[SOLVED] [ssh] RSA key authentication not working

thomasbb · 12-31-2020, 06:03 AM

In the server /etc/ssh/ssh_config, I've set

Code:

PasswordAuthentication no

restarted the daemon, and from the host copied a public id_rsa.pub on the server with ssh-copy-id:

Code:

$ ssh-copy-id -i ~/.ssh/id_rsa.pub useronserver@server

The key was copied well and shows exactly the same in userlocalhome/.ssh/id_rsa.pub as in userserverhome/.ssh/authorized_keys. However, the server keeps asking me for a password. Did I miss something?

ondoho · 12-31-2020, 06:35 AM

Quote:

Originally Posted by thomasbb

In the server /etc/ssh/ssh_config

Shouldn't you be editing /etc/ssh/sshd_config instead?

thomasbb · 12-31-2020, 06:47 AM

Quote:

Originally Posted by ondoho

Shouldn't you be editing /etc/ssh/sshd_config instead?

Apologies, there was a 'd'... Now it says

Code:

Permission denied (publickey).

Does it take another configuration? Maybe it's because my DHCP hasn't any domain name set up and the authorized_keys shows user@name-of-the-local-host?

ondoho · 12-31-2020, 07:06 AM

Did you restart the sshd service?
Careful if you aren't 100% sure that Key login works.
You could lock yourself out.
Do you have physical access to the server?

Follow a decent tutorial, e.g. https://wiki.archlinux.org/index.php/Ssh_keys

thomasbb · 12-31-2020, 07:31 AM

The server is an old PC I configured as a router and it's by my desk, so I can reconfigure it physically when needed.
The service is restarted but it still doesn't accept my key... Thank you for the link

marav · 12-31-2020, 07:50 AM

Hi,

Do you have this line in your sshd_config ?

Code:

PubkeyAuthentication yes

thomasbb · 12-31-2020, 08:33 AM

Quote:

Originally Posted by marav

Code:

PubkeyAuthentication yes

It was commented but it seems to be the default value. If I uncomment it and restart the service, it still doesn't work. But if I comment the PasswordAuthentication no line, then I can connect with ssh useronserver@IP-of-the-server. The same happens if instead of the IP I use the hostname of the server.

Maybe it takes an SSH agent?

michaelk · 12-31-2020, 08:51 AM

You can connect but I assume you need to enter your password.

Make sure the ~/.ssh directory is owned by your user_on_server and has permissions 700 i.e. drwx------
The ~/.ssh/authorized_keys file should also be owned by your user_on_server and have permissions of 600 i.e. -rw-------

Using the ssh -v option shows additional debug messages which might lend a clue to why keys are not working.

thomasbb · 12-31-2020, 09:17 AM

Quote:

Originally Posted by michaelk

Using the ssh -v option shows additional debug messages which might lend a clue to why keys are not working.

The client doesn't find my private key:

Code:

debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/id_rsa
debug1: Trying private key: /home/user/.ssh/id_dsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa_sk
debug1: Trying private key: /home/user/.ssh/id_ed25519
debug1: Trying private key: /home/user/.ssh/id_ed25519_sk
debug1: Trying private key: /home/user/.ssh/id_xmss
debug1: Next authentication method: password

It's named id_rsa_router, and I made another one named id_rsa_router_2048 with less encryption. But apparently the client uses none of them... Regarding the access rights, I had checked them

thomasbb · 12-31-2020, 09:26 AM

With the -i option, it all goes well... Thank you for your help

michaelk · 12-31-2020, 09:27 AM

In that case the key name must be used on the command line via the -i option or you can use a ~/.ssh/config file to automatically use user defined directives.

Code:

Host My_Server
    HostName IP_address or hostname
    User user_on_server
    IdentityFile ~/.ssh/id_rsa_router

To connect to your server just use the Host name

ssh My_Server

thomasbb · 12-31-2020, 09:40 AM

Quote:

Originally Posted by michaelk

In that case the key name must be used on the command line via the -i option or you can use a ~/.ssh/config file to automatically use user defined directives.

Code:

Host My_Server
    HostName IP_address or hostname
    User user_on_server
    IdentityFile ~/.ssh/id_rsa_router

To connect to your server just use the Host name

ssh My_Server

Perfect. Thank you for the ~/.ssh/config trick