Unable to connect to basic ubuntu ssh server with password authentication - permission denied publickey

Question

Title says it all. I followed this guide to the letter: https://linuxize.com/post/how-to-enable-ssh-on-ubuntu-20-04/ However at the end I was unable to ssh to ubuntu - I get permission denied (publickey). So I went into my sshd_config and modified the following: PermitRootLogin yes PubkeyAuthentication no PasswordAuthentication yes PermitEmptyPasswords no

everything else I left defaulted from a fresh install of ssh server. However, I still cannot log in via ssh, as I get Permission denied (publickey). I find this odd, considering I have explicitly disabled public key authentication. I even tried using the following ssh command: ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no myuser@myserver

However I still get the same result. What on earth am I missing? This seems like it should work. This is in ubuntu 20.04

Answer 1

I had this issue trying to connect from mint 20.04 to an ubuntu 20.04 server. The sshd_config was set up just as you descried on the server.

If you try ssh -v user@hostname you may see it trying a bunch of authentication keys, even though they are not in the config and you're not using the -i at the command line. It keeps trying different keys it finds until the server gets annoyed and closes out the connection.

In this case, try disabling public key authentication on the client (temporarily, one-shot at the command line):

ssh user@servername -o PubkeyAuthentication=no

After doing this, it prompted for a password and successfully logged in. I was also able to use sshpass -pMYPASSWORD ssh user@servername

Example output:

$ sshpass -p<password> ssh -v  <user>@<servername> 
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /home/<user>/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to <servername> [<servername>] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/<user>/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4
debug1: match: OpenSSH_8.2p1 Ubuntu-4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to <servername>:22 as '<user>'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:r2Ra44NtKxs4WPYKroLMETpd2ebGxUwiKuJdCLqX3fM
debug1: Host '<servername>' is known and matches the ECDSA host key.
debug1: Found key in /home/<user>/.ssh/known_hosts:33
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[email protected],ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected]>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:Yxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0 /home/<user>/.ssh/<privatekey>
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: RSA SHA256:Axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxk <user>@MacBook-Pro.fritz.box
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: RSA SHA256:4xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxg [email protected]
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: RSA SHA256:qxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxg right@<user>-<computername>-Mint
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: RSA SHA256:zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxM right@right-<computername>
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: RSA SHA256:vxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxc root@unite
Received disconnect from <servername> port 22:2: Too many authentication failures
Disconnected from <servername> port 22

Answer 2

If I understand this correctly, you want to set up ssh access with password (as opposed to e.g. keypairs).

Other settings than those you mention can be at play in /etc/ssh/sshd_config

You mentioned you had already set these:

PermitRootLogin yes
PubkeyAuthentication no
PasswordAuthentication yes
PermitEmptyPasswords no

You also need to set one of these:

KbdInteractiveAuthentication yes
  # recent OpenSSH versions

ChallengeResponseAuthentication yes
  # less recent OpenSSH versions

Further, if the optional setting AuthenticationMethods is active, you should probably comment it out - its argument is a list of authentication methods and all must be passed for the login to be allowed.

Restart sshd

After saving /etc/ssh/sshd_config, restart sshd (SSH server daemon):

sudo systemctl disable --now ssh
sudo systemctl enable --now ssh

Trouble-shooting

To see what authentication methods are attempted, accepted and denied, try to connect to the host with -vfor verbose output:

<client>$ ssh -v host

From the output you can follow what authentication methods are attempted and the response from the host. E.g. look for lines such as:

debug1: Next authentication method: publickey

debug1: Next authentication method: keyboard-interactive