[SUPPORT] - SSH Key Signing - Hashicorp Vault

Are you using paramiko as a client or server?

Client

What feature(s) aren't working right?

SSH, Keys/auth

What version(s) of paramiko are you using?

3.3.1

What version(s) of Python are you using?

3.11.4

What operating system and version are you using?

Mac M1

If you're connecting as a client, which SSH server are you connecting to?

OpenSSH

If you're using paramiko as part of another tool, which tool/version?

No response

What are you trying to do with paramiko?

I'm trying to ssh into my server in order to execute certain commands using generate private RSA key and signed ssh key cert via Hashicorp Vault.

How are you trying to do it, and what's happening instead?

1. I first generate my private key and get public key that needs to be signed by Hashicorp Vault.

def generate_ssh_key_pair():
    private_key = rsa.generate_private_key(backend=default_backend(), public_exponent=65537, key_size=2048)
    public_key = private_key.public_key()
    private_key_pem = private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.TraditionalOpenSSL,
        encryption_algorithm=serialization.NoEncryption()
    ).decode('utf-8')

2. Then I send the key to be signed by Hashicorp Vault using public key from generated key above.
3. Key is signed by Vault without any issues using hvac library.
4. I write both private key and generated signed certificate from Hashicorp Vault locally to separate files.
5. Then I try to establish ssh connection with Paramiko client using below code.

        ssh_client = paramiko.SSHClient()
        ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        # Connect to the SSH server
        test_connection = ssh_client.connect(ssh_host, ssh_port, ssh_username, key_filename=[private_key_path, public_key_cert_path])

6. I'm getting "Error: Authentication failed" and I know at least pkey parameter when using regular ssh private key without signed cert works just fine. However, for some reason adding certificate to the key_filename params doesn't pass it along with private key in order to auth.

Basically I'm trying to use IdentityFile and CertificateFile if you were to use your local ssh client.

Anything else?

No response

Start at SSHClient.connect and trace how the key_filename list is processed for the private key and the Vault-signed certificate. Check the existing authentication tests and determine whether a connection to OpenSSH succeeds with both files, with completion demonstrated by successful authentication using the signed certificate.