up vote 0 down vote favorite
share [g+] share [fb]

There are three files in my setup:

id_rsa
id_rsa.pub
authorized_keys

authorized_keys has a copy of id_rsa.pub contents to allow no-password logins.

These files have been copied between two computers. If I ssh from computer1 to computer2, it works. If I ssh from coputer2 to computer1, it prompts for a password. Can someone tell me why this might happen.

Also, both systems are running Ubuntu 10.04. I have reinstalled openssh-server packages on both systems. Permissions of the files are the same. The /etc/ssh sshd_config and ssh_config files are the same. I have run with -v -v -v and the only difference between the two sessions, is that one says the 'key was accepted by the server', the other one just continues to the password prompt.

So what else is left to check?

link|improve this question
70% accept rate
feedback

4 Answers

up vote 1 down vote accepted

You can get server debug output by stopping the server and running it from the command line:

sudo /usr/sbin/sshd -Dd

This gave me the following output, after trying to login from my other computer:

...
Authentication refused: bad ownership or modes for directory /home/user
...

Checking my directory:

ls -l /home/user
drwxrwxr-x 142 user user 7.7K 06-19 15:45 /home/user/

The correct permissions should be:

chmod 750 /home/user

After I did that, it's now working.

link|improve this answer
feedback
up vote 0 down vote

Did you add the fingerprint from computer1 to .ssh/authorized_keys on computer2?

Additionally, you should not use the same private key among many boxes, as it weakens the security should one box get cracked. Personally I use one key per client per server.

link|improve this answer
As for your second point, that's why keys should always have a password. Also see related superuser.com/questions/121307/… – honk Jun 20 '10 at 0:40
The authorized_keys file is the same on both computers if that is what you mean. Also, I agree with the security issues, right now I would just like to solve the issue, even if I end up switching keys down the line. – Casey Jun 20 '10 at 0:58
Try setting the sshd log level to DEBUG on computer2. After a failed connection attempt, it should explain why the key was rejected. – Daenyth Jun 20 '10 at 14:13
I could not get any info on the client side using '-v -v -v'. is there another method? – Casey Jun 21 '10 at 15:48
Look at the logs on the server side. It is probably in /var/log/secure or /var/log/auth.log... Look around, you should see it. Set the sshd log level to DEBUG in sshd_config – Daenyth Jun 21 '10 at 16:29
feedback
up vote 0 down vote

One thing to check in addition to Daenyth's answer is file ownership and permissions within your ~/.ssh directory on both computers.

Make sure you are set as the user for all files in that directory: chown *USERNAME*: ~/.ssh/*

Also, check that the permissions are such that the the files are readable and writable by your user but not accessible by group or other: chmod 600 ~/.ssh/*

link|improve this answer
yep, files and .ssh dir is owned by me, all permissions are set to 600. – Casey Jun 20 '10 at 1:01
feedback
up vote 0 down vote

Home directory can't be world or group writable either, not just .ssh dir and files, if your sshd_config file has StrictModes=yes.

Test by changing StrictModes=no and restart sshd daemon

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.