3

I have 2 laptops at home, both running Ubuntu 12.04 (Desktop), and both using the same NetGear wifi router. I used a technique called "MAC binding" on one of the machines so that the router always assigns it the same 192.168.1.52 IP address every time it tries to connect to the Internet. (Unrelated: MAC binding just means configuring the router to always bind a specific MAC address to a specific IP.)

So now, I have 1 laptop that always gets assigned a random IP in the 192.168.1.1 to 192.168.1.50 range, and 1 laptop (my "build server") that always get assigned 192.168.1.52.

I am trying to write some bash script that I will run on the "client" laptop (the random IP machine) that will ssh into the build server (192.169.1.52 machine); hence the necessity for the build server to have a "dedicated" IP from inside my LAN. I don't want to have to explicitly feed these bash scripts a password, so I followed the instructions in this article here to generate SSH keys. Specifically, I:

  1. Generate SSH keys on my client laptop (producing an id_rsa.pub file)
  2. I scp'd the id_rsa.pub file to my build server, and cat'd it into the ~/.ssh/authorized_keys file. I verified that my client laptop's SSH key now exists inside the authorized_keys file on the build server.
  3. I closed the terminal on my client laptop and then reopened a new one, just for good measure (in case Linux needs that in order to restart anything, etc.)
  4. I then tried to SSH into the build server, and am still being prompted for a password!

What's going on here? Why is SSH on my build server not honoring the authorized keys from my client laptop? Do I need to restart anything on the build server (sshd, etc.)? Have I missed any crucial steps here? How to start troubleshooting? Thanks in advance!

Update: Apparently Ubuntu doesn't have a /var/log/secure.log, but does have a /var/log/auth.log. When I tail this log on the build server, and then attempt to SSH into the build server from my client laptop, here's what happens:

  1. I run ssh myuser@buildserver from the client laptop
  2. I am prompted for a password.
  3. As soon as I enter the password, I see the following output in the build server's auth.log file:

 

May 21 12:02:07 buildserver sshd[28930]: error: RSA_public_decrypt failed: error:0407006A:lib(4):func(112):reason(106)
May 21 12:02:10 buildserver sshd[28930]: pam_sm_authenticate: Called
May 21 12:02:10 buildserver sshd[28930]: pam_sm_authenticate: username = [myuser]
May 21 12:02:10 buildserver sshd[28930]: pam_sm_authenticate: /home/myuser is already mounted
May 21 12:02:10 buildserver sshd[28930]: Accepted password for myuser from 192.168.1.3 port 39821 ssh2
May 21 12:02:10 buildserver sshd[28930]: pam_unix(sshd:session): session opened for user myuser by (uid=0)
May 21 12:02:10 buildserver sshd[29003]: Received disconnect from 192.168.1.3: 11: disconnected by user
May 21 12:02:10 buildserver sshd[28930]: pam_unix(sshd:session): session closed for user myuser

Something that maybe I should have mentioned: on both machines (the client laptop and my build server, the username/account name is myuser) - could Linux be getting confused because of the same username on both machines?

5
  • 1
    The generic term for "MAC Binding" is a persistent DHCP reservation. May 21, 2013 at 16:03
  • Does your public key start with ssh-rsa or ---- BEGIN SSH2 PUBLIC KEY ---- ? May 21, 2013 at 16:14
  • The fiirst, ssh-rsa...is that my private key?
    – pnongrata
    May 21, 2013 at 16:16
  • No, that's just how my key entries are, but tools always seem to generate the latter kind, and I always convert them. See my answer. May 21, 2013 at 16:17
  • Are you using ssh-agent to manage your private key? Does it work if you use SSH_AUTH_SOCK=0 ssh buildserver ? May 21, 2013 at 16:23

3 Answers 3

6

First step: restart ssh with /etc/init.d/sshd restart. Also, ensure that the permissions on the authorized_users file is correct. To verify, use chmod 600 ~/.ssh/authorized_keys and ensure it's owned by the user you're logging in as.

11
  • 1
    Thanks @Nathan C (+1) - I tried both suggstions: I restarted ssh (via sudo service ssh stop then sudo service ssh start), and then I changed the permissions on authorized_keys from 700 to 750. Please note that I restarted a service called ssh, not sshd like you suggested. There doesn't seem to be a service called sshd installed on my build server (remember its an Ubuntu desktop), so could that be my problem? If so, what's the fix? If not, anything else you can think of? Thanks again!
    – pnongrata
    May 21, 2013 at 15:50
  • 2
    The desktop portion doesn't matter (since it's just the GUI that makes it a "desktop"). Does the /var/log/secure.log have anything referencing the key?
    – Nathan C
    May 21, 2013 at 15:57
  • 1
    @TicketMonster - You also need to cat id.pub >> authorized_keys2. Depending on your ssh protocols enabled, you need both authorized_keys and authorized_keys2. Restarting the service is unnecessary, unless you change ssh/sshd configurations.
    – nerdwaller
    May 21, 2013 at 15:58
  • 1
    Looks like the public key is corrupted. Try copying it over again. If needed, regenerate your keypair and start from scratch.
    – Nathan C
    May 21, 2013 at 16:17
  • 2
    I regenerated the keys like @NathanC suggested - and now it works! Thanks everyone!!
    – pnongrata
    May 21, 2013 at 16:33
5

For me, deleting id_rsa.pub helped (I was using ~/.ssh/id_rsa key). This was caused, because id_rsa.pub was not matching my id_rsa key.

1

What format is your public key in?

I find a lot of tools generate keys like this:

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "1024-bit RSA, converted from OpenSSH by [email protected]"
AAAAB3NzaC1yc2EAAAABIwAAAIEA1on8gxCGJJWSRT4uOrR13mUaUk0hRf4RzxSZ1zRb
YYFw8pfGesIFoEuVth4HKyF8k1y4mRUnYHP1XNMNMJl1JcEArC2asV8sHf6zSPVffozZ
5TT4SfsUu/iKy9lUcCfXzwre4WWZSXXcPff+EHtWshahu3WzBdnGxm5Xoi89zcE=
---- END SSH2 PUBLIC KEY ----

And my authorized_keys file always contained the key like this:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA1on8gxCGJJWSRT4uOrR13mUaUk0hRf4RzxSZ1zRbYYFw8pfGesIFoEuVth4HKyF8k1y4mRUnYHP1XNMNMJl1JcEArC2asV8sHf6zSPVffozZ5TT4SfsUu/iKy9lUcCfXzwre4WWZSXXcPff+EHtWshahu3WzBdnGxm5Xoi89zcE=

(The public key concatenated together all on one line)

2
  • Thanks @Darth Android (+1) - my public key starts ssh-rsa, not the ---- BEGIN... style. What does this tell you?
    – pnongrata
    May 21, 2013 at 16:17
  • 1
    Just that this isn't the answer. Sorry :( May 21, 2013 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .