Robomongo: ssh tunnel using private key

[drujensen]

I have not been able to successfully connect via tunnel using a private key. The private key doesn't have a pass phrase. I selected my ~/.ssh/id_dsa private key and verified that I can ssh from a terminal with no password requested. I use this same technique using SQLPro for MySQL with no issues.

Thanks!

[michalzubkowicz]

Same here in 0.8.4

Fri Apr  4 10:57:38.735 [Robomongo] Connecting to localhost:27017...
Fri Apr  4 10:57:39.291 ERROR: Authentication by public key failed![Robomongo] connect failed
Fri Apr  4 10:57:39.823 ERROR: Authentication by public key failed![Robomongo] can't connect

And ssh server secure.log:

Apr  4 10:55:54 backup sshd[8570]: Connection from 111111 port 36427
Apr  4 10:55:54 backup sshd[8570]: debug1: Client protocol version 2.0; client software version libssh2_1.4.3
Apr  4 10:55:54 backup sshd[8570]: debug1: no match: libssh2_1.4.3
Apr  4 10:55:54 backup sshd[8570]: debug1: Enabling compatibility mode for protocol 2.0
Apr  4 10:55:54 backup sshd[8570]: debug1: Local version string SSH-2.0-OpenSSH_5.3
Apr  4 10:55:54 backup sshd[8571]: debug1: permanently_set_uid: 74/74
Apr  4 10:55:54 backup sshd[8571]: debug1: list_hostkey_types: ssh-rsa,ssh-dss
Apr  4 10:55:54 backup sshd[8571]: debug1: SSH2_MSG_KEXINIT sent
Apr  4 10:55:54 backup sshd[8571]: debug1: SSH2_MSG_KEXINIT received
Apr  4 10:55:54 backup sshd[8571]: debug1: kex: client->server aes128-ctr hmac-sha1 none
Apr  4 10:55:54 backup sshd[8571]: debug1: kex: server->client aes128-ctr hmac-sha1 none
Apr  4 10:55:54 backup sshd[8571]: debug1: expecting SSH2_MSG_KEXDH_INIT
Apr  4 10:55:54 backup sshd[8571]: debug1: SSH2_MSG_NEWKEYS sent
Apr  4 10:55:54 backup sshd[8571]: debug1: expecting SSH2_MSG_NEWKEYS
Apr  4 10:55:54 backup sshd[8571]: debug1: SSH2_MSG_NEWKEYS received
Apr  4 10:55:54 backup sshd[8571]: debug1: KEX done
Apr  4 10:55:55 backup sshd[8571]: debug1: userauth-request for user root service ssh-connection method none
Apr  4 10:55:55 backup sshd[8571]: debug1: attempt 0 failures 0

[jonlil]

Exactly same issue here

[reviyou]

same issue except I use RSA private key, I can ssh with putty using it, I can connect to the mongo from the server itself, I disabled the auth just for test purposes - robomongo SSH connection for client version v0.8.4 RC2 doesn't work for me..
no passphrase

[Glavin001]

I am also receiving this error.

[tirithen]

I have the same issue, unable to connect via SSH tunnel with private key. Is there any way to get a more verbose output than that it was unable to connect?

[VierenV]

I get also this issue, not able to connect to Mongo on Amazon ec2 instance through Robomongo whereas my credentials work with Putty (Private key ppk with passphrase).
Port 27017 is open on my instance and "bind_ip" param in MongoDB conf is disabled of course

Edit : Don't know if it's important, but i'm using Red Hat as Linux distribution

[jonlil]

To get around the issue until they solve it you can of course do the tunnel manually

ssh user@host -L <local port>27018:127.0.0.1:<destination port>27017

In robomongo

Host: 127.0.0.1
port: 27018

[njvitto]

Same issue here (and thx and lot @jonlil, very useful tip BTW ;))

[anlek]

Same issue here.

[pajtai]

same issue here - cannot get it to work with a private key

[vohtaski]

+1

[sublet]

+1

[eliecharra]

+1

[RanaNoureddin]

+1

[jaymecd]

same issue - rsa key, password protected

[VierenV]

To connect with Robomongo, use Putty.

Putty :
Menu : /Session

Connect with ssh : user@DNSname Port : 22 (server which hosts MongoDB)
If you need a key :
Menu : Connection/SSH/Auth
Browse.. >Select your key file (.ppk in my case, got with PuttyGen)
Click Open
Enter your passphrase if needed
You are connected now. Then, right click on the window border
Select Change settings
Go to Connection/SSH/Tunnels
Source Port : 27017 (Default MongoDB port)
Destination : 127.0.0.1:27017
Local & Auto selected

Now your local port 27017 is forwarded through your distant 27017 port, you can open Robomongo to connect local 27017. No authentication needed
Address : localhost : 27017

You're good to manage MongoDB with Robomongo !

[shlomisas]

+1

[tuo]

+1

[robocon]

I test on ubuntu 14.04(Vagrant+Puphpet) not using putty it work well

Connection

Address: 127.0.0.1
Port: 27017

SSH

SSH Address: 192.168.56.101
Port: 22
SSH User Name: vagrant
SSH Auth Method: Private Key
Private key: part_to_your_puphpet_folder/files/dot/ssh/id_rsa
Passphrase: 

[amitava82]

@robocon Works great, thanks!

[nhammond101]

i'm on ubuntu too and testing the connection (from the connection window) failed , but simply saving the settings and connecting worked

[jchamberlain]

+1 On a Mac. It acts like it's not using the tunnel at all, and instead trying to connect directly to localhost.

[ghost]

Hey, I just tried out the 0.8.5 os X release. It seems like ssh tunnel (with private key) still doesn't work.

[stennie]

@mchen-cb There haven't been any changes to this issue for 0.8.5, so I wouldn't expect any different outcome from previous releases.

[Jakobovski]

+1

[ddo]

+1

[ddo]

After trying some, it works for me now from home -> ec2.
My mistake is missing the ssh username which is "ubuntu" in my case

:+1:

[askilada]

+1

[jonlachlan]

This works for me. Make sure that the Connection is localhost:27101 (or whatever port you're using), and that your SSH Address has the actual host IP address. I'm using Ubuntu so "ubuntu" is the username, otherwise for Amazon it might be "ec2-user" or "root". For (It's whatever you use for your SSH connection.)

Thanks so much for this feature, now I can just SSH connect to my deployment DB and avoid setting up Mongo's outside connection settings.

[drujensen]

Verified that this is still not working with @jonlachlan 's suggestions. Connection is set to localhost:27017 and SSH Address is using the actual host IP Address. Also verified I can connect using ssh with username@ipaddress without requiring password. Verified the private key matches the public key on the server.

[jonlachlan]

Huh. My setup is similar. I presume it would be helpful for debugging to know what operating system you're on and what version of Robomongo you're using. I'm on a Mac using Robomongo 0.8.5
Here's my settings:
Connection tab -> address: localhost, port: 27017
Authentication tab -> "Perform Authentication" is turned off
Advanced tab -> Default Database is left blank
SSL tab -> "Use SSL Protocol" is not checked
SSH tab ->
"Use SSH tunnel" is checked
"SSH Address": first field is my server's IP address, second field is the port "22" as was default
"SSH User Name": ubuntu (my server's username)
"SSH Auth Method": Set to Private Key
"Private Key": Click the ... button to select your .pem file
"Passphrase": left blank

Then I click "Test" button and it says:

When I go to connect, it works just fine.

[drujensen]

@jonlachlan Thanks for your detailed response.

Everything looks exactly the same:
Mac using Robomongo 0.8.5
Connection tab -> address: localhost, port: 27017
Authentication tab -> "Perform Authentication" is turned off
Advanced tab -> Default Database is left blank
SSL tab -> "Use SSL Protocol" is not checked
SSH tab -> "Use SSH tunnel" is checked
"SSH Address": first field is my server's IP address, second field is the port "22" as was default
"SSH User Name": admin
"SSH Auth Method": Set to Private Key
"Private Key": Click the ... button to select your .pem file
"Passphrase": left blank

The exception is that I am using "~/.ssh/id_rsa" file which I generated using ssh-keygen -t rsa -b 2048 -C "[email protected]"

How did you get the .pem format for your private key? Did you manually convert it or did you use a different technique for generating your ssh pub/private keys?

[jonlachlan]

The pem file is what I downloaded from Amazon AWS originally. I think the pem format is required for the SSH Tunnel.

Try this:

openssl rsa -in ~/.ssh/id_rsa -outform pem > mydomain-key.pem

It will ask you for your password if you have one, then you should have your pem file. You can name it whatever you want.

[drujensen]

Once I saw that you were using .pem, I tried:
openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem

I also tried:
openssl req -x509 -key ~/.ssh/id_rsa -nodes -days 365 -newkey rsa:2048 -out id_rsa.pem

Unfortunately, neither worked.

[jonlachlan]

That's strange. Did you verify that the "out" file was in the .ssh folder? Did you update the file in the Robomongo settings? Obvious things, but just checking.

You can check that the ssh key file is working by using it in terminal

ssh -i ~/.ssh/id_rsa.pem [email protected]

[jonlachlan]

I just determined that the "Private Key" must be the full path, so

Users/yourself/.ssh/id_rsa.pem

not

~/.ssh/id_rsa.pem

[drujensen]

The full path fixed it! No .pem conversion necessary. @jonlachlan Thanks for your help on this. It's been over a year and you are the first to help us figure this out!

/Users/{yourself}/.ssh/id_rsa

[jonlachlan]

Yay! I'm really glad. Happy SSH-ing ;-)

[petek]

I just ran across this again, working on some hosts and not on others. After a bit of debugging, I ran across this in the ssh log:
Jun 17 16:31:06 xxx sshd[11935]: fatal: Unable to negotiate a key exchange method [preauth]
This is happening because of the server's KexAlgorithms settings, and RoboMongo not supporting the ones recommended by https://stribika.github.io/2015/01/04/secure-secure-shell.html
It would be helpful if ssh connection debugging could be provided when using an ssh tunnel and the connection fails due to that.

[Repox]

I'm on Mac what fixed the issue for me was basically copying my private key and give it the .pem extension. Nothing else.

cp ~/.ssh/id_rsa ~/.ssh/id_rsa.pem

I selected the .pem file as the private key for Robomongo it worked.

[scalastic]

@Repox : Yes, that's the trick on Mac !
And set an existing database name otherwise you'll be waiting very, very long........

[cburatto]

Solution from @VierenV using Putty worked just fine for me. Just one minor reminder to the steps in the end:

Connect with ssh : user@DNSname Port : 22 (server which hosts MongoDB)
If you need a key :
Menu : Connection/SSH/Auth
Browse.. >Select your key file (.ppk in my case, got with PuttyGen)
Click Open
Enter your passphrase if needed
You are connected now. Then, right click on the window border
Select Change settings
Go to Connection/SSH/Tunnels
Source Port : 27017 (Default MongoDB port)
Destination : 127.0.0.1:27017
Local & Auto selected
Click Add to add the port to the list

Also, remember to open your port to your IP (or all IPs) on the AWS security group for the instance.

[yelgulwa]

Works great. Thanks for the great product!

[fracasula]

Same issue here. It works just fine with MongoChef but it doesn't with Robomongo. I'm using a vagrant machine created with puphpet.com and I tried using both 127.0.0.1:2222 and the direct ip address 192.168.33.10:22. Unfortunately it doesn't work. Could it be because the vagrant private key has no passphrase?

Thanks for your efforts :+1:

[ayonliu]

@jonlachlan thanks, it's worked for me.

For me, the trick is:

Connection tab -> address: localhost, port: 27017

The "address" here is "localhost" or "127.0.0.1", not the server's IP address you want to access, because we're using SSH tunnel here.

[travism]

@petek is right also. Any server that is using best practices security for their supported openssh settings will probably also fail.

Please update robomongo to support key exchanges with the latest recommended settings.

[mpmadhuranga]

@ayonliu thankz .

[iancwinter]

Fix for me was to use the more complete path for the .pem file, i.e.:

/Users/[me]/.ssh etc.

…rather than:

~/.ssh etc.

(On OS X 10.11.2)

[anorsich]

@drujensen @travism @iancwinter @fracasula In the latest 0.9.0 RC8 release we reworked ssh tunnel from scratch. It is now much faster and worked seamlessly for during our testing phase. You can read more in the following blog post

Let us know if it worked for you, if there are any issues -- please re-open or create a new issue.

[zmirc]

Still doesn't work with 0.9.0 RC9.
Thanks @VierenV for helping. That worked.

[simsekgokhan]

Hi @zmirc , we are very sorry that it is not working. For us to investigate, can you please inform us about your local/remote OS version, SSH configuration you use and the error you are getting? (maybe a screenshot)

[zmirc]

Hi, @simsekgokhan
Here are my connection settings in RoboMongo 0.9.0 RC9
TAB Connection:

• some name
• localhost
• 27017

TAB SSH

• checked "Use SSH tunnel"
• address: IPv4 address of an internet reachable server
• address port: NOT 22 -> I'm using a custom SSH port
• username: (can't mention)
• method: Private key -> pointing to .ppk private key made with Putty on Windows 8 (my machine)
• no key pass

Local OS (my machine): Windows 8
Remote OS (server I wanted to connect): CentOS 7 latest version with latest updates
Remote Mongo: 3.2.9

I attached how it looks when I press "test".

I wish this helps.

[simsekgokhan]

@zmirc
Thank you very much for lots of useful information.

First of all, start with converting ppk file to OpenSSH format.
Open puttygen, Converstations -> Import Key, select ppk file, convert to OpenSSH key
Normally ppk file is for Putty and Robomongo should use OpenSSH format private key file.

Secondly, as I understand (not sure) your SSH server and mongodb server are the same Centos 7 machine. If so, use the same IP address on connection and SSH tabs but different ports of course. (Different IPs are used when port forwarding or SSH jump-server solutions are used)

If problem still exists, please send us Robomongo SSH logs.

How-to: Select the connection and press "shift+enter", and share the logs with us.

[zmirc]

@simsekgokhan
Thanks for the OpenSSH tip. It seems to work now. Great!!!

Maybe mention it somewhere in the user interface. Other tools that I use support Putty's format, that's why I put that one without even thinking about.

[clearride]

@ayonliu after all the over analysis seems the fix was simple ;-), thanks for saving my time

[abenedetti]

@simsekgokhan

OpenSSH conversion worked here as well! You've put an end of a 2 days search !!🥇

[simsekgokhan]

@abenedetti
Happy to hear that. Thanks for the feedback ; )

[mdkshuvo]

I have not been able to successfully connect to remote server

[nervgh]

I have not been able to successfully connect to remote server

I have same issue.

[yo2boy]

Had the same issue with Robo3T (rebranded Robomongo).

The putty thing worked but I don't understand why.

[RoboSparrow]

This tip may sound incredibly stupid: Make sure you don't have trailing whitespace in your ssh address and connection name fields.

[drakontas]

This is seriously still not fixed after almost 4 years? You guys may want to remove the feature from the app altogether if you're not going to bother fixing it 👎 Tried a successful tunnel connection with the exact same file and settings using Mongo Compass and it works fine, definitely not an issue with my key file or settings. Windows 64-bit version, Windows 10 Enterpise.

[gelldur]

In my case I have problem with port forwarding on my serwer simply replace 127.0.0.1 with localhost

1. Open tunnel
   ssh -vvvL 27020:localhost:27017 username@my_host
2. Then simply connect in Robo to localhost on port 27020

[rvdende]

Found the issue on linux and fix.

Copy your private key up to home and add an extension like this:

cp ~/.ssh/id_rsa ~/id_rsa.ssh

Then use the new file and it works. So the error seems to be when using folders with leading dot, and/or filename without extension.

[niy]

This could also be a key incompatibility issue as reported in #1590 and #1189 , Some users were able to fix the problem by regenerating their ssh private keys using RSA. So if your using Ed25519 algorithm for your private keys, it probably won't work here.

btw @fluentart suggestion fixed the issue for me.

[davNazaryan]

Hi. Had the same issue on Windows 10 and Robo 3T 1.2.1
It seems that we need to use a pure private key instead of PuTTY .ppk key.
Note: As I understand it's not the only issue with Robo 3T SSH tunnel, but for those who tried to use .ppk file it may help.

1. Open PuTTYgen ( It must be installed with PuTTY )
2. Load your .ppk file there.
3. Click on Conversions
4. Then on Export SSH key
   
   
   
   • 
   
   
5. Save the file. ( key_private_pure in our example )
   
   
   
   • 
   
   
6. Use it instead of .ppk file for SSH tunneling in Robo 3T
   
   
   
   • 
   
   

[krishnadevhub]

On my situation, I had to do few configurations on my Ubuntu 18 Vagrant box in order to successfully connect MongoDB remotely using Robo 3T GUI. I've explained in the following steps.

1. On Ubuntu server, to open mongo shell run:
   $ mongo

2. Inside mongo shell, type following command to create new a admin user.
   ````

   use admin;
   db.createUser({user:"admin", pwd:"password", roles:[{ role: "root", db: "admin" }]});
   ````

3. By default mongodb is configured to allow connections only from localhost(IP 127.0.0.1). We need to allow remote connections from any ip address. The following change should only be done in your development server. Open up etc/mongod.conf file and do the following change.

   ````

   network interfaces

   net:
       port: 27017
       bindIp: 0.0.0.0   #default value is 127.0.0.1
   

   ````

   Also in the same mongod.conf file uncomment security option and add authorization option as shown below.
   security: authorization: enabled

4. Save and exit the mongod.conf file and restart mongodb server.
   $ sudo servcie mongod restart

5. Download and install Robo 3T GUI tool.

6. On Robo 3T GUI, in the connection settings, you need to do few changes as shown on
   below screen shots.

Enter mongodb admin database username and password which you have created earlier.

Here, I have entered my Ubuntu 18 Vagrant box ssh credentials.

Save the changes and press connect icon to see if the connection is working fine.

I hope above details would give some help to your situation.

[brieucdlf]

Have the issue as well ... Tried your solution @fluentart but not working :(
I'm going to try to regenerate my key !

[fritzfr]

For people on macOS this should work:

/Users/YOURUSERNAME/.ssh/id_rsa

[AsterixMechant]

Found the issue on linux and fix.

Copy your private key up to home and add an extension like this:

cp ~/.ssh/id_rsa ~/id_rsa.ssh

Then use the new file and it works. So the error seems to be when using folders with leading dot, and/or filename without extension.

This fixed it for me!