如何在 Mac 终端上通过 ssh 登录使用私钥？ 我的尝试导致`加载密钥“/path/to/privatekey”：无效格式`

Question

I usually use putty on windows for ssh login, which has an option to add a private key for logging in.

I switched to Mac and I am using iTerm2 to attempt to log into the server. I tried the command ssh user@serverIPAddress -p portNumber but I got Permission denied (publickey). , which I am guessing is because I didn't add my private key like I was doing with Putty.

I tried looking up how to add my private key here

https://docs.rackspace.com/support/how-to/logging-in-with-an-ssh-private-key-on-linuxmac/

I saved my private key file from my windows laptop and saved it into my mac. I think tried

ssh -i /path/to/privatekey user@serverIPAddress -p portNumber

But then I got this

Permissions 0644 for '/path/to/privatekey' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored.

I looked at the website and it had instructions to secure the file, so I tried:

chmod 600 /path/to/privatekey

And tried

ssh -i /path/to/privatekey user@serverIPAddress -p portNumber

Again, but then I got

Load key "/path/to/privatekey": invalid format.

I open the file and noticed that it's not in same format as in the the webpage. My file is formatted like this

PuTTY-User-Key-File-2: ssh-rsa
Encryption: aes256-cbc
Comment: rsa-key-20200908
Public-Lines: 6
public key
Private-Lines: 14
private key

So I remove everything everything except the private key and I add '-----BEGIN RSA KEY-----' and '-----END RSA KEY-----' like on the website.

But I still get

Load key "/path/to/privatekey": invalid format.

Any ideas on where I went wrong?

Answer 1

TLDR: Putty uses a different format

You're not really using iTerm2 to 'login to the server'. You're using the OpenSSH client program ssh , run from a shell in iTerm2, to do so. The problem is between Putty and OpenSSH. Putty uses its own format for privatekey files, which is different from the formats OpenSSH uses. Putty cannot use an OpenSSH keyfile, and OpenSSH cannot use a Putty keyfile.

Changing the PEM labels on a file does not change its contents. BTW, the PEM labels normally used by OpenSSH below 7.8 for an RSA keyfile are -----BEGIN/END RSA PRIVATE KEY----- , as shown on the webpage you link, NOT RSA KEY as you say. But putting either of these on an otherwise unchanged Putty keyfile is like taking a box of rat poisin and putting a label on it that says 'candy'. The contents are still rat poison, not candy, and anyone who eats them thinking they are candy is in big trouble.

The Putty-related program PuttyGen can convert between these formats. See dupe from years ago when the scope of SO included non-programming questions like this:
How to convert SSH keypairs generated using PuTTYgen (Windows) into key-pairs used by ssh-agent and Keychain (Linux)
and crossdupes:
https://security.stackexchange.com/questions/146360/ssh-keypair-works-in-putty-but-not-in-openssh-inside-the-puttys-session
https://unix.stackexchange.com/questions/48303/using-rsa-private-key-from-putty-in-filezilla
https://unix.stackexchange.com/questions/74545/what-is-the-difference-between-an-openssh-key-and-putty-key
https://superuser.com/questions/990275/generate-rsa2-key-in-openssh-format