topic Re: SSH key authentication using domain users? Then how about SFTP? in Network and Storage Protocols

SSH key authentication using domain users? Then how about SFTP?

audifreakjim — Thu, 05 Jun 2025 06:52:31 GMT

We cannot seem to get this to work with domain users.

We are using this KB as a guide to setup passwordless ssh

https://kb.netapp.com/support/index?page=content&id=1011670

It is working for root and local users.

For domain users we have tested both naming conventions for folder names in /etc/sshd

/etc/sshd/username@domainname/.ssh/authenticated_keys

/etc/sshd/domainname\username/.ssh/authenticated_keys

It finds the keys, but ONTAP spits back:

User 'lab.demo\administrator' denied access - missing required capability: 'login-ssh'

Two separate environments with the same results. Again, we can get local users to work so the keys are good, and with domain users it is finding the keys.

I have tried useradmin group modify administrators -r admin,root to give maximum permissions, but still no luck. Just the default role of admin should be sufficient..

So getting SSH to work is one thing, but we are really trying to get passwordless SFTP working. Here is the error when we try with a domain user. The Authentication type for SFTP is mixed, we have also tried with NTLM

SFTP (SSH File Transfer Protocol) connection request from client system xxx.xxx.xxx.xxx, user lab.demo\administrator failed, because the user is not permitted to do SFTP (SSH File Transfer Protocol) operations.

Has anyone successfully implemented passwordless SFTP using domain credentials? Is this even supported?

Re: SSH key authentication using domain users? Then how about SFTP?

columbus_admin — Fri, 08 Jul 2011 14:08:01 GMT

This post is a bit old, but this KB(for SSH breaking when roles change) has the info you need. Any ssh based authentication, with AD accounts is not supported in ONTAP, and believe me I really wish it were. We have ran into a bug recently(2 months ago) and this KB was brought up to us as still being correct.

Cause

Data ONTAP does not support key exchange with Active Directory Accounts.

Solution

Use local filer accounts for SSH key exchange to avoid this issue. NetApp does not currently support key exchange with Active Directory accounts.

https://kb.netapp.com/support/index?page=content&id=2012318

Re: SSH key authentication using domain users? Then how about SFTP?

audifreakjim — Mon, 11 Jul 2011 15:30:33 GMT

Thanks for clearing this up!

Re: SSH key authentication using domain users? Then how about SFTP?

JERROD_FINN — Wed, 07 Nov 2012 19:46:14 GMT

Actually you can do this. I've set it up and use it daily. Send me a message and I'll explain if you are interested.

Re: SSH key authentication using domain users? Then how about SFTP?

PC70 — Mon, 02 Mar 2015 16:41:23 GMT

What was the fix?

@JERROD_FINN wrote:
Actually you can do this. I've set it up and use it daily. Send me a message and I'll explain if you are interested.