SecureCRT and a failed order of applied preferences

Update: The amazing folks at VanDyke have fixed SecureCRT so that if the session has a defined key, it is tried first; and if that key fails then agent keys are tried next.

The server has disconnected with an error. Server message reads:
A protocol error occurred. Too many authentication failures for ec2-user

Recently I was setting up EC2 instances for a client, and as such things go I wound up creating ssh keys for each of the EC2 regions in which I was working.  With each instance I created in each new region, I configured the specific connection profile in SecureCRT with the appropriate ssh key.  All was well, for a while.  And then I hit a brick wall.  I could spin up new instances, add them to SecureCRT, but I couldn’t connect to them.

Long story short, as I added each new ssh key, it was added to the “Agent Keys” that were automagically presented to each host.  What I didn’t expect, and what I consider to be a bit of a bug, is that the Agent Keys are presented first; even if the session profile specifies a key.  So, despite having configured a specific key for the session, my connections were failing because the X number of Agent Keys presented first exceeded MaxAuthTries in the sshd_config.

Many other ssh clients support Key Agent along with specified keys.  OpenSSH and PuTTY are two that come to mind.  OpenSSH will present Key Agent keys for auth, but if you specify “-i PATHtoKEYfile” that key will be presented first.

I reached out to support at VanDyke, the creators of SecureCRT.  I explained the problem, and asked if there was a configuration option for controlling the Key Agent/Session Key order; and if not I requested that this be filed as a bug.  I was told this “behavior is by design”.  Odd, since they constructed a video explaining how Session settings override Default settings; so it is obvious they understand that most specific takes precedent over less specific settings.  The same precedence should logically apply to auth keys, and it does with OpenSSH.  According to section “Using Identities” in SSH, The Secure Shell: The Definitive Guide the described behavior is host specific identities, and then agent identities.

The quickie solution I used was to got to “Tools”/”Manage Agent Keys” in SecureCRT and clear out all the extraneous keys that had accumulated.  I hated doing this, as I was stripping out some of the ‘automatic smarts’ that I love about SecureCRT.  Still, it isn’t as bad as the kludge that Todd at VanDyke support suggested.  His suggestion was that I disable “Try All Agent Keys” in the SSH2.ini file.  Todd’s suggestion makes me wonder why I pay money for SecureCRT and all of its advanced features if their only way to deal with a problem is to have me disable those features.

Despite several days of emailing back and forth, and providing documentation showing that at least two of the major ssh clients process host keys before agent keys, the folks at VanDyke stand by their odd choice of ordering.  Todd has submitted a ‘feature request’ for me, and they refuse to treat this as a bug.  Next time my license is up for renewal I just might have to write a SecureCRT->JellyfiSSH config conversion tool…

High School Reunion

I was not able to make it to my ten year reunion. I had planned to attend… I was going to show up in my school bus, and after the official party ended I wanted to take people bar hopping in the bus. The bus was my undoing. One of my neighbors, whose head is so far up his rectum that he watches his ulcers grow, called the police and complained that my bus was lowering his property values. The police were rather firm that they could not wait the four weeks until I was coming out for the reunion, and I was forced to fly out two weeks early. Not being able to afford more time off and the additional plane tickets, I was forced to skip my reunion.

I can share with you the short note I provided for the reunion book…

The first thing I did after graduation was return to the mother ship so I could go home. I had run the gambit of American education and now knew volumes about the subjugation of the masses through the illusion of education. Unfortunately I found that Area 51 had been turned into a Six Flags Great America and the mother ship into a twisted version of Epcot. Elvis was working the crowds and Jim Morrison had his own booth in the gaming area.

Lacking a way home I decided to go native. In an attempt to blend in, I attended college. Here I found that my earlier studies had only been an introduction to the malevolency of the American education system. The colleges of ‘education’ were an evolutionary step in preventing over-education. William Harris, US Commissioner of Education in 1899, would be proud. (see Zendik Farm, issue 50, “How School Started“) Innovative thinking is punished while conformance guarantees success, of a sort. Since I had no way to report my studies I decided to end this self-torture. I fled seeking a more hospitable climate.

I became a ‘Corporate Paid Computer Hacker’ with the official title of ‘Court Wizard’. This provided the flexibility I needed to preserve my sanity and save me from complacency. I also managed to avoid monogamy and progeny during these days and those that followed.

Even though I was free from its more insidious entrapments, I soon became tired with the entire American culture and decided a trip through time was the necessary medicine. I sought and found a way to return to my favorite period of human history, that brief span of years that passed from the Medieval to Renaissance periods of the European Colonization Project. It seems that a large number of humans enjoy re-creating those periods of history in which education was rare and survival a matter of luck. (Perhaps an offshoot of current educational practices? Note for furthur research.)

By infiltrating these groups I was able to find a comfortable world to live within, while financing my adventures with my ‘hired gun hacker’ persona.

Perhaps this world should be opened up for no other reason than its recreational potential? After all, I’m having a blast…

And that’s how I spent my summer vacation.
Can I go home now? My brain is full.

I use Amazon affiliate links in some of my posts. I think it is fair to say my writing is not influenced by the $0.40 I earned in 2022.