This KB explains steps to resolve an issue where a SSH connection fails to a Juniper device asking for password even-though a keypair (public and private keys) are used for authentication.

If customer uses a keypair authentication method, however while sshing to the device it requests for a password, the connection will fail as there is no password to authenticate.

If you run a verbose for ssh, you would see that the authentication fails as there is no mutual authentication key is detected and then goes for next authentication method which is password.

ACMv1-: ssh -vvv [email protected]

debug1: send_pubkey_test: no mutual signature algorithm >>>>>>>>>>>> it could not find the required algorithm for authentication.

debug2: we did not send a packet, disable method

debug3: authmethod_lookup password

debug3: remaining preferred:

debug3: authmethod_is_enabled password

debug1: Next authentication method: password

[email protected]'s password:

This error is seen usually seen when an unsupported/deprecated algorithm is used to authenticate or the algorithm is not present in the ssh config file of the client.

One of the below options can be used to resolve this issue.

• Add the missing algorithm in the ssh config of the client and then try to ssh.

# vim ~/.ssh/config, add the lines at the beginning

Host host.example.com

PubkeyAcceptedKeyTypes=+ssh-rsa

HostKeyAlgorithms=+ssh-rsa

• If adding the algorithm to the client is not possible, then you can specifically mention the algorithm when doing SSH

ssh -o "PubkeyAcceptedAlgorithms=+ssh-rsa" <server>

NOTE:

The same error can also be encountered while doing scp as, scp establishes the ssh connection before copying the file. Hence same workaround can be used for scp as well.

for eg:

scp -o "PubkeyAcceptedAlgorithms=+ssh-rsa" <source> <destination>