sftp only account: access via putty/winscp not working

Question

I set up a sftp only account some months ago.

I took roughly this guide: https://wiki.archlinux.org/index.php/SFTP_chroot

Access from linux is possible.

Now someone wants to access the sftp account via WinScP.

I did it according to these docs: https://winscp.net/eng/docs/guide_public_key

I created a public/private key pair via WinSCP and created the public key for the authorized_keys file with this command:

puttygen -O public-openssh -o foo.pub foo.ppk

I added the line of foo.pub to ~modsftp/.ssh/authorized_keys like usual.

Passwordless access from linux works, but not via putty/winscp:

===> psftp -i foo.ppk modsftp@remote-host
Using username "modsftp".
Server refused our key
Using keyboard-interactive authentication.
Password: 

On the ssh server I just see this line:

sshd[26281]: Connection closed by 10.111.44.33 [preauth]

I am clueless why it works via openssh commandline tools, but not via putty/winscp.

Answer 1

Problem solved: PEBCAK (problem exists between chair and keyboard).

Access via openssh tools worked, because the used my ssh-agent and not the -i foo command line argument :-)

Adding the public-key to ~modsftp/.ssh/authorized_keys was useless in this case.

If I did disable the ssh-agent like this (setting SSH_AUTH_SOCK to an empty string), it did not work for openssh tools, too:

SSH_AUTH_SOCK= sftp -i foo modsftp@remote-host

I turned on LogLevel DEBUG in sshd_config and saw the issue in the log file:

sshd[30819]: debug1: matching key found: file /etc/ssh/authorized_keys/modsftp, line 1

BINGO: sftp-only setup is different than normal ssh accounts. The authorized_keys are stored in a different file.

Issue solved. I hope this question+answer will help other people with similar issues.