3

I have an interesting problem with ssh. Here is the setup.

My client (running Ubuntu 17.04) has public and private ssh keys. I copied over the public key to the server (running Ubuntu Server 16.04.3 LTS) using the ssh-copy-id command. I verified this worked by looking at the authorized_keys file on the server; my client's public key is the only one listed.

Now onto the problem. I am able to login to the server from the client through ssh, using my private ssh-key. But after I logout and attempt to ssh again, I get the following error:

Permission denied (publickey).

When I login to the server at the console, I use my password to login and it works fine. Then when I try to SSH again from my client, it works again. And I can logout and login as many times as I want. As soon as I logout from the console on the server (like I'm physically at the server logged in before this), I can SSH from my client exactly ONE more time. Then as soon as that session is ended, I get the Permission denied (publickey).error again on all subsequent SSH attempts. Any ideas?

Here is my ssh config file on my client:

Host sauron
        HostName 192.168.1.191
        User joe
        PubKeyAuthentication yes
        IdentityFile id_rsa

One more thing to mention is I do have the entire SSD on the server encrypted. I have to unlock it whenever I boot the server with an encryption password. Not sure if that's relevant. I suspect it could be a permissions issue, though I'm not sure of that either. Suggestions would be much appreciated, and please ask if you need clarification on anything.

4
  • Are individual home directories encrypted in addition to full-disk encryption?
    – muru
    Aug 24, 2017 at 3:02
  • I checked my home folder and see there is a .ecryptfs folder in there, so I would say yes there is encryption at the home directory level.
    – jeklund
    Aug 24, 2017 at 3:20
  • Your comment led me to an article that showed how to move the authorized_keys file to a location that was not encrypted and then source it with the sshd_config file. That fixed it! I am now able to login with ssh keys remotely and with no password. If I require access to the encrypted home directory, I still need to type in my user password, but this is to be expected.
    – jeklund
    Aug 24, 2017 at 4:28
  • great! If you could summarize what you did following that article, that would be helpful for future reference
    – muru
    Aug 24, 2017 at 4:30

1 Answer 1

1

Thanks to @muru comment about encrypted home directories, I was led to this article about how to deal with this.

The TLDR; of that article is as follows and fixed my problem:

  1. Create a directory in /etc/ssh/ with the same name as the login user you are using. In my case: /etc/ssh/joe.

  2. Copy the authorized_keys file to this directory.

  3. Set correct permissions of this file and directory to the user.

  4. Add the following line to the sshd_config file:

AuthorizedKeysFile /etc/ssh/%u/authorized_keys

  1. Restart SSH.

All fixed!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .