let's imagine I have username: exuser

My local SSH config file is:

Host app.example.com
  HostName app.example.com
    User exuser
    IdentitiesOnly yes
    IdentityFile ~/.ssh/exuser@app.example.com
    Port 2853

When I'm trying to connect I have an error: Permission denied (publickey).

Found on the server side auth.log:

Could not open authorized keys '/home/exuser/.ssh/authorized_keys':No such file or directory

ls -l /home/exuser/ | grep ssh:

drwx------ 2 exuser exuser  4096 Dec  5 21:42 .ssh

ls -l /home/exuser/.ssh/:

-rw------- 1 exuser exuser  409 Aug 30 14:23 authorized_keys

sshd_config enabled options:

Port 2853
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 1024
SyslogFacility AUTH
LogLevel DEBUG
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
MaxStartups 20
AcceptEnv LANG LC_*
UsePAM yes
Subsystem sftp internal-sftp
Match group ftpaccess
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

If I have an opened session from VNC client (ISP vm manager) everything is OK and I can open ssh session from my desktop without any error.

sshd[28467]: debug1: matching key found: file /home/exuser/.ssh/authorized_keys, line 1 RSA SHA256: blah blah

This error will appear again if I relogin to the desktop system (Ubuntu locks the private key) or delete known_hosts file.

What is wrong? Thanks in advance!

  • 1
    Is your home directory on the remote system encrypted? is it decrypted when the VNC session is opened? – steeldriver Dec 5 '17 at 23:48
  • @steeldriver yes. ecryptfs-verify -h says "Configuration valid". How to check whether it decrypted or not? Perhaps it is because now I am connected without active VNC and any issues. – Denis Ivanov Dec 6 '17 at 0:02
  • @steeldriver thanks for this tip. I found this article says I should move my authorized_keys from encrypted directory. – Denis Ivanov Dec 6 '17 at 0:08
  • If you are able to access your home files via VPN then yes it has been decrypted. Assuming it's only the home that's encrypted, you could move the authorized_keys file under /etc as described in this previous answer Ubuntu server ssh after reboot: Permission denied (publickey) – steeldriver Dec 6 '17 at 0:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.