1

I am running on a cluster, where my home directory is shared to all machines. Some of the machines are RHEL and the others are Ubuntu.

When I login without password from RHEL->RHEL or UBUNTU->RHEL it is successful. However, when I try anything->UBUNTU, it fails and I need to manually type the password.

EDIT1: It fails only when trying to connect to some Ubuntu machines. Connecting to other Ubuntu machines is successful.

I made sure the setting of ~ and ~/.ssh to chmod 700 and authorized_keys to chmod 600, but it didn't help.

EDIT2: I added below the output of namei -lx ~/.ssh/authorized_keys

EDIT3: I added below the output of ssh in debug mode on a machine I have sudo for. Surprisingly (although above), it says Authentication refused: bad ownership or modes for file /home/lab/my_user/.ssh/authorized_keys.

I deleted and recreated the ssh keys, and it was also with no success (ssh to non-sudo machines still works, ssh to with-sudo doesn't). The commands I used were:

ssh-keygen -t rsa
ssh-copy-id -i id_rsa.pub ubuntu_machine_name

Here is the output when doing ssh -vv host

[my_user@ctx01 .ssh]$ ssh -vv 10.20.30.40
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options or *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 10.20.30.40 [10.20.30.40] port 22.
debug1: Connection established.
debug1: identity file /home/lab/my_user/.ssh/identity type -1
debug1: identity file /home/lab/my_user/.ssh/identity-cert type -1
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /home/lab/my_user/.ssh/id_rsa type 1
debug1: identity file /home/lab/my_user/.ssh/id_rsa-cert type -1
debug1: identity file /home/lab/my_user/.ssh/id_dsa type -1
debug1: identity file /home/lab/my_user/.ssh/id_dsa-cert type -1
debug1: identity file /home/lab/my_user/.ssh/id_ecdsa type -1
debug1: identity file /home/lab/my_user/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 130/256
debug2: bits set: 480/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.20.30.40' is known and matches the RSA host key.
debug1: Found key in /home/lab/my_user/.ssh/known_hosts:1
debug2: bits set: 519/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-my_userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/lab/my_user/.ssh/identity ((nil))
debug2: key: /home/lab/my_user/.ssh/id_rsa (0x7f412fd53880)
debug2: key: /home/lab/my_user/.ssh/id_dsa ((nil))
debug2: key: /home/lab/my_user/.ssh/id_ecdsa ((nil))
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/lab/my_user/.ssh/identity
debug1: Offering public key: /home/lab/my_user/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/lab/my_user/.ssh/id_dsa
debug1: Trying private key: /home/lab/my_user/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
my_user@10.20.30.40's password:

Here is the output of namei -lx ~/.ssh/authorized_keys

f: /home/lab/my_user/.ssh/authorized_keys
Drwxr-xr-x root   root    /
drwxr-xr-x root   root    home
Drwxr-xr-x nobody nogroup lab
drwx------ nobody nogroup my_user
drwx------ nobody nogroup .ssh
-rw------- nobody nogroup authorized_keys

Here is the output of ssh in debug mode:

debug1: userauth-request for user my_user service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: test whether pkalg/pkblob are acceptable [preauth]
debug1: temporarily_use_uid: 2117/505 (e=0/0)
debug1: trying public key file /home/lab/my_user/.ssh/authorized_keys
debug1: fd 4 clearing O_NONBLOCK
Authentication refused: bad ownership or modes for file /home/lab/my_user/.ssh/authorized_keys
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 2117/505 (e=0/0)
debug1: trying public key file /home/lab/my_user/.ssh/authorized_keys2
debug1: Could not open authorized keys '/home/lab/my_user/.ssh/authorized_keys2': No such file or directory
debug1: restore_uid: 0/0
Failed publickey for my_user from 10.20.30.40 port 48718 ssh2: RSA 90:42:ea:e3:79:b2:27:67:49:1b:17:0b:db:b6:ad:eb
  • 1
    How is the home directory shared? NFS? Please add the output of namei -lx ~/.ssh/authorized_keys. – muru Feb 5 '16 at 17:53
  • Hi @muru, I think it is NFS (I am not the admin). I added the output of namei -lx ~/.ssh/authorized_keys to the question – Yuval Atzmon Feb 6 '16 at 0:11
  • Check with your admin how your home directory is mounted. It's possible it's mounted at login using Kerberos, meaning the SSH daemon can't access your home directory until you login. – muru Feb 7 '16 at 8:44
2

The issue was related to the fact that the NFS was not configured correctly on the Ubuntu machines. When I did ls -l the file owner and group were nobody nogroup. Once I fixed the NFS configuration, everything went well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.