2

This question may sound a duplicate, but I am confident it is not.

I'm playing around a VM with Ubuntu 12.0.4LTS to learn something and my Mac OS 10.9, establishing an SSH connection as per my title. Both the VM (guest) and my local computer (host) have the SSH keys in place. In theory a key was required only for the host, because no reverse connections to the guest are required (but that's a different story).

However - and that's the problem - while trying to SSH to the guest, the host returns always a permission denied message even though the fingerprint have been transmitted.

The authenticity of host 'test.me (172.90.90.91)' can't be established.
RSA key fingerprint is bf:95:70:b1:20:69:b3:e6:a4:2e:58:4b:7e:fc:d9:71.
Are you sure you want to continue connecting (yes/no)? yes

I know this is due to the host key not being included in the authorized-keys file of my guest (Ubuntu). In fact by manually adding the key everything went fine.

But that's the weird thing. From the host I was able to ssh connect to my guest, and once asked the same fingerprint message above, the connection was established without problems.

So that's the question. Why my guest (ubuntu) was able to add the fingerprint and connect to the host (Mac) without problems and not vice versa? Is this a problem / setting in the openSSH config of the server? If so, what is this option? Is the VM (Mac) setting too insecure to accept every SSH fingerprint?

Is this somewhat connected to the PasswordAuthentication setting of the server? And would you recommend to add this to the Mac too?

Thanks Andrea

| improve this question | |
  • There are a couple of very good answers on this SuperUser question – hmayag Feb 17 '14 at 8:17
  • That doesn't really tell me what's the real issue. It explain in deep the signing process, the exchange methodology etc. I was after understanding the specific authentication issue between my guest and host here. Thanks – Andrea Moro Feb 17 '14 at 9:06
0

This have nothing to do with authorized-keys. It's related to known-hosts file. Check if that file exists and have the rigth permissions <-rw-------> you you. Folder <~/.ssh> should be owned by you too.

I case file exists and has right permissions, look at the IP address. For example if you connect to unknown host (10.0.0.1), you'll get:

The authenticity of host '10.0.0.1' can't be established. RSA key fingerprint is bf:95:70:b1:20:69:b3:e6:a4:2e:58:4b:7e:fc:d9:71. Are you sure you want to continue connecting (yes/no)? yes

In network with DHCP, there can "swap" of IP addresses occurr and your connection will be rejected with different message.

| improve this answer | |
  • So when A makes a request, an authorisation token is sent from B. By accepting the connection, I though it was A (requestor) that was in need to add an entry in the known-host file, whereas B requires an entry in the authorized-keys file. If this is not the case, I can't explain why adding an entry on B in the authorized-key I was able to establish the connection. Perhaps I may be wrong. I have to double check it now. – Andrea Moro Feb 19 '14 at 10:06
  • I can confirm that known host file is changed on the computer that request the connection to a server, whereas the authorized key file should include the id_rsa fingerprint of the computer that want to connect. Not the other way round. Cleaning the files I manually edited, the final erro message from A to B is Permission denied (publickey) – Andrea Moro Feb 19 '14 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.