Today we needed to sFTP to a remote server. The remote server administrators didn't want us to send them the user's public key; instead, they asked the user to perform an initial connection, that was refused, then somehow "imported" the public key that had been "offered" during that connection.
How is this possible, and how could I achieve the same?
Note: the client version string is SSH-2.0-OpenSSH_6.9.
Note2: the remote software identifies itself as XFB.Gateway.
Note3: this method worked and our user is now able to access the sFTP server.
Note4: the issued command was sftp -v -o IdentityFile=my_id_rsa u0005fa@ip.
From what I know, I can only see fingerprints of the public keys. If someone had asked me, I would have answered the same as this other user wrote here. Does the key exchange work differently? Are clients transmitting their full public keys? In what phase?
In this other answer, a blog post is mentioned where someone describes creating their own custom Java ssh server software in order to capture clients' public keys. I tried it out, and it tells me:
john trying to authenticate with RSA MIIB..........
Now, from what I learned in this answer, MIIB would be the beginning of a 768 bit private key, while I was instead expecting to see a public key starting with AAAAB3NzaC1yc2E and corresponding to my test 2048 bit RSA private key. Is this just another format that can be converted to the ssh-rsa standard?
Are there other tools (possibly not Java-based) that accomplish the same task?
