Getting error using the SSH remote capture interface with key only authentication.
Error by extcap pipe: * (sshdump.exe:2128): WARNING *: Error creating connection: Can't find a valid authentication. Disconnecting
Tuning off key only authentication on the remote system and using password works. The private key works in WinSCP.
The other obvious thing to check is that your key doesn't have a passphrase on it. Alternatively, if it does, make sure you are providing the passphrase to wireshark each time you attempt to capture from SSH (it doesn't store the passphrase, it must be provided anew each time).
My situation was different, I traced this back to the user account that I was attempting to login with, had an invalid shell setup on the host in /etc/passwd.
Why it was working with most other terminals is a bit of a mystery, but I suspect it's because with those programs you can explicitly set the shell you want to use for that connection (which I had done).
Asked: 2017-11-19 08:56:35 +0000
Seen: 6,566 times
Last updated: Dec 30 '20
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
Assuming this is done on Windows, with an unknown target. Are there any protections on the private key (eg. passphrase?). Is a key agent being used?
Yes Wireshark on Windows. Target is FreeBSD 11.1. Have tried with both protected and unprotected private key. No, a key agent is not being used. Note, the same private key (both protected and unprotected) works in WinSCP.
Have you tried connecting via putty or another windows client with full logging turned on? My idea is, that the path might not be provided correctly, and therefore the id file either does not get loaded at all, or is the wrong one selected.
strangely enough appears to be no one uses ssh capture from windows machines with key authentication instead of password. I have exactly the same situation as @NOYB. And yes, I can connect using putty from same machine. What's wrong with wireshark sshdump?
Same problem, different circumstance. Can't get it to work even just with username and password.
The credentials are fine, I can SSH from most other applications to the box in question with the same creds, but fails from Wireshark's SSH capture interface:
Error by extcap pipe: * (sshdump.exe:35516): WARNING *: Error creating connection: Can't find a valid authentication. Disconnecting
The only other program that is also having an issue is plink (which is my normal go to for streaming remote captures into wireshark, hence why I was playing with the SSH interface in the first place....)
The following command shows the avaliable auth methods. I would have expected it to work...