unable to authenticate with identity file

[little-plant]

``# the instructions

1. generate identity file
   tctl auth sign --user=xxx --out=teleport-identity --format=file
2. tsh with identity file
   tsh --identity=./teleport-identity --proxy=<proxy_addr>:443 -d clusters

get error msg below

DEBU [TSH] Extracted username "xxx" from the identity file ./teleport-identity. tsh/tsh.go:1629
INFO [CLIENT] no host login given. defaulting to dev client/api.go:1035
DEBU [TSH] Pinging the proxy to fetch listening addresses for non-web ports. tsh/tsh.go:1789
DEBU [CLIENT] not using loopback pool for remote proxy addr: <proxy_addr>:443 client/api.go:2706
INFO [CLIENT] Connecting proxy=<proxy_addr>:3023 login="dev" client/api.go:2043
WARN [CLIENT] Failed to authenticate with proxy <proxy_addr>:3023. error:[ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain] client/api.go:2047

ERROR REPORT:
Original Error: *errors.errorString ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
Stack Trace:
/home/dev/workspace/repos/teleport/lib/client/api.go:2048 github.com/gravitational/teleport/lib/client.(*TeleportClient).connectToProxy
/home/dev/workspace/repos/teleport/lib/client/api.go:1964 github.com/gravitational/teleport/lib/client.(*TeleportClient).ConnectToProxy.func1
/usr/local/go/src/runtime/asm_amd64.s:1650 runtime.goexit
User Message: failed to authenticate with proxy <proxy_addr>:3023
ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

[stevenGravy]

Is the port 3023 open from that machine to the proxy? Looks like there is potentially an issue.

[little-plant]

yes, when I try to login with password in debug mode, i can see
INFO [CLIENT] Successful auth with proxy <proxy_addr>:3023. client/api.go:2051

[webvictim]

Can you share the output of cat teleport-identity | openssl x509 -noout -issuer -dates -subject?

I see that you're trying to use the login dev - I'm trying to make sure that the user you issued the cert for has access to the dev login.

I also want to make sure that the identity file is still valid, and that it was issued by the same cluster you're trying to use it against.

[little-plant]

issuer=O = localhost, CN = localhost, serialNumber = 268247766777509068516423604099551129394
notBefore=Jun 11 11:07:55 2024 GMT
notAfter=Jun 11 17:58:21 2024 GMT
subject=L = -teleport-nologin-1738125b-1380-4d81-992c-8f5a8def2531, street = localhost, postalCode = {\"logins\":null}, O = auditor + O = log-audit-access, CN = <username>, 1.3.9999.1.7 = localhost

[little-plant]

seems like I should specify the --user ? dev is the username of my linux server. Actually I just want to use tsh as an auditor, so I'm not trying to login any host.

[webvictim]

Yeah - as I suspected, there are no logins associated with the user. You should either:

• assign a role to the user which grants them the dev login
• run tctl users update <username> --set-logins dev to grant that login directly to the user