Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My machine recently stopped accepting incoming public key authentication. I have an ubuntu 11.04 desktop that I ssh into from a windows machine. I use putty with pageant. I am able to connect but only with interactive password authentication, not with my rsa key that I have setup.

I have already verified that the key is listed in ~/.ssh/authorized_keys. How do I fix this and what do I check?

share|improve this question
    
First check that all three of ~, ~/.ssh and ~/.ssh/authorized_keys are only writable by you (in particular no group write permission). Look in /var/log/auth.log for log entries created at the time of your login attempts. Copy-paste them into your question (editing out names for privacy if you like). Also check whether the problem is purely on the server side or not: copy the private key over to the Linux machine (you'll need to convert PuTTY's private key file into the OpenSSH format) and see if ssh localhost works. –  Gilles Oct 20 '11 at 14:12
    
my home directory was writable for some reason. That fixed it. Put it as an answer so I can accept it. –  Andrew Redd Oct 20 '11 at 17:46
add comment

7 Answers 7

up vote 11 down vote accepted

If public key authentication doesn't work: make sure that on the server side, your home directory (~), the ~/.ssh directory, and the ~/.ssh/authorized_keys file, are all writable only by their owner. In particular, none of them must be writable by the group (even if the user is alone in the group). chmod 755 or chmod 700 is ok, chmod 770 is not.

What to check when something is wrong:

  • Run ssh -vvv to see a lot of debugging output. If you post a question asking why you can't connect with ssh, include this output (you may want to anonymize host and user names).
  • If you can, check the server logs in /var/log/auth.log.
  • If public key authentication isn't working, check the permissions again, especially the group bit (see above).
share|improve this answer
    
(from the U&L tag wiki, copied to AU) –  Gilles Oct 20 '11 at 18:02
    
@RexLogan That's what my first sentence says... –  Gilles Apr 26 '12 at 18:05
add comment

I would ensure that you have your settings in /etc/ssh/sshd_config correct.

To force the use of PKI only and to disallow passwords find the line

#PasswordAuthentication yes 

in your file, uncomment it and set it to

PasswordAuthenticate no

I would also read through the balance of the settings to ensure they make sense. In particular, try to ensure that you use RSA keys since DSA is know to be compromised.

share|improve this answer
5  
You're explaining how to disable password authentication. This won't help make public key authentication work (the public key is tried first). Andrew: do not disable password authentication until you're sure public key authentication works! –  Gilles Oct 20 '11 at 14:14
add comment

I ran into the same thing and finally figured out that it was because I encrypted my home directory. SSH can't read the authorized_keys file until you log in, so basically it forces you to password authenticate first. See the troubleshooting section of the following:

https://help.ubuntu.com/community/SSH/OpenSSH/Keys

share|improve this answer
add comment

If you check the permissions on the directories, and there is a "." right after them, then you may have selinux enabled, which will mess w/ the key exchange, and default to manual password identification.

You can disable SELinux to troubleshoot by following the instructions here: http://www.centos.org/docs/5/html/5.1/Deployment_Guide/sec-sel-enable-disable-enforcement.html, or just edit the /etc/selinux/config file and change it from "enforcing" to "disabled".

Hope this helps.

share|improve this answer
add comment

I fixed this problem by un-commenting "PasswordAuthentication yes" in /etc/ssh/sshd_config.

share|improve this answer
add comment

Due to a need for troubleshooting communication between two different machines, I had two private keys in ~/.ssh on the client side.

Instead of configuring each server host with the respective private key in ~/.ssh/identity as I should have done, I had the secondary (and in this case wrong) key configured for all hosts:

Host *
IdentityFile ~/.ssh/identity_b

Correcting ~/.ssh/identity resolved the issue:

Host a
IdentityFile ~/.ssh/identity_a
Host b
IdentityFile ~/.ssh/identity_b
share|improve this answer
add comment

Somehow this worked for me:

root@kaiser:~# vim /etc/ssh/sshd_config

Change this line from yes to no 28 StrictModes no

Try again

sysadmin@suselinux1:~> con sysadmin kaiser Welcome to Ubuntu 12.04.1 LTS (GNU/Linux 3.2.0-25-generic i686)

Last login: Fri Nov 9 15:40:11 2012 from 10.1.3.25 sysadmin@kaiser:~$ date vie nov 9 17:53:11 CST 2012 sysadmin@kaiser:~$

share|improve this answer
    
Doing something without knowing what it does and why it works may be acceptable, but suggesting the same is bad, and to be fair, worse if it deals with a security system. –  Mahesh Nov 10 '12 at 5:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.