Can't Use SSH Keys Unless Running SSH With Sudo

Question

For some reason I'm unable to SSH from my Ubuntu 15.10 machine to a remote server using a private key if I run ssh without sudo.

Server side config is fine. I have tested the private key from my Windows machine and from a CentOS box and both can use it.

If I put the private key in ~/.ssh authentication fails and I'm prompted for a password. However, if I put the same private key in /root/.ssh and use sudo ssh I can connect as normal.

Works: sudo ssh [email protected] -vvv

Doesn't Work: ssh [email protected] -vvv

I did notice this in the verbose SSH output.

Without Sudo: Offering RSA public key: /home/matt/.ssh/id_rsa

With Sudo: Trying private key: /root/.ssh/id_rsa

Prior to that line output is the same.

Using the root .ssh directory isn't the end of the world but this doesn't seem correct.

Does anyone know why it's not working with the ssh key in my user's home directory?

Output when running `ssh -vv user@host:

OpenSSH_6.9p1 Ubuntu-2ubuntu0.1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to gitlab.git.ho.me [192.168.1.155] port 22.
debug1: Connection established.
debug1: identity file /home/matt/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/matt/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/matt/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/matt/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/matt/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/matt/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/matt/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/matt/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9p1 Ubuntu-2ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4+deb7u3
debug1: match: OpenSSH_6.0p1 Debian-4+deb7u3 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to gitlab.git.ho.me:22 as 'git'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],ssh-rsa,[email protected],[email protected],ecdsa-sha2-nist[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-dss
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected],[email protected],hmac-sha[email protected],[email protected],hmac-md5,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd1[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug1: kex: server->client aes128-ctr [email protected] none
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-rsa SHA256:2jkKypIK9zvIYnJARNTDz2GVNqSRmz+ERWV/nTLCLWE
debug1: Host 'gitlab.git.ho.me' is known and matches the RSA host key.
debug1: Found key in /home/matt/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/matt/.ssh/id_rsa (0x560bd5470390),
debug2: key: /home/matt/.ssh/id_dsa ((nil)),
debug2: key: /home/matt/.ssh/id_ecdsa ((nil)),
debug2: key: /home/matt/.ssh/id_ed25519 ((nil)),
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/matt/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp SHA256:r+PZ/Ve2JY8SMHkm+opqRZzd/8HdfVL+zdc9hnaTSTQ
debug1: Trying private key: /home/matt/.ssh/id_dsa
debug1: Trying private key: /home/matt/.ssh/id_ecdsa
debug1: Trying private key: /home/matt/.ssh/id_ed25519
debug2: we did not send a packet, disable method
debug1: Next authentication method: password

Output when running sudo ssh -vv user@host

OpenSSH_6.9p1 Ubuntu-2ubuntu0.1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to gitlab.git.ho.me [192.168.1.155] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9p1 Ubuntu-2ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4+deb7u3
debug1: match: OpenSSH_6.0p1 Debian-4+deb7u3 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to gitlab.git.ho.me:22 as 'git'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],hmac-[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug1: kex: server->client aes128-ctr [email protected] none
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:YUYeh6YJ4Nkz5B/17cjcE57I8Ao6IHHuDYgK60dzMHI
debug1: Host 'gitlab.git.ho.me' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/id_rsa ((nil)),
debug2: key: /root/.ssh/id_dsa ((nil)),
debug2: key: /root/.ssh/id_ecdsa ((nil)),
debug2: key: /root/.ssh/id_ed25519 ((nil)),
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentication succeeded (publickey).
Authenticated to gitlab.git.ho.me ([192.168.1.155]:22).

Output of sudo ls -ald /root/.ssh /root/.ssh/* /home/matt/.ssh /home/matt/.ssh/*

drwx------ 2 matt matt 4096 Apr 12 19:25 /home/matt/.ssh
-rwx------ 1 matt matt   59 Apr 12 17:28 /home/matt/.ssh/-config
-rw-rw-r-- 1 matt matt   63 Apr 12 17:27 /home/matt/.ssh/config~
-rw------- 1 matt matt 1675 Apr 12 17:46 /home/matt/.ssh/id_rsa
-rw-r--r-- 1 matt matt  393 Apr 12 17:46 /home/matt/.ssh/id_rsa.pub
-rw-rw-r-- 1 matt matt 1770 Apr 12 17:49 /home/matt/.ssh/known_hosts
-rw-rw-r-- 1 matt matt   25 Apr 12 19:25 /home/matt/.ssh/output.txt
drwx------ 2 root root 4096 Apr 12 18:21 /root/.ssh
-rw------- 1 root root 1675 Apr 12 18:21 id_rsa
-rw-r--r-- 1 root root  444 Apr 12 17:24 known_hosts

Maybe the file ownership or directory ownership is not correct? Just a guess. — Videonauth, Apr 12, 2016 at 22:52

cmks · Accepted Answer · 2016-04-12 23:06:36Z

0

If you call ssh from a sudo shell, you will be logged on as root at the target host. If you call ssh from your user shell you will be logged on as matt. I guess you put the key in the authorized_keys file of the root at the target host, so you need to tell ssh you want logon as root at the target machine racer than as matt:

ssh [email protected]

answered Apr 12, 2016 at 23:06

cmks

1,8941 gold badge11 silver badges17 bronze badges

I'm specifying the user when calling ssh. ssh [email protected] If i do sudo ssh [email protected] it works. It doesn't without sudo
– user1564192
Apr 12, 2016 at 23:07
from your user shell call the command as follows: ssh -vv [email protected] and edit your post to append the full output, furthermore append the output of sudo ls -ald /root/.ssh /root/.ssh/* /home/matt/.ssh /home/matt/.ssh/*
– cmks
Apr 12, 2016 at 23:12
And the output of sudo diff /home/matt/.ssh/id_rsa /root/.ssh/id_rsa && echo OK || Not-OK
– cmks
Apr 12, 2016 at 23:20
Added to OP. I did add the diff output since it was OK.
– user1564192
Apr 12, 2016 at 23:23
Also added the output when running with sudo
– user1564192
Apr 12, 2016 at 23:28

| Show 3 more comments

cmks · Accepted Answer · 2016-04-13 00:13:35Z

The difference between the user and the sudo way is:

matt:
debug1: Server host key: ssh-rsa SHA256:2jkKypIK9zvIYnJARNTDz2GVNqSRmz+ERWV/nTLCLWE
debug1: Host 'gitlab.git.ho.me' is known and matches the RSA host key.
debug1: Found key in /home/matt/.ssh/known_hosts:1

-

sudo:
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:YUYeh6YJ4Nkz5B/17cjcE57I8Ao6IHHuDYgK60dzMHI
debug1: Host 'gitlab.git.ho.me' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:1

As matt ssh finds a rsa known-host-key and ssh fail. As root ssh finds a dsa known host key and succeeds.

Maybe you fix it by removing the file /home/matt/.ssh/known_hosts

You may force using dsa by this command:

ssh -o HostKeyAlgorithms=ssh-dss [email protected]

You may remove old entries from the known_hosts file with:

ssh-keygen -R gitlab.git.ho.me
ssh-keygen -R 192.168.1.155

Thank you for looking into it. I got it fixed. I uncommented IdentityFile in the ssh_config and it is not working. This is a 2 day old install of Ubuntu so I'm not sure why there would be an issue there. — user1564192, Apr 13, 2016 at 0:22

user1564192 · Accepted Answer · 2016-04-13 00:24:24Z

0

It turns out uncommenting IdentityFile in /etc/ssh/ssh_config resolved the issue. This was commented out on a default install of Ubuntu 15.10

answered Apr 13, 2016 at 0:24

user1564192

411 silver badge4 bronze badges

Add a comment |

Stack Exchange Network

Can't Use SSH Keys Unless Running SSH With Sudo

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
ssh
sudo
.

Hot Network Questions

Can't Use SSH Keys Unless Running SSH With Sudo

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged sshsudo.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
ssh
sudo
.