Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to SSH from a NAS to a webserver using a public key. NAS user is 'root' and webserver user is 'backup'

I have all permissions set correctly and when I debug the SSH connection I get: (last little bit of the debug)

debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering DSA public key: /root/.ssh/id_dsa.pub
debug1: Server accepts key: pkalg ssh-dss blen 433
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Enter passphrase for key '/root/.ssh/id_dsa.pub':

I am using the command:

ssh -v -i /root/.ssh/id_dsa.pub backup@webserver.com

The fact that it is asking for a passphrase is a good sign surely, but I do not want it to prompt for this or a password (which comes afterwards if I press 'return' on the passphrase)

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

Thats because your private key is encrypted...

You can add your key to an ssh agent using ssh-add or remove the passphrase (and with it the encryption) from the key using the following command:

ssh-keygen -p -f /root/.ssh/id_dsa -N ''


EDIT

Oh I just realized that you try to use your public key to authenticate... You want to use the private key there:

ssh -v -i /root/.ssh/id_dsa backup@webserver.com

And just to make absolutely sure, the content of the file id_dsa.pub goes into ~backup/.ssh/authorized_keys on the webserver. You can use the following command to do that automatically

ssh-copy-id -i /root/.ssh/id_rsa.pub backup@webserver.com
share|improve this answer
    
still get the issue. It did work and granted me with 'your identification has been saved with the new passphrase'. but then still asks for a passphrase the next time I try and login. I'm not sure what else to try... –  Andrew Atkinson Nov 20 '12 at 21:52
    
check my updated answer... maybe that helps... –  rbtux Nov 20 '12 at 22:15
    
thank you, it seems I was possibly trying to compare the public key to the public key... I did not need to remove the passphrase –  Andrew Atkinson Nov 20 '12 at 22:25
add comment

There are a few things.

Primarily, if the KEY is asking for a password, the key was generated with it. Secondly, if the system is prompting for a password after, then the key is not authenticating. Meaning, you will need to regenerate your SSH key (or change it as suggested by @rbtux) and fix the authorized_keys files.

ssh-keygen -t {dsa|rsa} -b {1024|2048|4096} -C "optional comment" -f id_examplekey

The items in curly brackets are options, type and bit size (To state the obvious: dsa > rsa, 4096 > 1024 - in terms of "security").

Then you need to add the public key (.pub) to the authorized_keys and authorized_keys2 files (it's a common misconception to say the .pub is for local use, however it is intended to be compared against) So in the server's .ssh folder.

$ cat id_examplekey.pub >> authorized_keys{,2}

Then on your end, you should make sure the key permissions are chmod 600 id_example and to alleviate typing all that, you can set up the config file: ~/.ssh/config on your local box (that is a skeleton, you can customize this a ton):

Host example.com
    User WHATEVERNAME
    IdentityFile ~/.ssh/id_examplekey
share|improve this answer
    
but the section in the debug which reads: debug1: Server accepts key: pkalg ssh-dss blen 433 does this not mean that the key has been accepted? I have recreated again with no passphrase, still the same? - i am out of ideas? Thank you –  Andrew Atkinson Nov 20 '12 at 22:09
    
@AndrewAtkinson Looks like you got it below. You need the private key on the from machine (local, client, whatever) and the public.pub key added to the authorized_keys files. My other suggestions should help save you time :D Good luck! –  nerdwaller Nov 20 '12 at 22:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.