Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using ssh-keygen to generate a key on Ubuntu 10.10, then using ssh-copy-id to copy the key to two remote machines that are running 10.04 (one desktop, the other server).

But here's the thing: I can SSH into the desktop without a password, but then some time later I'm asked for a password again. The server always asks for a password and never lets me login with my key.

I've checked permissions on the .ssh folder, the authorized_keys file, my id_dsa and my id_dsa.pub on all hosts, and they're inline with what the Ubuntu documentation suggests. I've even copied my keys using scp and gasp set permissions to files and folders to 777 just to rule out any permission issues.

Does anyone have a foolproof way of setting up SSH keys on Ubuntu for password-less SSH access before I change profession and become a flower arranger?

share|improve this question
2  
+1 for the question, as well as that last line. – James Apr 14 '11 at 11:22
    
You might have a permission issue still; Your keys will not work unless they are readable by the owner only. Giving them weaker permissions only ensures that they will not work. – Egil Apr 14 '11 at 11:31
    
Tried that. As I said, I changed permissions to what the guide said and then tried 777. Still doesn't explain why it works for a while, then stops... – roboplegicwrongcock Apr 14 '11 at 11:53
    
Have you tried running tail -f /var/log/auth.log on the server while you log in to see if sshd logs any helpful information? – Egil Apr 14 '11 at 12:42
up vote 5 down vote accepted

First of all, I suggest, if you can, to remove+purge, then reinstall openssh-client/server on the three machines, and remove each ~/.ssh, so that you start from a clean situation.

Next, follow this ubuntu wiki page that treats more specifically of ssh keys configuration.

Last, keep in mind the following issue: from debian ssh wiki:

Login without password does not work if group or world has write permissions for the home directory on the remote machine.

share|improve this answer
1  
It was a permissions thing. Bad ass, thanks bud. – roboplegicwrongcock Apr 14 '11 at 16:01

The operation of ssh is governed by a twisty maze of a couple dozen configuration files spread across ~/.ssh and /etc/ssh on both the client and server machines all different.

And the Pluggable Authentication Module (man 7 PAM) joins in the party for extra kicks.

I will give a nickel to anyone who can explain the precise semantics of all these interacting mechanisms as I've never bothered to spend a day figuring them out.

share|improve this answer
    
So here's the thing: I need password-less access for a bit of software I'm using. If a login attempt is followed by a password prompt, the software breaks. I have no way to change this mechanism, so using SSH keys is a must. Or I'm going to start looking at petunias. – roboplegicwrongcock Apr 14 '11 at 12:25

Instead of changing the permissions of my home folder, changing the permissions for the ~/.ssh folder solved my problem according to this.

share|improve this answer

http://linuxproblem.org/art_9.html

Following is what worked for me on 16.04

Your aim

You want to use Linux and OpenSSH to automate your tasks. Therefore you need an automatic login from host A / user a to Host B / user b. You don't want to enter any passwords, because you want to call ssh from a within a shell script.

How to do it

First log in on A as user a and generate a pair of authentication keys. Do not enter a passphrase:

a@A:~> ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/home/a/.ssh/id_rsa): Created directory '/home/a/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/a/.ssh/id_rsa. Your public key has been saved in /home/a/.ssh/id_rsa.pub. The key fingerprint is: 3e:4f:05:79:3a:9f:96:7c:3b:ad:e9:58:37:bc:37:e4 a@A Now use ssh to create a directory ~/.ssh as user b on B. (The directory may already exist, which is fine):

a@A:~> ssh b@B mkdir -p .ssh b@B's password: Finally append a's new public key to b@B:.ssh/authorized_keys and enter b's password one last time:

a@A:~> cat .ssh/id_rsa.pub | ssh b@B 'cat >> .ssh/authorized_keys' b@B's password: From now on you can log into B as b from A as a without password:

a@A:~> ssh b@B A note from one of our readers: Depending on your version of SSH you might also have to do the following changes:

Put the public key in .ssh/authorized_keys2 Change the permissions of .ssh to 700 Change the permissions of .ssh/authorized_keys2 to 640

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.