1

We are using Backuppc in our little office, with a mix of Windows 7 PC's and some users using their Macbooks. Backuppc is sitting on a server running Ubuntu 12.04.2. Passwordless ssh is working fine with Snow Leopard and Lion, but I am struggling with Mountain Lion, as it keeps asking for the password again and again. I have followed the procedure of exchanging the rsa public keys, and added the public key from the Backuppc user to the Mountain Lion host machine. First I added the key to the 'authorized_keys2' file on the .ssh directory. It did not work. After doing some searches, some people suggested to use 'authorized_keys' instead, as it seems Mountain Lion has upgraded the sshd package. It did not work either. I think permissions are set properly for both the .ssh directory (700) and the 'authorized_keys' file (edited: 644). It keeps asking for the password every time I try to ssh from the Backuppc user to the machine with Mountain Lion. Really annoying. Below I attach the debug output in case anyone can provide with some hints. Thank you very much for your help.

backuppc@ubuntu:~$ ssh -v [email protected]
OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.10.55 [192.168.10.55] port 22.
debug1: Connection established.
debug1: identity file /var/lib/backuppc/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /var/lib/backuppc/.ssh/id_rsa-cert type -1
debug1: identity file /var/lib/backuppc/.ssh/id_dsa type -1
debug1: identity file /var/lib/backuppc/.ssh/id_dsa-cert type -1
debug1: identity file /var/lib/backuppc/.ssh/id_ecdsa type -1
debug1: identity file /var/lib/backuppc/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9
debug1: match: OpenSSH_5.9 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 4c:c3:21:8f:6e:59:60:a9:5f:94:75:01:2d:e2:03:3e
debug1: Host '192.168.10.55' is known and matches the RSA host key.
debug1: Found key in /var/lib/backuppc/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /var/lib/backuppc/.ssh/id_rsa
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Trying private key: /var/lib/backuppc/.ssh/id_dsa
debug1: Trying private key: /var/lib/backuppc/.ssh/id_ecdsa
debug1: Next authentication method: keyboard-interactive
Password:

Following the advice on the comments, I have run a 'sshd -d' on the Mountain Lion target machine. First I stopped 'ssh' and then run the 'sshd -d'. I paste you the results below:

$sudo launchctl unload  /System/Library/LaunchDaemons/ssh.plist
$sudo /usr/sbin/sshd -d

debug1: sshd version OpenSSH_5.9p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: fd 6 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9
debug1: inetd sockets after dupping: 5, 5
Connection from 192.168.10.100 port 34179
debug1: Client protocol version 2.0; client software version OpenSSH_5.9p1 Debian-5ubuntu1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: permanently_set_uid: 75/75 [preauth]
debug1: list_hostkey_types: ssh-rsa,ssh-dss [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: client->server aes128-ctr hmac-md5 none [preauth]
debug1: kex: server->client aes128-ctr hmac-md5 none [preauth]
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received [preauth]
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent [preauth]
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT [preauth]
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user user1 service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "user1"
debug1: PAM: setting PAM_RHOST to "ubuntu"
debug1: userauth-request for user user1 service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: test whether pkalg/pkblob are acceptable [preauth]
debug1: temporarily_use_uid: 502/20 (e=0/0)
debug1: trying public key file /Users/user1/.ssh/authorized_keys
debug1: fd 6 clearing O_NONBLOCK
Authentication refused: bad ownership or modes for directory /Users/user1
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 502/20 (e=0/0)
debug1: trying public key file /Users/user1/.ssh/authorized_keys2
debug1: fd 6 clearing O_NONBLOCK
Authentication refused: bad ownership or modes for directory /Users/user1
debug1: restore_uid: 0/0
Failed publickey for user1 from 192.168.10.100 port 34179 ssh2
debug1: audit_event: unhandled event 6
debug1: userauth-request for user user1 service ssh-connection method keyboard-interactive [preauth]
debug1: attempt 2 failures 1 [preauth]
debug1: keyboard-interactive devs  [preauth]
debug1: auth2_challenge: user=user1 devs= [preauth]
debug1: kbdint_alloc: devices 'pam' [preauth]
debug1: auth2_challenge_start: trying authentication method 'pam' [preauth]
Postponed keyboard-interactive for user1 from 192.168.10.100 port 34179 ssh2 [preauth]
debug1: do_pam_account: called
debug1: PAM: num PAM env strings 2
Postponed keyboard-interactive/pam for user1 from 192.168.10.100 port 34179 ssh2 [preauth]
debug1: do_pam_account: called
Accepted keyboard-interactive/pam for user1 from 192.168.10.100 port 34179 ssh2
debug1: monitor_read_log: child log fd closed
debug1: monitor_child_preauth: user1 has been authenticated by privileged process
debug1: PAM: establishing credentials
User child is on pid 3240
debug1: PAM: establishing credentials
debug1: permanently_set_uid: 502/20
debug1: Entering interactive session for SSH2.
debug1: server_init_dispatch_20
debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384
debug1: input_session_request
debug1: channel 0: new [server-session]
debug1: session_new: session 0
debug1: session_open: channel 0
debug1: session_open: session 0: link with channel 0
debug1: server_input_channel_open: confirm session
debug1: server_input_global_request: rtype [email protected] want_reply 0
debug1: server_input_channel_req: channel 0 request pty-req reply 1
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req pty-req
debug1: Allocating pty.
debug1: session_new: session 0
debug1: session_pty_req: session 0 alloc /dev/ttys001
debug1: Ignoring unsupported tty mode opcode 37 (0x25)
debug1: Ignoring unsupported tty mode opcode 52 (0x34)
debug1: Ignoring unsupported tty mode opcode 71 (0x47)
debug1: server_input_channel_req: channel 0 request env reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req env
debug1: server_input_channel_req: channel 0 request shell reply 1
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req shell
debug1: Setting controlling tty using TIOCSCTTY.
11
  • What about on the Mountain Lion machine, what errors are you getting?
    – NickW
    Jun 4, 2013 at 14:43
  • Yes, run the sshd with -d on the Mountain Lionbaby to see what's going on.
    – ott--
    Jun 4, 2013 at 15:16
  • Hi, thanks for your comments. I have done as you say, first I stopped the ssh using sudo launchctl unload /System/Library/LaunchDaemons/ssh.plistand then run sudo /usr/sbin/sshd -d. I paste you the results at the end of the original question.
    – ibagur
    Jun 5, 2013 at 1:13
  • When you try to connect from backuppc, there will be more log messages on the Mountain Lion machine. Those are what is more important.
    – Kent
    Jun 5, 2013 at 1:26
  • sorry, I didn't post all of it. I have edited it now.
    – ibagur
    Jun 5, 2013 at 1:39

3 Answers 3

3

The answer from ibagur is close but he has the keys reversed. The remote system's public key must be in your local ~/.ssh/known_hosts file. Your public key must be in the remote system's ~/.ssh/**authorized_keys file. Contrary to the above post, the authorized_keys file MUST have 600 permissions. The steps to perform are

  1. Copy your public key to the remote system's ~/.ssh directory using the command scp id_rsa.pub username@remotehost:/path/to/home/username/.ssh/mykey.tmp making sure the file name you use is unique on the remote system. If prompted, accept the remote system's key after verifying that it is indeed the correct key for the remote system (trust the key). This will add the remote system's public key to your ~/.ssh/known_hosts file.
  2. Log in to the remote system using password authentication.
  3. Change directories to ~/.ssh using cd .ssh
  4. Install your key in the ``~/.ssh/authorized_keysfile usingcat mykey.tmp >> authorized_keys`
  5. Make sure the authorized_keys file is mode 600 using chmod 600 authorized_keys
  6. Log out and test, you should no longer be prompted for a password.

If you still have problems, you can try logging in to the remote system using ssh -vv to get some debugging output, but in my experience the client doesn't provide very much useful information. You will likely need to run the remote system's SSH daemon in debug mode as described in the original question.

2

Ok, thanks to everyone for the tips and suggestions on the comments. I finally made it work. There was a problem with permissions on the Mountain Lion user directory (not on the .ssh and authorized_keys directory). So I summarize below the steps I took in case anyone faces a similar issue:

  1. Repair permissions on the Mountain Lion target machine (the one I am connecting to with ssh from the server/backuppc user).
  2. Make sure the Mountain Lion user directory has 755 permissions.
  3. Delete the .ssh directory and contents in case you created it before.
  4. Create again the .ssh directory with 700 permisions and a new set of rsa keys for the Mountain Lion user with ssh-keygen.
  5. Add the Mountain Lion user public key to the server known_hostsfile.
  6. Add the server public key on the authorized_keys file (do not use 'authorized_keys2' on Mountain Lion and make user permits are set to 644.
1
  • My user dir perms were set to 771. Tailing /var/log/secure.log showed "Authentication refused: bad ownership or modes for directory /Users/myuser". Changing it to 755 worked
    – shadfc
    Aug 19, 2014 at 15:18
1

I believe that the authorized_keys file must have permissions set to 644.

If the permissions are anything else, the presence of the file is completely ignored and you are bumped onto the next authentication mehtod, in this case, password.

3
  • Mine work great with 640, 700, and even 600..
    – NickW
    Jun 4, 2013 at 15:04
  • 600 is to be recommended
    – user168261
    Jun 4, 2013 at 15:52
  • hi, thanks. I've tried 644, 640 and 700 and still keeps asking me for the password
    – ibagur
    Jun 5, 2013 at 1:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .