I have an interesting problem with ssh. Here is the setup.

My client (running Ubuntu 17.04) has public and private ssh keys. I copied over the public key to the server (running Ubuntu Server 16.04.3 LTS) using the ssh-copy-id command. I verified this worked by looking at the authorized_keys file on the server; my client's public key is the only one listed.

Now onto the problem. I am able to login to the server from the client through ssh, using my private ssh-key. But after I logout and attempt to ssh again, I get the following error:

Permission denied (publickey).

When I login to the server at the console, I use my password to login and it works fine. Then when I try to SSH again from my client, it works again. And I can logout and login as many times as I want. As soon as I logout from the console on the server (like I'm physically at the server logged in before this), I can SSH from my client exactly ONE more time. Then as soon as that session is ended, I get the Permission denied (publickey).error again on all subsequent SSH attempts. Any ideas?

Here is my ssh config file on my client:

Host sauron
        User joe
        PubKeyAuthentication yes
        IdentityFile id_rsa

One more thing to mention is I do have the entire SSD on the server encrypted. I have to unlock it whenever I boot the server with an encryption password. Not sure if that's relevant. I suspect it could be a permissions issue, though I'm not sure of that either. Suggestions would be much appreciated, and please ask if you need clarification on anything.

  • Are individual home directories encrypted in addition to full-disk encryption? – muru Aug 24 '17 at 3:02
  • I checked my home folder and see there is a .ecryptfs folder in there, so I would say yes there is encryption at the home directory level. – jeklund Aug 24 '17 at 3:20
  • Your comment led me to an article that showed how to move the authorized_keys file to a location that was not encrypted and then source it with the sshd_config file. That fixed it! I am now able to login with ssh keys remotely and with no password. If I require access to the encrypted home directory, I still need to type in my user password, but this is to be expected. – jeklund Aug 24 '17 at 4:28
  • great! If you could summarize what you did following that article, that would be helpful for future reference – muru Aug 24 '17 at 4:30

Thanks to @muru comment about encrypted home directories, I was led to this article about how to deal with this.

The TLDR; of that article is as follows and fixed my problem:

  1. Create a directory in /etc/ssh/ with the same name as the login user you are using. In my case: /etc/ssh/joe.

  2. Copy the authorized_keys file to this directory.

  3. Set correct permissions of this file and directory to the user.

  4. Add the following line to the sshd_config file:

AuthorizedKeysFile /etc/ssh/%u/authorized_keys

  1. Restart SSH.

All fixed!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.