2

I am trying to setup public key authentication on a server running Ubuntu 14.04 by following this post. I have done the following so far :

  1. Generated RSA keys on host using ssh-keygen -t rsa.

    The keys (id_rsa & id_rsa.pub ) are now stored in ~/.ssh directory.

  2. Copied the keys to server using ssh-copy-id <username>@<host>

  3. Edited /etc/ssh/sshd_config file to add line PasswordAuthentication no.

  4. Restarted ssh with /etc/init.d/ssh restart.

Now when I try to ssh from host to server I get the following displayed (I have edited out some details like server address and host names):

$:ssh -v user@domain
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /home/host/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to domain [192.168.xx.xx] port 22.
debug1: Connection established.
debug1: identity file /home/host/.ssh/id_rsa type 1
debug1: identity file /home/host/.ssh/id_rsa-cert type -1
debug1: identity file /home/host/.ssh/id_dsa type -1
debug1: identity file /home/host/.ssh/id_dsa-cert type -1
debug1: identity file /home/host/.ssh/id_ecdsa type -1
debug1: identity file /home/host/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/host/.ssh/id_ed25519 type -1
debug1: identity file /home/host/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 16:00:b8:c5:89:af:e9:50:22:85:76:6d:65:1c:aa:b4
debug1: Host 'domain' is known and matches the ECDSA host key.
debug1: Found key in /home/host/.ssh/known_hosts:2
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/host/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/host/.ssh/id_dsa
debug1: Trying private key: /home/host/.ssh/id_ecdsa
debug1: Trying private key: /home/host/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).

I have followed this to fix the issue and did the following :

  1. Ensured permissions are not too open by OpenSSH standards.

    chmod go-w ~/
    chmod 700 ~/.ssh
    chmod 600 ~/.ssh/authorized_keys
    
  2. Created a authorized_keys file in host computer by ssh-copy-id host@127.0.0.1 and copied the authorized_keys file to the server, changed ownership and permissions as required then.

Still the issue persists. I was able to ssh into the server successfully using password before trying to use Publickey authentication. Has anyone else faced similar issues?

Edit :

There was a new line added to the output when I tried to ssh in later : Agent admitted failure to sign using the key.. Some googling led to this issue. The issue is called gnome-keyring interference. When I tried SSH_AUTH_SOCK=0 ssh user@domain I was able to login into the server successfully using publickey authentication. Thank you all for your contribution.

  • can you somehow reach the server and look if the key was successfully added to ~/.ssh/authorized_keys ? and add it manually? – RoVo Nov 8 '17 at 8:13
  • Tip for next time: You're missing one step between 2. and 3. "Test if login with key works" – RoVo Nov 8 '17 at 8:14
  • @RoVo Yes. I checked the authorized_keys file on the server. The key was added successfully. I even ran a diff with the authorized_keys that I generated to be used with loopback on the host. How can I test "if login with key works"?. – lets_try Nov 8 '17 at 8:21
  • Try ssh -i ~/.ssh/key_name user@domain Is your home directory on the server encrypted ? – Panther Nov 8 '17 at 14:05
2

When I tried ssh -i ~/.ssh/key_name user@domain there was a response from the server that said Agent admitted failure to sign using the key.. This is apparently due to gnome-keyring interference issue and the fix is discussed in this link.

A temporary fix is to try SSH_AUTH_SOCK=0 ssh user@domain and if with this you can ssh into your server then follow with the fix in the above link.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.