Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Following the process I've used in other environments, I've tried setting-up shared keys between my Mac and my CentOS 4 webserver. I've seen the same problem with my older Ubuntu 7.10 workstation trying to connect via keys to the same webserver.

I have tried both dsa and rsa keytypes (sshkeygen -t <type>).

The sshd_config file on my webserver seems to be allowing key-based logins:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

And my .ssh/authorized_keys has my dsa and rsa keys added.

Where should I be looking for what to change next to make key-based logins "Just Work™"?

Is it related to the line,

#UseDNS yes

and sshd is trying to do a reverse-lookup on my IP, but cannot because it's NAT'd?

share|improve this question
1  
ssh -v to get verbose diagnostics could help pin down the problem. – coneslayer Apr 14 '10 at 17:05
up vote 5 down vote accepted

~/.ssh/ permissions should be set 0700, and the contents should be 0600.

Also, permissions on ~/ must be 0755 or less; that is, it cannot be writable by any other users.

share|improve this answer
    
Aha! Similar to permissions requirements for .forward files. Thanks! – warren Apr 14 '10 at 17:26

This Ubuntu page on SSH Keys is good reading (look at Troubleshooting).

share|improve this answer

add some -v option when you initiate your ssh connection as

ssh <user>@<host> -vvv 

If ever you have the admin rights to the server, you could also strace -f -p SSHD_PID your sshd

Both of them will give you a bunch of info....

share|improve this answer

CentOS or Ret Hat maintain old versions of packages, so I think this is an issue with, say OpenSSH 5 connecting to older versions.

If I recall, you probably need to have a file called authorized_keys2 instead of just authorized_keys on the server end.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .