In Ubuntu 12.10, I've created an LXC of type 'ubuntu' using the lxc-create utility. I then create ephemeral containers based on this container using the lxc-start-ephemeral utility, and I need to connect to those using password-less ssh. However, I need to keep their /home/ubuntu folders pristine, so I can't put the usual .ssh/authorized_keys file in there.
The 'encrypted home directory' section here tells me how to move authorized_keys out of the home directory. After I follow those instructions from inside the base container, I can ssh into the base container without giving a password.
However, when I launch an ephemeral container from the base container, I can't ssh in without a password. (Confusingly, passwordless ssh to the ephemeral container does work when authorized_keys is in its usual place in /home/ubuntu/.ssh.) How can I fix this?
Here's what ssh -v said, starting from when it accepts the host key:
debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/ubuntu/.ssh/id_rsa debug1: Authentications that can continue: publickey,password debug1: Trying private key: /home/ubuntu/.ssh/id_dsa debug1: Trying private key: /home/ubuntu/.ssh/id_ecdsa debug1: Next authentication method: password
Here are the relevant portions of /var/log/auth.log on the ephemeral container:
Apr 11 00:06:52 test-temp-SNeWevO sshd: Authentication refused: bad ownership or modes for directory / Apr 11 00:06:54 test-temp-SNeWevO sshd: Accepted password for ubuntu from 10.0.3.1 port 59677 ssh2 Apr 11 00:06:54 test-temp-SNeWevO sshd: pam_env(sshd:setcred): Unable to open env file: /etc/default/locale: No such file or directory Apr 11 00:06:54 test-temp-SNeWevO sshd: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
I did this test on a fresh AWS micro instance based on the standard Ubuntu 12.10 AMI, and can provide detailed instructions on how to reproduce it if that helps.