Tag Info

Hot answers tagged

17

After setting up password-less ssh, I was still asked for my user password. Looking at /var/log/auth.log on the remote machine pointed out the issue: sshd[4215]: Authentication refused: bad ownership or modes for directory /home/<user> So, make sure to have it right: chmod o-w ~/ chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys While forbidding ...


15

Just make sure that you have followed the following procedure: On Machine A open a terminal and enter the commands as follows: root@aneesh-pc:~# id Just to make sure that we are root. If the above command output something like below we are root else switch to root using the su command uid=0(root) gid=0(root) groups=0(root) 1) Create the keys. ...


10

Even if agent is up, if certain environment variables are not set, you have no reference to agent. Furthermore, even if it is all ok, agent and variables, the identity are not automatically sent to agent: that is a task for ssh-askpass, working only in X sessions. If you are using bash, create the file ~/.bash_profile with this content: # File: ...


9

Yes. you can enable agent-forwarding by adding ForwardAgent Yes in your ssh configuration file (either ~/.ssh/config for user or /etc/ssh/ssh_config system wide. See also http://drupal.txwikinger.me.uk/content/configurations-ssh-make-some-things-more-convenient. Alternatively, if ssh is called with the option -A, the agent forwarding is also enabled as ...


9

This is all gathered from website and stackoverflow, hope this helps who are new to ssh so you can have many ssh keys ~/.ssh$ ls yyy_id_rsa yyy_id_rsa.pub id_rsa id_rsa.pub known_hosts Note: we need to add then to the ssh-agent, probably id_rsa will be added so we need to add the other private key ~/.ssh$ ssh-add yyy_id_rsa now we have added both ...


7

I worked out a solution for this via the bash shell. Add to .bashrc: check-ssh-add() { if [ "$DESKTOP_SESSION" == "" ]; then if [[ `ssh-add -l` != *id_?sa* ]]; then ssh-add -t 5h ## 5 hour ssh-agent expiration fi fi } slogin() { check-ssh-add /usr/bin/slogin $@ } ssh() { check-ssh-add /usr/bin/ssh $@ } scp() { check-ssh-add /usr/bin/scp $@ } ...


6

It seems your home directory or the place where your keys are, is encrypted. The first login mounts and decrypts the directory letting the ssh daemon use the keyfile. Solution for that is to move the "authorized_keys"-file to a device where it is not encrypted by default. After that you have to point the ssh daemon to that place. The following ...


6

Probably just a higher level permissions problem. You need to remove write permissions from group and other to your home directory and .ssh directory. To fix these permissions, run chmod 755 ~ ~/.ssh or chmod go-w ~ ~/.ssh. If you're still having problems, issue the following grep on your log: sudo egrep -i 'ssh.*LOCAL_USER_NAME' /var/log/secure ...


6

From man ssh-add: ssh-add adds private key identities to the authentication agent, ssh-agent(1). When run without arguments, it adds the files ~/.ssh/id_rsa, ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/identity.[...] Identity files should not be readable by anyone but the user. Note that ssh-add ignores identity files if they ...


5

Background Original Reference: http://peterpetrakis.blogspot.com/2013/06/automating-and-encrypting-duplicity.html Having suffered data loss in the past and hacking on storage suggests that it's a good idea to have regular backups. I wanted redundancy in case my local server failed and I wanted to encrypt my backups using a password protected gpg key. The ...


5

I'm not sure why people attempt to solve this at the terminal multiplexer configuration level. That's not a place for it, unless you want to have to do it again because you've switched to tmux, screen, etc. Every time you open another window, your shell gets executed and reads its configuration files. Sourcing this from your shell configuration file solves ...


5

I addition to what txwikinger said, you can also just use the -A command line option when SSHing to your firewall.


4

Unsetting SSH_AUTH_SOCK is a workaround, but doing so disables ssh-agent, which some people might still want to use. It seems that ssh-agent can't sign anything with the private key because it doesn't properly decrypt it when automatically adding this key to the keyring. If one generates the standard id_rsa identity file in ~/.ssh, or stores a private key ...


4

Not a direct answer to the above question, but a work around for the core problem: Stop gnome-keyring ssh-agent from starting. Then ssh-agent, ssh-add and ssh works as expected. (Or at least as I expect). To stop gnome-keyring ssh-agent from starting do: sudo mv /etc/xdg/autostart/gnome-keyring-ssh.desktop ...


3

The ssh client will check all your keys until it finds one that matches. This is how it works (this is very simplified, before this a quite complex dance has been made to encrypt all of this): The server creates an auth token. The token is encrypted using your public key on the server. The server send the encrypted token to the client. The client tries to ...


3

I don't know the internals so to explain why in GNOME it works and in KDE it doesn't, but I can suggest a solution. Define a function like the following in your ~/.bashrc: ssh() { if ! ssh-add -l &>/dev/null; then ssh-add </dev/null &>/dev/null fi command ssh "$@" } i.e., if the agent has no key stored already (! ...


2

The program your coworker is looking for is ssh-askpass: under X, asks user for a passphrase for ssh-add This is integrated into Gnome in the package ssh-askpass-gnome (which will interface with Gnome Keyring, so you can save the ssh key decryption password in the keyring, and it will be supplied as needed) - note that it should already be installed if ...


2

I recently started using ssh-ident: https://github.com/ccontavalli/ssh-ident all you have to do is add something like: alias ssh="/path/to/ssh-ident" in your .bashrc. Alternatively, you can ln -s /path/to/ssh-ident ~/bin/ssh or some other directory in your PATH before /bin and /usr/bin.


2

This issue is detailed in Bug #664059, and solved for byobu versions 3.7 and above. Basically, there is an incorrect assumption that /var/run/screen/S-$USER/ will exist and be writable at the point at which the SSH socket needs to be set. So I moved the symlink to the SSH socket to $HOME/.byobu/.ssh-agent.


2

Assuming that you have copied the public key to the authorized_keys file on the remote machine, the ssh client will check whichever private key on the local machine matches the public key on the remote machine.


2

It turns out that if gnome compatibility is turned on in xfce, xfce4-session will unconditionally start gnome-keyring-daemon. This is hardcoded, there is at the moment no way to configure this. Disabling the gnome compatibility mode results in keyring not starting on login and you will need to provide your password again if you start it. The simplest ...


1

Here's a less invasive version of the script JanKanis posted. It accepts whatever components were passed to it, but yanks out the SSH component. #!/bin/bash ARGS="$@" COMPONENTS="" if [[ $ARGS =~ \-\-components= ]]; then component_match_expression='(\-\-components=([0-9a-z,]+))' COMPONENTS=$(echo $ARGS | grep -oP "$component_match_expression") ...


1

So turns out this is a result of deciding to encrypt my home directories, and placing the auth-sock there... This means when I fully detach from screen, my running programs lose access to my home directory, which breaks ssh-agent. It doesn't kill the ssh-agent process like deleting the socket normally does, and it doesn't remove the socket because it's in an ...


1

It is started in /etc/X11/Xsession.d/90x11-common_ssh-agent. The files in /etc/X11/Xsession.d/ are run from /etc/X11/Xsession by display managers (like lightdm or gdm) after a user logs in and by xinit.


1

Manually changing SSH_AUTH_SOCK does not work for me, but the flag -p helped in my case. Steps: Copy 10mount-ssh as you did. ssh-add at host schroot -p -c <chroot> --automatic-session, so chroot should have the same environment variables as the host (due to -p flag). hg clone ssh://<login>@<host>:<repo> - command (from chroot) is ...


1

Copied/pasted from ssh_config(5) in openssh-client 1:5.3p1-3ubuntu7: IdentityFile Specifies a file from which the user's RSA or DSA authentication identity is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol version 2. Additionally, any identities represented by the authentication ...


1

I assume you followed the linked article and modified your ~/.bashrc. However ~/.bashrc might never be sourced when you're running a command from a panel launcher. An easy way to debug is adding date > /tmp/bashrc_sourced to then end of your ~/.bashrc and check if the current time is printed to the file when you invoke the panel launcher. Related note: ...


1

Run ssh-add in a terminal, and type in your passphrase when prompted. If this works, then every subsequent access to your ssh key should just work without any prompting, in all terminals and applications running in the same X session.


1

There is a bug report #616899 which sounds similar to your problem. They suggest to download byobu v3.1 and manually install it.


1

Using ssh-keygen creates a key ~.ssh/id_rsa or ~.ssh/id_dsa. These are the default file locations for ssh keys and are read in automatically. Use ssh-add when you need to add extra keys. If you don't want a default key simply name your keys something other than id_rsa. This can be done when generating ssh-keygen -f keyname or simply by renaming the file.



Only top voted, non community-wiki answers of a minimum length are eligible