Can't connect via SSH and publickey and user B (user A can)

Question

SOLVED. It was the group writable bit on user_B s home directory, that tricked me.

I'm running out of ideas on this one. Every hint would be highly appreciated.

Consider this setup:

• A server S running Ubuntu, users boldewyn, user_A and user_B
• Two laptops A and B, each with a local user boldewyn (has an id_rsa key to log in S) and a second key id_rsa_A / id_rsa_B. All keys are stored in /home/boldewyn/.ssh. Both running Ubuntu.

• user_A and user_B on S have empty passwords, login should be possible only via publickey and SSH.

  +--------+            +-------------------+            +--------+
  | laptop |            |       server      |            | laptop |
  |   A    |            |         S         |            |   B    |
  |        |            |                   |            |        |
  +--------+    SSH     +-------------------+    SSH     +--------+
  |id_rsa_A|------------|< user_A   user_B >|------------|id_rsa_B|
  +--------+            +-------------------+            +--------+
  |id_rsa  |------------|<    boldewyn     >|------------|id_rsa  |
  +--------+            +-------------------+            +--------+
  

What works:

• Log in from any laptop as boldewyn (using id_rsa and S:/home/boldewyn/.ssh/authorized_keys

• Log in from laptop A as user user_A (using id_rsa_A and S:/home/user_A/.ssh/authorized_keys: ssh -i id_rsa_A user_A@S)

My problem: On laptop B the exactly same setup fails for user_B. I can't log in on S, because for any reason the key is not accepted and the password prompt comes (user_B has no password, that's no option).

What I've checked:

• On laptop B:

  • Checked the rights of ~/.ssh and all its content
  • put public part of id_rsa_B in boldewyns .authorized_keys and ssh -i id_rsa_B boldewyn@S: works (the key is not corrupt or so)
  • ssh -vvv: Well, not really helpful: Just tells me at one point, that it skips publickey method now. No reason given.

• On server S:

  • Triple-checked user_Bs .authorized_keys file
  • Checked the rights of /home/*/.ssh and all their contents (especially compared user_A and user_B)
  • Checked that $HOME is set (via sudo -u user_B -i)
  • Checked, that all users are in /etc/ssh/sshd_configs AllowUsers (and AllowGroups, by the way)

Other stuff:

The only difference I can come up with between user_A and user_B is, that I created the latter with adduser -M (don't create a home directory; it already existed before). However, I triple-checked, that /home/user_B and all relevant children are owned by user_B and his primary group.

Answer 1

Did you triple-check that /home/user_B (as well as /home/user_B/.ssh and /home/user_B/.ssh/authorized_keys) had the proper permissions: not writable except to the user, i.e., mode 755 or more restrictive?

Answer 2

I think it might be related to the way you generated those keys. I would try again. Keys are generated with ssh-keygen facility. Perhaps when one set of keys was generated a passphrase was used in the generation process. You might try just hitting the enter key when you are prompted for a passphrase. Copy the the pub portion of that key to ubuntu. Make sure you delete to offending entry in the .ssh/authorized_keys file. A second thought: if cat the pub file make sure you use a >> (append) rather than > (replace_ when you copy the pub file to the authorized_keys file. (cat id_rsa.pub >> .ssh/authorized_keys).

I am a bit surprised. I have used my methods at work, using Solaris and Cygwin, and at home on my Linux Lan comprised of Centos, Slackware, Debian, and Ubuntu. Is it possible that you private key doesn't match the public one? When you generate your keys you get a pair, the pubic one will get copied traditionally to the .ssh/authorized keys file under the home directory of the target machine. If you re-generate the keys, the new .pub file must be copied. The new private key will not pair with the old public one. I notice that you seem to have a .authorized_keys folder in the home directory. I have never tried that. I think the normal placement is in the /home/user_name/.ssh/authorized_keys folder. I have never had problems using any version of Solaris from about 6 on up, Freebsd, and various iterations and flavors of Linux. Good Luck

Alan