0

I have an Ubuntu 16.04 and a debian machine, both connected through a network. On my Ubuntu machine there is service running, which needs to reboot the debian computer when starting the service. The service is invoked by sudo service debian_client start and is doing a bunch of commands like ssh root@192.168.0.1 reboot on the debian machine. The problem is, I need to type in the password once for every ssh command, which is very annoying.

I tried then to go to ~/.ssh on the Ubuntu machine and did

ssh-keygen -t rsa
ssh-copy-id root@192.168.0.1

After that I logged in via ssh root@192.168.0.1 which works without typing a password. But when invoking the ssh command through the service, I still have to type password. Does anybody know why and how to resolve this issue, I can't find help online for that specific problem?

Interesting part, I changed the script to ssh -v root@192.168.0.1 and compared the output of the script with the output if I do that via bash. The difference is that the script always looks for keys in /root, like the output shows:

...
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password

If I do it myself via bash, the output reads:

debug1: Next authentication method: publickey
debug1: Offering RSA public key: user@ubuntucomputer
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Authentication succeeded (publickey).

and I am logged in without any password typed. Can anybody help, why is my service looking for the key at /root/? Thank you very much.

  • 1
    What user does the service run as? what user did you go to ~/.ssh and run ssh-keygen -t rsa as? – steeldriver Jan 18 '18 at 14:17
  • It seems that the key /root/.ssh/id_rsa is not the key copied with ssh-copy-id root@192.168.0.1. You could give ssh-keygena path and filename. Then you might need to point the ssh connection in your service to your keyfile with -i /path/to/keyfile – Robert Riedl Jan 18 '18 at 14:39
  • Oh I forget to add that. I used ssh-copy-id with the -i option and copied the *.pub file from ~/.ssh/, hope that was right? How can I find out about the user that starts the service? I thought thats myself or root. I did all ssh related commands from my user and checked the creation time of the key files in .ssh. – Martin Herrmann Jan 18 '18 at 14:58
  • The private key file needs to be available to the service - either in the default location of the service owner, or passed to ssh explicitly with the -i option – steeldriver Jan 18 '18 at 15:00
  • Okay, the problem is, I should be able to use that script on several computers with different usernames, hence I can't define an exact path to the user's .ssh folder. The better solution would be to change the user, which executes the script, hows that possible? – Martin Herrmann Jan 18 '18 at 15:26
0

My guess is that:

  • you generated ssh-key as user 'user' (ssh login working from bash/cli debug1: Offering RSA public key: user@ubuntucomputer)
  • there is /home/user/.ssh folder with ssh keys.
  • the servise is executed as 'service' user with home directory '/root'.

Possible quick way to make password less authentication working is:

cd ~; sudo cp -R .ssh /root/

  • Hi, I tried that, at first an error occured, @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for '/root/.ssh/Key.pub' are too open. I changed the permissions to -rw------- and tried again, but then the debain computer accepts the key, but asks for the passphrase. This however is not accepted and then again I am asked for the regular login passwort. The passphrase in this case is simply empty, does that matter? – Martin Herrmann Jan 18 '18 at 15:25
  • I further tried to create a key file as root, hence it was then automatically created in /root/.ssh, and copied that to the debian server, but this doesn't help anyway. – Martin Herrmann Jan 18 '18 at 15:27
  • SSH client is looking for files /root/.ssh/id_rsa, /root/.ssh/id_dsa,.... (look at your script debug output). Your public ssh key file is /root/.ssh/Key.pub. Looks like default configuration is too modified. Then you should provide name of private key: ssh -i /root/.ssh/Key.private root@192.168.0.1 – Ova Jan 18 '18 at 15:47
  • And you should generate ssh key with option '-N': ssh-keygen -N '' -t rsa – Ova Jan 18 '18 at 15:59
  • Thanks @Ovidijus this was the correct hint, I need to pass the private key to the ssh command, not the public. Its working now! – Martin Herrmann Jan 19 '18 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.