3

I am trying to login to an Ubuntu server from another Ubuntu machine via key.

What I did on client:

ssh-keygen -t rsa # generate ssh key

And on the server /etc/ssh/sshd_config:

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024


# Logging
SyslogFacility AUTH
LogLevel DEBUG3

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile     /etc/ssh/keys/%u/autherized_keys2

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

Match User MyUser
    PasswordAuthentication no
Match all

/etc/ssh/keys/MyUser/autherized_keys2:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRcr3RQzythTCGfICWqMMGlPRLCBzZi9Wq/1+3+lhQofhcvj6p93/pXNR/SfeDYAnRa51MgU3nwa90CcJuNsZkUIY8PFStu0Uw3fkGkitpBJ10ACRyg4yMT0OGtDe5zOVJlkmZNNn5rAjYZ4xiTdZIZ55/UgMwTL2u7w+p0ET/ankajaW5KwuRdZLI4+PSZHJ94ZtvwyY8DEIDVYoIpp5j2m7QJCmrEc4PBWbxTExSQlD6ONwGlBECwCbxXE2jRBxu4Ox7m6XzKtlLytVOFX8g+K2tnyurYo0Nvi14GXweOdiYQtcbJYsh7QsfzH230yzxXT1MaOWaMzgXTO5WgusZ MyUser@Infra-L-Omer-a-Ubuntu

which is exactly the same as id_rsa.pub in client. the output in client try to login (-vvv verbose mode):

$ sudo ssh -vvv -2 -o StrictHostKeyChecking=no -i /home/MyUser/.ssh/id_rsa MyUser@***.**.**.** -p 555 # the command to log in [** is my IP]
OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "**.**.**.**" port 555
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to **.**.**.** [**.**.**.**] port 555.
debug1: Connection established.
debug1: identity file /home/MyUser/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/MyUser/.ssh/id_rsa-cert type -1
debug1: identity file /home/MyUser/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/MyUser/.ssh/id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to **.**.**.**:555 as 'MyUser'
debug3: put_host_port: [**.**.**.**]:555
debug3: hostkeys_foreach: reading file "/home/MyUser/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/MyUser/.ssh/known_hosts:7
debug3: load_hostkeys: loaded 1 keys from [**.**.**.**]:555
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:WOX/Lg+OQsBxFeIEh7jOZ/2005b4uVe+Ox/39/6MfCA
debug3: put_host_port: [**.**.**.**]:555
debug3: put_host_port: [**.**.**.**]:555
debug3: hostkeys_foreach: reading file "/home/MyUser/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/MyUser/.ssh/known_hosts:7
debug3: load_hostkeys: loaded 1 keys from [**.**.**.**]:555
debug3: hostkeys_foreach: reading file "/home/MyUser/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/MyUser/.ssh/known_hosts:7
debug3: load_hostkeys: loaded 1 keys from [**.**.**.**]:555
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:WOX/Lg+OQsBxFeIEh7jOZ/2005b4uVe+Ox/39/6MfCA.
Please contact your system administrator.
Add correct host key in /home/MyUser/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/MyUser/.ssh/known_hosts:7
  remove with:
  ssh-keygen -f "/home/MyUser/.ssh/known_hosts" -R [**.**.**.**]:555
Password authentication is disabled to avoid man-in-the-middle attacks.
Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug2: key: /home/MyUser/.ssh/id_rsa (0x556c348b7200), explicit
debug2: key: /home/MyUser/.ssh/id_rsa (0x556c34904110)
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey
debug3: authmethod_lookup publickey
debug3: remaining preferred: ,gssapi-with-mic,publickey
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/MyUser/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: /home/MyUser/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

What do I have to change in order that the key verification will work?

4
  • Please provide the exact command you use to ssh in.
    – Jeremy
    Apr 23, 2018 at 11:09
  • Thanks, did you copy the private key created by the first command to the server?
    – Jeremy
    Apr 23, 2018 at 11:18
  • Not the private key ,the public key, the command create id_rsa private key, and id_rsa.pub the public key I copied Apr 23, 2018 at 11:51
  • Indeed, sorry, my mistake. Not sure what the issue is, best just to follow a guide beginning to end.
    – Jeremy
    Apr 23, 2018 at 12:25

2 Answers 2

2

This is how I connect from a pc to a server:

pcuser@pchostname:~$ssh-keygen

Creates two files in /home/pcuser/.ssh/ called id_rsa (private key) and id_rsa.pub (public key)

Create a file, if it doesn't exist yet, called /home/pcuser/.ssh/config and add the information of your server:

Host myserver
  HostName myserverIP
  User myserverUser
  Port 22
  IdentityFile ~/.ssh/id_rsa

Port 22 and IdentityFile ~/.ssh/id_rsa are the default values. You only need to specify them if you use something different from the default.

Now copy the public key of your pc to your server. You will be asked to store it as known host and asked for the server user password

pcuser@pchostname:~/$ssh-copy-id  -i ~/.ssh/id_rsa.pub myserver

You can now ssh to your server with

pcuser@pchostnamme:~/$ssh myserver

It shouldn't ask for the password anymore.

Have a look at the ssh configuration file documentation for more options. Some interesting options (although they can be insecure) are:

Host *
 StrictHostKeyChecking no
 UserKnownHostsFile=/dev/null
 ControlPersist 8h

Which are written at the end of the config file and apply to all the hosts that don't have those settings explicitly set earlier in the file.

0

Probably you changed the IP of the server to an already known connection.

The warning says:

REMOTE HOST IDENTIFICATION HAS CHANGED!

You can fix it like it is stated:

ssh-keygen -f "/home/MyUser/.ssh/known_hosts" -R [...]:555

And the retry connecting.

Not the answer you're looking for? Browse other questions tagged .