I've searched through all topics I could find on this but can't get it to work. I've used keygen to create the keys, copy-id to send to server and changed all the permissions on server per other posts. I'm not seeing permission errors or authentication errors either but maybe I need to enable more debugging? Here is a part of the debug log:

debug1: Offering public key: RSA SHA25******* /home/mike/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: password

wondering about the line "we did not send a packet, disable method? I can log in with password after that.

Server is: Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-47-generic x86_64)

Here is my sshd_config:

#       $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port 2200
#AddressFamily any
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH

# Authentication:
AllowUsers mike
LoginGraceTime 60
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
AuthorizedKeysFile      ~/.ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
PrintLastLog no
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
MaxStartups 2
ClientAliveInterval 600
ClientAliveCountMax 0
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem       sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server
  • 1
    Try changing the line AuthorizedKeysFile ~/.ssh/authorized_keys to AuthorizedKeysFile .ssh/authorized_keys and restart the sshd service. – user68186 Apr 11 '19 at 13:47
  • 1
    You must PasswordAuthentication no in order to disable the passwd auth and then restart sshd. But be careful, IMO you have not successfully copied your .pub key into the serve's ~/.ssh/authorized_keys... you should be able to connect to the server with your key no mater the passwd auth is enabled or disabled.... Probably you need to use quotes when you copy the id, when the ssh port is modified: ssh-copy-id "<username>@<host> -p <port>" (this is old bug, mentioned also somewhere in Ubuntu documentation, but IMO it still active). – pa4080 Apr 11 '19 at 13:53
  • 1
    @pa4080 I would not set PasswordAuthentication no until I can successfully login without using the password (pubkey authentication). I have tested public key authentication successfully without setting PasswordAuthentication no. Since OP is being asked for password, it tells me that either the public key has not been copied in the right place (or not at all), or it has the wrong permissions, or the sshd is looking for the public key in the wrong place and can't find it. – user68186 Apr 11 '19 at 14:35
  • @user68186 I will try this and report results. I have succesfully used keys to log in from my laptop to another ubuntu 18.04 desktop without changing PasswordAuthentication no – Mike77 Apr 11 '19 at 15:25
  • Thanks for picking that up @user68186. I added your solution as the correct answer. I see now that is shown that way in the man page link – Mike77 Apr 11 '19 at 17:14

Changing the line AuthorizedKeysFile ~/.ssh/authorized_keys to AuthorizedKeysFile .ssh/authorized_keys and restarting the sshd service worked.

| improve this answer | |
  • Great! Now that you have correctly answered the question accept your answer by placing the green check mark next to it (after the waiting time). This will help others with the same problem. – user68186 Apr 11 '19 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.