Linux – How to we connect to an SFTP server from a Windows machine to a Linux SFTP server using a DSA key

linuxsftpsshwindows

As a Windows user, I generated a pair of DSA keys from CoreFTP Lite and sent it to a third party that runs an SFTP server.

They told me that a valid DSA key needs to have ssh-dsa at the start and the username@systemname at the end.

CoreFTP generated neither the ssh-dsa header nor the username@systemname footer. I tried with WinSCP and it didn't generate them either.

Is there a difference between how SFTP works between Windows and Linux?

If I put a useraccount@systemname at the end of the text will it work? How would the Linux system validate that my system is called "systemname"? If it can't validate, what is the purpose of adding it?

Best Answer

Is there a difference between how SFTP works between Windows and Linux?

No. The only difference is key storage formats used by various programs. Most Linux systems run OpenSSH as the SSH/SFTP server, and your third party is requesting an OpenSSH-compatible public key.

  • CoreFTP stores private keys in the OpenSSH format, and public keys in a similar to OpenSSH.

    You can use PuTTYgen or ssh-keygen -yf to extract the public key, as the "private" file always contains the entire keypair.

    Or you can simply add "ssh-dss" before the CoreFTP public key data to make it OpenSSH-compatible. Example:

    ssh-dss AAAAB3NzaC1kc3M...
    

    (Why does CoreFTP forget the header? It could be that the developers deemed it unnecessary, as the Base64-encoded data already has ssh-dss in the beginning. And besides, who would ever need compatibility with the most popular SFTP software?)

  • PuTTY uses its own "PPK" key format.

    When you open the key in PuTTYgen (or generate a fresh one), the OpenSSH public key is displayed in the big box at the top.

    The private key can be exported to OpenSSH format through the menus.

  • WinSCP does not have a key generation program. It bundles PuTTYgen from PuTTY.

For completeness:

  • OpenSSH (ssh, ssh-keygen) stores private keys in "PEM" format used by OpenSSL, and public keys in its own single-line format. (As mentioned above, the "private" key file contains both private and public keys.)

They told me that a valid DSA key needs to have [...] the username@systemname at the end.

[...] If I put a useraccount@systemname at the end of the text will it work? How would the Linux system validate that my system is called "systemname"? If it can't validate, what is the purpose of adding it?

The username@systemname part is a comment used for key identification (for example, when you have 10 keys in authorized_keys), but is entirely ignored by software.

OpenSSH public keys without a comment are perfectly valid.