Java/3.0 TurboVNC Viewer (JSch, specifically) does not support the new (non-PEM) OpenSSH private key format

[dcommander]

Symptomatically, this causes an error of the form:

invalid privatekey: [{some_characters}

when attempting to use SSH tunneling or the TurboVNC Session Manager.

Workarounds:

1. When generating a new SSH key, pass -m pem to ssh-keygen.

2. For existing keys, you can convert the private key in place by running

   ssh-keygen -p -f {path_to_private_key_file} -m pem

   (You will be prompted for the existing passphrase, if any, and a new passphrase, which can be empty.)

3. The Java/3.0 TurboVNC Viewer will, by default, attempt to use an SSH private key stored in ~/.ssh/id_dsa or ~/.ssh/id_rsa, if either of those files exists. If that private key isn't relevant to the SSH server to which you are connecting, then you can bypass it in multiple ways:

   • Create an OpenSSH config file entry in ~/.ssh/config that disables SSH public key authentication for a specific host and user name, e.g.:

     Host myuser.myhost.mydomain
         HostName myhost.mydomain
         User myuser
         PubKeyAuthentication no

     You can then point the Java/3.0 TurboVNC Viewer to myuser.myhost.mydomain, which will cause it to authenticate using SSH user name myuser without SSH public key authentication.

   • Create an OpenSSH config file entry in ~/.ssh/config that uses a specific private key for a specific host and user name, e.g.:

     Host myuser.myhost.mydomain
         HostName myhost.mydomain
         User myuser
         IdentityFile ~/.ssh/myuser

     You can then point the Java/3.0 TurboVNC Viewer to myuser.myhost.mydomain, which will cause it to authenticate using SSH user name myuser and SSH private key file ~/.ssh/myuser.

   • Specify an SSH private key using the SSHKey or SSHKeyFile parameters in the TurboVNC Viewer.

4. If you are using the TurboVNC 3.0 Viewer, then you can add the private key to ssh-agent or Pageant. This has the added benefit of storing the SSH private key passphrase, if any, so you don't have to enter it each time you connect.