Private key forwarding to winscp isn't working

[kyuuaria]

Describe the problem:
The private key forwarding to winscp added in #7143 doesn't work for me. Clicking Launch WinSCP simply doesn't do anything. There is also nothing in the logs. It should be noted that I got both my private key and the corresponding passphrase in the vault. I also made sure to add winscp to path because I thought it might not be able to execute the command.

[artu-ole]

Hm, just making sure, do you have WinSCP path configured in the Tabby settings? Having WinSCP in path should not be required, but you need it to be configured in here:

Edit: example C:\Program Files (x86)\WinSCP\WinSCP.exe

[kyuuaria]

No I have it on auto-detect I'll try it with the explicit winscp path later

[artu-ole]

Auto-detect didn't function for me either back in the day :(

[kyuuaria]

I have set the path now and it still doesn't work

[artu-ole]

Interesting, I've now tested the passphrased key and that worked as well. When you say there is nothing in the logs do you mean in the developer tools console there is no new output after you try winscp connection?

[kyuuaria]

I checked the log.txt in C:\Users\USERNAME\AppData\Roaming\tabby

[kyuuaria]

I just tested it with the devtools and that is the error I got

[kyuuaria]

Have you tested it with both the private key and the corresponding passphrase in the vault?

[artu-ole]

Hm, yes, tested with the ssh-keygen generated keypair:
ssh-keygen -t rsa -b 2048
Key is in the settings of the connection:

Key is in the following usual format:

Key

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABBU55Mgi+
PXgHWgFNNMdAxxAAAAEAAAAAEAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQDF0IEyoIFk
4jwstW9XUc9rsb1LAhVUFv36lP+zhdjJzcyjhxO3eQcqYMs0pJCQL77o2hNOuuApf1/QPn
NrJm6WBoJwfY+J6SQpDtnIXiS/cxOFyG2fwKmkLTofmtU04f7bFmgNEzfQ8e5e+dWIexjI
esqTheBt5qP4huq5Cvc+5U0PgLWPanv1+oSRIxdRc8B6EmNMxf05SqQs5KhFkkYms5jbNf
VjIJ22Df1Xmke/uGLq4MPQh3e1vmdRPsAxDCbaf7/XjoAy/JxkOKvAQ6CiWQG5aziL/lAK
TBwE1yAZs16arHybS09mQEX8f6b9oJ/LPZjxTg3qb3AsXryg9rLLAAAD0G8kutqopYwc/s
41KaNE9Xt/XWCC4TD4TdypwP41GXO57jkmsJPd/w5+ASSNRbWYRvJcUSEHlljf4iGpgNtm
wzSdZrHGgzTSUH/u9tva212I6BchQK6mwiRoYoonAv4UoCRhdBRhlwxunS/VJEe671BLDD
IxIJLf0AM8meA3sJ0Gq57uGOvLaaupozQjIi1/V7Tq03GcmPeBc42i+sX3fpHMLUe3eHGK
s6g2K0WxTLNlthyvfHxQpNmdvRxXmniGhq0aEVurSHidt6vn16u2EQX//mHUyyfR190d1P
4DGziRQCYXEcUCUED8AJt8bjGxUcXCDA6Oug9BSuM4Kk6a5X84jQuOPoY6hJeMFxgniI9q
jQTWA+ol5TZ1cq97Iv7I0fHNWf74Mq2mxo0SIAsaXo+dsyzJYfbgWtRDa/EV99HfOMut8V
mcpWi7Gql+w00rRDrIpVsuInvHRFG/PL8UIYwJEalbL/L80V69MkSYqaRbITL/eunZwE3J
oDIliHoKEAbbVUmwc5iPY8+F4govxCqomFmTsCXGkPRBTSWEweT/QNsi/apRR2LPZGk6k8
sYQCizM2rs64UwXEup0eGSA5va7o95sFxhoDTmIOnsN95BC1UuGWilWWkj+NFKlzb/IV9I
JOseIb0VOv7FtzQnpYXS6Ulp8qCjbYYsBj7O9CxewLTLjwroIU7gMmI50tQ4CqBgK3ToQo
nh5U3iCd9urg6NVeFpB8xrDr0454+cUraG5Ycd6skjXg0YWmV1eqMcSLdNnfuXcrGYeC+S
CEch24o/KlnE1wS/knhJvkmNDalOzM3hGMShIZDGf7idg2b5k6RC0qOkp144TSWxohQT3T
0ZFxWBKwA58Q14/RBsInTF6w/xgZdN78Wv9aqHjhihnO2JzZsmLRAt1IlGoSq1Rp/pk5uF
0j7Hafub/7JdUFRnNKbmStcZmlC7HXjcJ/yHQv5VAMQ020Fo/ovxC0PIlROq9GctpPWO4B
f+FWLtA+3erjgDYsMlo2LAk6HuYxoxo7s3Q8AGftapOuuQNuBli2+jZkE/gMx8Ajqj3CiU
4v5N2Gcp/q8Nke6QOesSy1qjvVoyVbY11XSH4aolTWa+9Wv/hDhg8CPr1gVrTkK2JBzleh
c9Ue2B+qk4V8qnah7oIKqoaxkzkgLrlcQqhhpyhdgJcWEBj/aVNWkllvvDVbnPduwRA8Sx
fc9V2t2J0NgkTL5DUds7OI1EtwAhmofLl0Kv3b3hmoWW4m3w60UvmGanjwARNqeAAHNCJa
iI18DBtfah3p8Y+MN2Dhy0LSGgBdw=
-----END OPENSSH PRIVATE KEY-----

The comments are required as it seems the parsing library relies on them(that is the function that throws the error for you):
https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pem.js#L95-L196

GitHub

forge/pem.js at 2bb97afb5058285ef09bcf1d04d6bd6b87cffd58 · digitalbazaar/forge

A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps - forge/pem.js at 2bb97afb5058285ef09bcf1d04d6bd6b87cffd58 · digitalbazaar/forge

[kyuuaria]

My private key looks different for sure I also generated one with ssh-keygen but I used EdDSA

[artu-ole]

Okay, that might explain it, even though the forge claims to support it (ED25519) something must be failing. I will dig deeper in the evening!

[Remonli]

Okay, that might explain it, even though the forge claims to support it (ED25519) something must be failing. I will dig deeper in the evening!

It works well if set profile as agent and use pageant as agent, but fails if set profile as auto.

[kyuuaria]

It works well if set profile as agent and use pageant as agent, but fails if set profile as auto.

In that case winscp is just going to use the ssh agent as well so no key forwarding is required

[kyuuaria]

Okay, that might explain it, even though the forge claims to support it (ED25519) something must be failing. I will dig deeper in the evening!

That's gotta be the issue I'm using a regular openssh private key but with ed25519 instead of rsa

[Remonli]

It works well if set profile as agent and use pageant as agent, but fails if set profile as auto.

In that case winscp is just going to use the ssh agent as well so no key forwarding is required

Actually, there are more bugs on key forwarding. If you log in a remote server with pageant agent and then try to ssh to another one on 1st server , it's ok. But if you do same thing with windows 11 openssh agent , the forwarding does not work.

[artu-ole]

I'm able to reproduce the issue with the ed25519, the source issue is in a node-sshpk library which is used internally by Tabby to handle private keys and at that point when winSCP is being launched the key is only available from that object. It fails to properly serialize the key back from the parsed state. Though parsing goes correctly since Tabby is able to open the connection.
There seems to be a fix on the way: TritonDataCenter/node-sshpk#83
I didn't (yet) test whether that pull request would do the trick, but it should judging by what it says on the tin.
Tabby itself is using a fork by @Eugeny in which he might be able to incorporate those changes sooner.

[artu-ole]

Actually, a correction. The key is available as string at that point as well, but node-sshpk is used for its auto parsing mode: https://github.com/TritonDataCenter/node-sshpk#parsekeydata-format--auto-options
Then node-forge is used for it's support for writing ppk putty format keys(which is the only format that winSCP accepts from cli arguments).
It does not look like there is an auto format selection in node-forge and ppk writing in sshpk is lacking, hence that's the order of things.

GitHub

GitHub - TritonDataCenter/node-sshpk: Parse, convert, fingerprint and use SSH keys in pure node.js

Parse, convert, fingerprint and use SSH keys in pure node.js - GitHub - TritonDataCenter/node-sshpk: Parse, convert, fingerprint and use SSH keys in pure node.js

[Eugeny]

I've merged that PR into my node-sshpk and bumped it in Tabby - let me know if it helps!

[artu-ole]

Alright, played around with it and indeed now node-sshpk serializes a valid pkcs8 formatted key. But encountered a problem on the other side, the node-forge library is not able to read it anyhow(I gave it too much credit and didn't check yesterday): digitalbazaar/forge#667
Which brings this to square one. node-sshpk can't write ppk, node-forge can write it, but can't read ed25519 key in pem format.
I've looked around and didn't find a library that would do that other than a paid one: https://www.chilkatsoft.com/refdoc/nodejsSshKeyRef.html Suggestions welcome!

There is another way, to rely on winscp.com(cli utility tools that come with winscp) and that works, but might be too clumsy, there would need to be another prompt for passphrase if it is not saved. But that would remove node-forge dependency and might be a reliable way to go.
https://superuser.com/a/912618

SshKey Node.js Reference Documentation

Super User

How do you convert an SSH private key to a .ppk on the Windows command line?

I have generated a key pair with ssh-keygen. I now want to use the same key pair with PuTTY-based applications.

Because I'm working in a CLI environment, I want to convert the key to the .ppk format

[Eugeny]

happy to use winscp's own converter if it works reliably 👍

[kyuuaria]

@artu-ole how are things going?

[artu-ole]

@kyuuaria Hey, sorry mate, didn't have time to get into it yet between work and personal life. Since that's still a pressing issue for you and the path forward seems clear I'll give a try next week and hopefully will have something to share then!