authorized_keys:1: matching key found: RSA SHA256:b1v/YYPlDjtPaETE0HlLDc4mDkXZMgv/jDe19wbSNMk 4252 2021-11-24 13:18:30.804 debug1: C:\Users\d_nlds_sql\.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding 4252 2021-11-24 13:18:30.804 Accepted key RSA SHA256:b1v/YYPlDjtPaETE0HlLDc4mDkXZMgv/jDe19wbSNMk found at C:\Users\d_nlds_sql\.ssh/authorized_keys:1 4252 2021-11-24 13:18:30.804 debug3: mm_answer_keyallowed: publickey authentication: RSA key is allowed 4252 2021-11-24 13:18:30.804 debug3: mm_request_send: entering, type 23 4252 2021-11-24 13:18:30.804 debug3: mm_sshkey_verify: entering [preauth] 4252 2021-11-24 13:18:30.804 debug3: mm_request_send: entering, type 24 [preauth] 4252 2021-11-24 13:18:30.804 debug3: mm_sshkey_verify: waiting for MONITOR_ANS_KEYVERIFY [preauth] 4252 2021-11-24 13:18:30.804 debug3: mm_request_receive_expect: entering, type 25 [preauth] 4252 2021-11-24 13:18:30.804 debug3: mm_request_receive: entering [preauth] 4252 2021-11-24 13:18:30.804 debug3: mm_request_receive: entering 4252 2021-11-24 13:18:30.804 debug3: monitor_read: checking request 24 4252 2021-11-24 13:18:30.804 debug3: mm_answer_keyverify: publickey 0000029015C93110 signature verified 4252 2021-11-24 13:18:30.804 debug1: auth_activate_options: setting new authentication options 4252 2021-11-24 13:18:30.804 debug3: mm_request_send: entering, type 25 4252 2021-11-24 13:18:30.804 Accepted publickey for d_nlds_sql from 10.61.131.11 port 51067 ssh2: RSA SHA256:b1v/YYPlDjtPaETE0HlLDc4mDkXZMgv/jDe19wbSNMk 4252 2021-11-24 13:18:30.804 debug1: monitor_child_preauth: user d_nlds_sql authenticated by privileged process 4252 2021-11-24 13:18:30.804 debug3: mm_get_keystate: Waiting for new keys 4252 2021-11-24 13:18:30.804 debug3: mm_request_receive_expect: entering, type 26 4252 2021-11-24 13:18:30.804 debug3: mm_request_receive: entering 4252 2021-11-24 13:18:30.819 debug3: mm_get_keystate: GOT new keys 4252 2021-11-24 13:18:30.819 debug1: auth_activate_options: setting new authentication options [preauth] 4252 2021-11-24 13:18:30.819 debug2: userauth_pubkey: authenticated 1 pkalg rsa-sha2-512 [preauth] 4252 2021-11-24 13:18:30.819 debug3: user_specific_delay: user specific delay 0.000ms [preauth] 4252 2021-11-24 13:18:30.819 debug3: ensure_minimum_time_since: elapsed 0.000ms, delaying 8.696ms (requested 8.696ms) [preauth] 4252 2021-11-24 13:18:30.819 debug3: send packet: type 52 [preauth] 4252 2021-11-24 13:18:30.819 debug3: mm_request_send: entering, type 26 [preauth] 4252 2021-11-24 13:18:30.819 debug3: mm_send_keystate: Finished sending state [preauth] 4252 2021-11-24 13:18:30.819 debug1: monitor_read_log: child log fd closed 4252 2021-11-24 13:18:31.069 error: lookup_principal_name: User principal name lookup failed for user 'ho\d_nlds_sql' (explicit: 5, implicit: 5) 4252 2021-11-24 13:18:31.069 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ho\d_nlds_sql' Status: 0xC0000062 SubStatus 0. 4252 2021-11-24 13:18:31.069 debug3: get_user_token - unable to generate token for user ho\d_nlds_sql 4252 2021-11-24 13:18:31.247 error: lookup_principal_name: User principal name lookup failed for user 'ho\d_nlds_sql' (explicit: 5, implicit: 5) 4252 2021-11-24 13:18:31.262 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ho\d_nlds_sql' Status: 0xC0000062 SubStatus 0. 4252 2021-11-24 13:18:31.262 error: get_user_token - unable to generate token on 2nd attempt for user ho\d_nlds_sql 4252 2021-11-24 13:18:31.262 error: unable to get security token for user ho\d_nlds_sql 4252 2021-11-24 13:18:31.262 fatal: fork of unprivileged child failed

[NoMoreFood]

Can you post a similar output for password-based logon for comparison?

[bagajjal]

Please check if it's related to https://github.com/PowerShell/Win32-OpenSSH/issues/1787