Forum » Support and Bug Reports »

Post a reply

Before posting, please read how to report bug or request support effectively.

Bug reports without an attached log file are usually useless.

Username

Subject

Message body

Font colour:

Font size:

[quote="Sav123"]Hello,

I have been following this guide you have produced and have hit a dead end when exchanging keys.([url]https://winscp.net/eng/docs/guide_windows_openssh_server#configuring_ssh_server[/url]).

I am attempting to set this up on a Windows 2016 server on our domain and I can successfully connect via password authentication from my PC so SFTP is running. But I am having no luck regarding the key authentication with my server refusing the key no matter what I try. I have gone through this process a few times now and also searched the internet but no solution to my issue was found after trying a few I found here. I have created the latest run with no encryption to see if we get anymore info and have the most simplest setup to reduce complexity. I can see the .ssh folder on the server in the correct location with my public key too. I have included the winscp logs below showing the process, it appears to me that it see and match the keys and then refuses them, is this correct? Is there anything I can do on the server to make this accept the keys?
[code]@sessionlog@
. 2021-10-12 13:30:44.767 --------------------------------------------------------------------------
. 2021-10-12 13:30:44.768 WinSCP Version 5.19.3 (Build 11749) (OS 10.0.18362 - Windows 10 Enterprise)
. 2021-10-12 13:30:44.768 Configuration: HKCU\Software\Martin Prikryl\WinSCP 2\
. 2021-10-12 13:30:44.768 Log level: Normal, Logging passwords
. 2021-10-12 13:30:44.768 Local account: NT****\Chris
. 2021-10-12 13:30:44.768 Working directory: C:\Program Files (x86)\WinSCP
. 2021-10-12 13:30:44.768 Process ID: 2760
. 2021-10-12 13:30:44.775 Ancestor processes: explorer, ...
. 2021-10-12 13:30:44.775 Command-line: "C:\Program Files (x86)\WinSCP\WinSCP.exe" 
. 2021-10-12 13:30:44.775 Time zone: Current: GMT+1, Standard: GMT+0 (GMT Standard Time), DST: GMT+1 (GMT Summer Time), DST Start: 28/03/2021, DST End: 31/10/2021
. 2021-10-12 13:30:44.776 Login time: 12 October 2021 13:30:44
. 2021-10-12 13:30:44.776 --------------------------------------------------------------------------
. 2021-10-12 13:30:44.776 Session name: NT****\Chris@w**os3.*****.co.uk (Modified site)
. 2021-10-12 13:30:44.776 Host name: **********.co.uk (Port: 22)
. 2021-10-12 13:30:44.776 User name: Chris (Password: No, Key file: C:\Users\chris\Desktop\keys\priv.ppk, Passphrase: No)
. 2021-10-12 13:30:44.776 Tunnel: No
. 2021-10-12 13:30:44.776 Transfer Protocol: SFTP
. 2021-10-12 13:30:44.776 Ping type: Off, Ping interval: 30 sec; Timeout: 15 sec
. 2021-10-12 13:30:44.776 Disable Nagle: No
. 2021-10-12 13:30:44.776 Proxy: None
. 2021-10-12 13:30:44.776 Send buffer: 262144
. 2021-10-12 13:30:44.776 SSH protocol version: 2; Compression: No
. 2021-10-12 13:30:44.776 Bypass authentication: No
. 2021-10-12 13:30:44.776 Try agent: Yes; Agent forwarding: Yes; TIS/CryptoCard: No; KI: Yes; GSSAPI: Yes
. 2021-10-12 13:30:44.776 GSSAPI: KEX: No; Forwarding: No; Libs: gssapi32,sspi,custom; Custom: 
. 2021-10-12 13:30:44.776 Ciphers: aes,chacha20,blowfish,3des,WARN,arcfour,des; Ssh2DES: No
. 2021-10-12 13:30:44.776 KEX: ecdh,dh-gex-sha1,dh-group14-sha1,rsa,WARN,dh-group1-sha1
. 2021-10-12 13:30:44.776 SSH Bugs: Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto
. 2021-10-12 13:30:44.776 Simple channel: Yes
. 2021-10-12 13:30:44.776 Return code variable: Autodetect; Lookup user groups: Auto
. 2021-10-12 13:30:44.776 Shell: default
. 2021-10-12 13:30:44.776 EOL: LF, UTF: Auto
. 2021-10-12 13:30:44.777 Clear aliases: Yes, Unset nat.vars: Yes, Resolve symlinks: Yes; Follow directory symlinks: No
. 2021-10-12 13:30:44.777 LS: ls -la, Ign LS warn: Yes, Scp1 Comp: No; Exit code 1 is error: No
. 2021-10-12 13:30:44.777 SFTP Bugs: Auto,Auto
. 2021-10-12 13:30:44.777 SFTP Server: default
. 2021-10-12 13:30:44.777 Local directory: C:\Users\chris, Remote directory: /C:/Users/Chris, Update: Yes, Cache: Yes
. 2021-10-12 13:30:44.777 Cache directory changes: Yes, Permanent: Yes
. 2021-10-12 13:30:44.777 Recycle bin: Delete to: No, Overwritten to: No, Bin path: 
. 2021-10-12 13:30:44.777 DST mode: Win
. 2021-10-12 13:30:44.777 --------------------------------------------------------------------------
. 2021-10-12 13:30:44.818 Looking up host "w****.*****.co.uk" for SSH connection
. 2021-10-12 13:30:44.827 Connecting to 172.20.107.18 port 22
. 2021-10-12 13:30:44.841 We claim version: SSH-2.0-WinSCP_release_5.19.3
. 2021-10-12 13:30:44.879 Remote version: SSH-2.0-OpenSSH_for_Windows_8.6
. 2021-10-12 13:30:44.879 Using SSH protocol version 2
. 2021-10-12 13:30:44.880 Have a known host key of type ssh-ed25519
. 2021-10-12 13:30:45.028 Doing ECDH key exchange with curve Curve25519 and hash SHA-256
. 2021-10-12 13:30:45.096 Server also has ecdsa-sha2-nistp256/ssh-rsa host keys, but we don't know any of them
. 2021-10-12 13:30:45.096 Host key fingerprint is:
. 2021-10-12 13:30:45.096 ssh-ed25519 255 c9:91:6b:f8:96:63:74:a7:63:69:50:c9:6a:df:12:ed Qo9Lnm6hJHM7F9CfEkpbNvN9nLaXl+k/yRCuh8pBZIA=
. 2021-10-12 13:30:45.146 Host key does not match cached key
. 2021-10-12 13:30:45.146 Host key matches cached key
. 2021-10-12 13:30:45.147 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] outbound encryption
. 2021-10-12 13:30:45.147 Initialised HMAC-SHA-256 outbound MAC algorithm
. 2021-10-12 13:30:45.147 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] inbound encryption
. 2021-10-12 13:30:45.147 Initialised HMAC-SHA-256 inbound MAC algorithm
. 2021-10-12 13:30:45.148 Reading key file "C:\Users\chris\Desktop\keys\priv.ppk"
! 2021-10-12 13:30:45.149 Using username "Chris".
. 2021-10-12 13:30:45.412 Server offered these authentication methods: publickey,password,keyboard-interactive
. 2021-10-12 13:30:45.412 Offered public key
! 2021-10-12 13:30:45.423 Server refused our key
. 2021-10-12 13:30:45.463 Server refused our key
. 2021-10-12 13:30:45.463 Server offered these authentication methods: publickey,password,keyboard-interactive
. 2021-10-12 13:30:45.463 Attempting keyboard-interactive authentication
. 2021-10-12 13:30:45.470 Server refused keyboard-interactive authentication
. 2021-10-12 13:30:45.470 Server offered these authentication methods: publickey,password,keyboard-interactive
. 2021-10-12 13:30:45.470 Prompt (password, "SSH password", <no instructions>, "&Password: ")
. 2021-10-12 13:30:55.120 Response: "********"
. 2021-10-12 13:30:55.120 Sent password
. 2021-10-12 13:30:55.174 Access granted
. 2021-10-12 13:30:55.174 Opening main session channel
. 2021-10-12 13:30:55.264 Opened main channel
. 2021-10-12 13:30:55.292 Started a shell/command
. 2021-10-12 13:30:55.331 --------------------------------------------------------------------------
. 2021-10-12 13:30:55.331 Using SFTP protocol.
. 2021-10-12 13:30:55.331 Doing startup conversation with host.
> 2021-10-12 13:30:55.343 Type: SSH_FXP_INIT, Size: 5, Number: -1
< 2021-10-12 13:30:55.344 Type: SSH_FXP_VERSION, Size: 177, Number: -1
. 2021-10-12 13:30:55.344 SFTP version 3 negotiated.
. 2021-10-12 13:30:55.344 Unknown server extension posix-rename@openssh.com="1"
. 2021-10-12 13:30:55.344 Supports statvfs@openssh.com extension version "2"
. 2021-10-12 13:30:55.344 Supports hardlink@openssh.com extension version "1"
. 2021-10-12 13:30:55.344 Unknown server extension fsync@openssh.com="1"
. 2021-10-12 13:30:55.344 Unknown server extension lsetstat@openssh.com="1"
. 2021-10-12 13:30:55.344 Unknown server extension limits@openssh.com="1"
. 2021-10-12 13:30:55.344 We believe the server has signed timestamps bug
. 2021-10-12 13:30:55.344 We will use UTF-8 strings until server sends an invalid UTF-8 string as with SFTP version 3 and older UTF-8 strings are not mandatory
. 2021-10-12 13:30:55.344 Limiting packet size to OpenSSH sftp-server limit of 262148 bytes
. 2021-10-12 13:30:55.344 Changing directory to "/C:/Users/Chris".
. 2021-10-12 13:30:55.344 Getting real path for '/C:/Users/Chris'
> 2021-10-12 13:30:55.344 Type: SSH_FXP_REALPATH, Size: 24, Number: 16
< 2021-10-12 13:30:55.345 Type: SSH_FXP_NAME, Size: 51, Number: 16
. 2021-10-12 13:30:55.345 Real path is '/C:/Users/Chris'
. 2021-10-12 13:30:55.345 Trying to open directory "/C:/Users/Chris".
> 2021-10-12 13:30:55.345 Type: SSH_FXP_LSTAT, Size: 24, Number: 263
< 2021-10-12 13:30:55.347 Type: SSH_FXP_ATTRS, Size: 37, Number: 263
. 2021-10-12 13:30:55.347 Getting current directory name.
. 2021-10-12 13:30:55.387 Listing directory "/C:/Users/Chris".
> 2021-10-12 13:30:55.387 Type: SSH_FXP_OPENDIR, Size: 24, Number: 523
< 2021-10-12 13:30:55.388 Type: SSH_FXP_HANDLE, Size: 13, Number: 523
> 2021-10-12 13:30:55.388 Type: SSH_FXP_READDIR, Size: 13, Number: 780
< 2021-10-12 13:30:55.402 Type: SSH_FXP_NAME, Size: 3967, Number: 780
> 2021-10-12 13:30:55.402 Type: SSH_FXP_READDIR, Size: 13, Number: 1036
< 2021-10-12 13:30:55.553 Type: SSH_FXP_STATUS, Size: 28, Number: 1036
< 2021-10-12 13:30:55.554 Status code: 1
> 2021-10-12 13:30:55.554 Type: SSH_FXP_CLOSE, Size: 13, Number: 1284
. 2021-10-12 13:30:55.554 .ssh;d;0;2021-10-12T09:13:36.000Z;3;"-" [0];"-" [0];rwx------;2
. 2021-10-12 13:30:55.554 AppData;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Application Data;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Contacts;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Cookies;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Desktop;d;0;2021-10-08T13:13:27.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Documents;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Downloads;d;0;2021-10-08T13:18:01.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Favorites;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Links;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Local Settings;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Music;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 My Documents;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 NetHood;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT;-;786432;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.dat.LOG1;-;106496;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.dat.LOG2;-;16384;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT{334e114d-78e5-11e6-840e-ead53ba0b534}.TM.blf;-;65536;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT{334e114d-78e5-11e6-840e-ead53ba0b534}.TMContainer00000000000000000001.regtrans-ms;-;524288;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT{334e114d-78e5-11e6-840e-ead53ba0b534}.TMContainer00000000000000000002.regtrans-ms;-;524288;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.ini;-;20;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.pol;-;9244;2021-10-08T07:14:11.000Z;3;"-" [0];"-" [0];r--------;0
. 2021-10-12 13:30:55.554 Pictures;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 PrintHood;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Recent;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Saved Games;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Searches;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 SendTo;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Start Menu;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Templates;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Videos;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.555 ..;D;0;1899-12-30T00:00:00.000Z;0;"" [0];"" [0];---------;0
. 2021-10-12 13:30:55.601 Startup conversation with host finished.[/code]
In Windows security logs we see it produced like this 
[code]
A logon was attempted using explicit credentials.

Subject:
	Security ID:		SYSTEM
	Account Name:		W*****$
	Account Domain:		NT****
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Chris
	Account Domain:		NT*****
	Logon GUID:		{de02ce60-8bd4-0bcc-6c97-0ac16a9a15df}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x224
	Process Name:		C:\Windows\System32\lsass.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command[/code]
I really feel that we are almost there, but something is evading us.[/quote]

Options

Disable BBCode in this post

Notify me when a reply is posted (registered users only)

Add an Attachment

If you do not want to add an Attachment to your Post, please leave the Fields blank.

Filename

(maximum 10 MB; please compress large files; only common media, archive, text and programming file formats are allowed)

File Comment

Options

Private file (available to author and site moderators only)

Topic review

Sav123

2021-10-12 15:32

Sorted it. While I followed the instruction I did not put my key in the Administrators group only my users file. Once I copied that into the ProgramData folder and renamed it administrator_authorized_keys it worked.

Sav123

Issues Setting up SFTP

2021-10-12 14:03

Hello,

I have been following this guide you have produced and have hit a dead end when exchanging keys.(https://winscp.net/eng/docs/guide_windows_openssh_server#configuring_ssh_server).

I am attempting to set this up on a Windows 2016 server on our domain and I can successfully connect via password authentication from my PC so SFTP is running. But I am having no luck regarding the key authentication with my server refusing the key no matter what I try. I have gone through this process a few times now and also searched the internet but no solution to my issue was found after trying a few I found here. I have created the latest run with no encryption to see if we get anymore info and have the most simplest setup to reduce complexity. I can see the .ssh folder on the server in the correct location with my public key too. I have included the winscp logs below showing the process, it appears to me that it see and match the keys and then refuses them, is this correct? Is there anything I can do on the server to make this accept the keys?

. 2021-10-12 13:30:44.767 --------------------------------------------------------------------------
. 2021-10-12 13:30:44.768 WinSCP Version 5.19.3 (Build 11749) (OS 10.0.18362 - Windows 10 Enterprise)
. 2021-10-12 13:30:44.768 Configuration: HKCU\Software\Martin Prikryl\WinSCP 2\
. 2021-10-12 13:30:44.768 Log level: Normal, Logging passwords
. 2021-10-12 13:30:44.768 Local account: NT****\Chris
. 2021-10-12 13:30:44.768 Working directory: C:\Program Files (x86)\WinSCP
. 2021-10-12 13:30:44.768 Process ID: 2760
. 2021-10-12 13:30:44.775 Ancestor processes: explorer, ...
. 2021-10-12 13:30:44.775 Command-line: "C:\Program Files (x86)\WinSCP\WinSCP.exe" 
. 2021-10-12 13:30:44.775 Time zone: Current: GMT+1, Standard: GMT+0 (GMT Standard Time), DST: GMT+1 (GMT Summer Time), DST Start: 28/03/2021, DST End: 31/10/2021
. 2021-10-12 13:30:44.776 Login time: 12 October 2021 13:30:44
. 2021-10-12 13:30:44.776 --------------------------------------------------------------------------
. 2021-10-12 13:30:44.776 Session name: NT****\Chris@w**os3.*****.co.uk (Modified site)
. 2021-10-12 13:30:44.776 Host name: **********.co.uk (Port: 22)
. 2021-10-12 13:30:44.776 User name: Chris (Password: No, Key file: C:\Users\chris\Desktop\keys\priv.ppk, Passphrase: No)
. 2021-10-12 13:30:44.776 Tunnel: No
. 2021-10-12 13:30:44.776 Transfer Protocol: SFTP
. 2021-10-12 13:30:44.776 Ping type: Off, Ping interval: 30 sec; Timeout: 15 sec
. 2021-10-12 13:30:44.776 Disable Nagle: No
. 2021-10-12 13:30:44.776 Proxy: None
. 2021-10-12 13:30:44.776 Send buffer: 262144
. 2021-10-12 13:30:44.776 SSH protocol version: 2; Compression: No
. 2021-10-12 13:30:44.776 Bypass authentication: No
. 2021-10-12 13:30:44.776 Try agent: Yes; Agent forwarding: Yes; TIS/CryptoCard: No; KI: Yes; GSSAPI: Yes
. 2021-10-12 13:30:44.776 GSSAPI: KEX: No; Forwarding: No; Libs: gssapi32,sspi,custom; Custom: 
. 2021-10-12 13:30:44.776 Ciphers: aes,chacha20,blowfish,3des,WARN,arcfour,des; Ssh2DES: No
. 2021-10-12 13:30:44.776 KEX: ecdh,dh-gex-sha1,dh-group14-sha1,rsa,WARN,dh-group1-sha1
. 2021-10-12 13:30:44.776 SSH Bugs: Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto
. 2021-10-12 13:30:44.776 Simple channel: Yes
. 2021-10-12 13:30:44.776 Return code variable: Autodetect; Lookup user groups: Auto
. 2021-10-12 13:30:44.776 Shell: default
. 2021-10-12 13:30:44.776 EOL: LF, UTF: Auto
. 2021-10-12 13:30:44.777 Clear aliases: Yes, Unset nat.vars: Yes, Resolve symlinks: Yes; Follow directory symlinks: No
. 2021-10-12 13:30:44.777 LS: ls -la, Ign LS warn: Yes, Scp1 Comp: No; Exit code 1 is error: No
. 2021-10-12 13:30:44.777 SFTP Bugs: Auto,Auto
. 2021-10-12 13:30:44.777 SFTP Server: default
. 2021-10-12 13:30:44.777 Local directory: C:\Users\chris, Remote directory: /C:/Users/Chris, Update: Yes, Cache: Yes
. 2021-10-12 13:30:44.777 Cache directory changes: Yes, Permanent: Yes
. 2021-10-12 13:30:44.777 Recycle bin: Delete to: No, Overwritten to: No, Bin path: 
. 2021-10-12 13:30:44.777 DST mode: Win
. 2021-10-12 13:30:44.777 --------------------------------------------------------------------------
. 2021-10-12 13:30:44.818 Looking up host "w****.*****.co.uk" for SSH connection
. 2021-10-12 13:30:44.827 Connecting to 172.20.107.18 port 22
. 2021-10-12 13:30:44.841 We claim version: SSH-2.0-WinSCP_release_5.19.3
. 2021-10-12 13:30:44.879 Remote version: SSH-2.0-OpenSSH_for_Windows_8.6
. 2021-10-12 13:30:44.879 Using SSH protocol version 2
. 2021-10-12 13:30:44.880 Have a known host key of type ssh-ed25519
. 2021-10-12 13:30:45.028 Doing ECDH key exchange with curve Curve25519 and hash SHA-256
. 2021-10-12 13:30:45.096 Server also has ecdsa-sha2-nistp256/ssh-rsa host keys, but we don't know any of them
. 2021-10-12 13:30:45.096 Host key fingerprint is:
. 2021-10-12 13:30:45.096 ssh-ed25519 255 c9:91:6b:f8:96:63:74:a7:63:69:50:c9:6a:df:12:ed Qo9Lnm6hJHM7F9CfEkpbNvN9nLaXl+k/yRCuh8pBZIA=
. 2021-10-12 13:30:45.146 Host key does not match cached key
. 2021-10-12 13:30:45.146 Host key matches cached key
. 2021-10-12 13:30:45.147 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] outbound encryption
. 2021-10-12 13:30:45.147 Initialised HMAC-SHA-256 outbound MAC algorithm
. 2021-10-12 13:30:45.147 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] inbound encryption
. 2021-10-12 13:30:45.147 Initialised HMAC-SHA-256 inbound MAC algorithm
. 2021-10-12 13:30:45.148 Reading key file "C:\Users\chris\Desktop\keys\priv.ppk"
! 2021-10-12 13:30:45.149 Using username "Chris".
. 2021-10-12 13:30:45.412 Server offered these authentication methods: publickey,password,keyboard-interactive
. 2021-10-12 13:30:45.412 Offered public key
! 2021-10-12 13:30:45.423 Server refused our key
. 2021-10-12 13:30:45.463 Server refused our key
. 2021-10-12 13:30:45.463 Server offered these authentication methods: publickey,password,keyboard-interactive
. 2021-10-12 13:30:45.463 Attempting keyboard-interactive authentication
. 2021-10-12 13:30:45.470 Server refused keyboard-interactive authentication
. 2021-10-12 13:30:45.470 Server offered these authentication methods: publickey,password,keyboard-interactive
. 2021-10-12 13:30:45.470 Prompt (password, "SSH password", <no instructions>, "&Password: ")
. 2021-10-12 13:30:55.120 Response: "********"
. 2021-10-12 13:30:55.120 Sent password
. 2021-10-12 13:30:55.174 Access granted
. 2021-10-12 13:30:55.174 Opening main session channel
. 2021-10-12 13:30:55.264 Opened main channel
. 2021-10-12 13:30:55.292 Started a shell/command
. 2021-10-12 13:30:55.331 --------------------------------------------------------------------------
. 2021-10-12 13:30:55.331 Using SFTP protocol.
. 2021-10-12 13:30:55.331 Doing startup conversation with host.
> 2021-10-12 13:30:55.343 Type: SSH_FXP_INIT, Size: 5, Number: -1
< 2021-10-12 13:30:55.344 Type: SSH_FXP_VERSION, Size: 177, Number: -1
. 2021-10-12 13:30:55.344 SFTP version 3 negotiated.
. 2021-10-12 13:30:55.344 Unknown server extension posix-rename@openssh.com="1"
. 2021-10-12 13:30:55.344 Supports statvfs@openssh.com extension version "2"
. 2021-10-12 13:30:55.344 Supports hardlink@openssh.com extension version "1"
. 2021-10-12 13:30:55.344 Unknown server extension fsync@openssh.com="1"
. 2021-10-12 13:30:55.344 Unknown server extension lsetstat@openssh.com="1"
. 2021-10-12 13:30:55.344 Unknown server extension limits@openssh.com="1"
. 2021-10-12 13:30:55.344 We believe the server has signed timestamps bug
. 2021-10-12 13:30:55.344 We will use UTF-8 strings until server sends an invalid UTF-8 string as with SFTP version 3 and older UTF-8 strings are not mandatory
. 2021-10-12 13:30:55.344 Limiting packet size to OpenSSH sftp-server limit of 262148 bytes
. 2021-10-12 13:30:55.344 Changing directory to "/C:/Users/Chris".
. 2021-10-12 13:30:55.344 Getting real path for '/C:/Users/Chris'
> 2021-10-12 13:30:55.344 Type: SSH_FXP_REALPATH, Size: 24, Number: 16
< 2021-10-12 13:30:55.345 Type: SSH_FXP_NAME, Size: 51, Number: 16
. 2021-10-12 13:30:55.345 Real path is '/C:/Users/Chris'
. 2021-10-12 13:30:55.345 Trying to open directory "/C:/Users/Chris".
> 2021-10-12 13:30:55.345 Type: SSH_FXP_LSTAT, Size: 24, Number: 263
< 2021-10-12 13:30:55.347 Type: SSH_FXP_ATTRS, Size: 37, Number: 263
. 2021-10-12 13:30:55.347 Getting current directory name.
. 2021-10-12 13:30:55.387 Listing directory "/C:/Users/Chris".
> 2021-10-12 13:30:55.387 Type: SSH_FXP_OPENDIR, Size: 24, Number: 523
< 2021-10-12 13:30:55.388 Type: SSH_FXP_HANDLE, Size: 13, Number: 523
> 2021-10-12 13:30:55.388 Type: SSH_FXP_READDIR, Size: 13, Number: 780
< 2021-10-12 13:30:55.402 Type: SSH_FXP_NAME, Size: 3967, Number: 780
> 2021-10-12 13:30:55.402 Type: SSH_FXP_READDIR, Size: 13, Number: 1036
< 2021-10-12 13:30:55.553 Type: SSH_FXP_STATUS, Size: 28, Number: 1036
< 2021-10-12 13:30:55.554 Status code: 1
> 2021-10-12 13:30:55.554 Type: SSH_FXP_CLOSE, Size: 13, Number: 1284
. 2021-10-12 13:30:55.554 .ssh;d;0;2021-10-12T09:13:36.000Z;3;"-" [0];"-" [0];rwx------;2
. 2021-10-12 13:30:55.554 AppData;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Application Data;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Contacts;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Cookies;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Desktop;d;0;2021-10-08T13:13:27.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Documents;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Downloads;d;0;2021-10-08T13:18:01.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Favorites;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Links;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Local Settings;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Music;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 My Documents;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 NetHood;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT;-;786432;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.dat.LOG1;-;106496;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.dat.LOG2;-;16384;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT{334e114d-78e5-11e6-840e-ead53ba0b534}.TM.blf;-;65536;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT{334e114d-78e5-11e6-840e-ead53ba0b534}.TMContainer00000000000000000001.regtrans-ms;-;524288;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 NTUSER.DAT{334e114d-78e5-11e6-840e-ead53ba0b534}.TMContainer00000000000000000002.regtrans-ms;-;524288;2021-10-08T07:14:48.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.ini;-;20;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rw-------;0
. 2021-10-12 13:30:55.554 ntuser.pol;-;9244;2021-10-08T07:14:11.000Z;3;"-" [0];"-" [0];r--------;0
. 2021-10-12 13:30:55.554 Pictures;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 PrintHood;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Recent;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Saved Games;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 Searches;d;0;2021-10-08T07:14:16.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.554 SendTo;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Start Menu;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Templates;d;0;2021-10-08T07:14:09.000Z;3;"-" [0];"-" [0];rwx------;0
. 2021-10-12 13:30:55.554 Videos;d;0;2021-10-08T07:14:15.000Z;3;"-" [0];"-" [0];r-x------;0
. 2021-10-12 13:30:55.555 ..;D;0;1899-12-30T00:00:00.000Z;0;"" [0];"" [0];---------;0
. 2021-10-12 13:30:55.601 Startup conversation with host finished.

In Windows security logs we see it produced like this

A logon was attempted using explicit credentials.



Subject:

   Security ID:      SYSTEM

   Account Name:      W*****$

   Account Domain:      NT****

   Logon ID:      0x3E7

   Logon GUID:      {00000000-0000-0000-0000-000000000000}



Account Whose Credentials Were Used:

   Account Name:      Chris

   Account Domain:      NT*****

   Logon GUID:      {de02ce60-8bd4-0bcc-6c97-0ac16a9a15df}



Target Server:

   Target Server Name:   localhost

   Additional Information:   localhost



Process Information:

   Process ID:      0x224

   Process Name:      C:\Windows\System32\lsass.exe



Network Information:

   Network Address:   -

   Port:         -



This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command

I really feel that we are almost there, but something is evading us.

Post a reply

Topic review

Issues Setting up SFTP

Documentation

Support

Associations

Follow Us