Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to SSH from a NAS to a webserver using a public key. NAS user is 'root' and webserver user is 'backup'

I have all permissions set correctly and when I debug the SSH connection I get: (last little bit of the debug)

debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering DSA public key: /root/.ssh/
debug1: Server accepts key: pkalg ssh-dss blen 433
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Enter passphrase for key '/root/.ssh/':

I am using the command:

ssh -v -i /root/.ssh/

The fact that it is asking for a passphrase is a good sign surely, but I do not want it to prompt for this or a password (which comes afterwards if I press 'return' on the passphrase)

share|improve this question
up vote 16 down vote accepted

Thats because your private key is encrypted...

You can add your key to an ssh agent using ssh-add or remove the passphrase (and with it the encryption) from the key using the following command:

ssh-keygen -p -f /root/.ssh/id_dsa -N ''


Oh I just realized that you try to use your public key to authenticate... You want to use the private key there:

ssh -v -i /root/.ssh/id_dsa

And just to make absolutely sure, the content of the file goes into ~backup/.ssh/authorized_keys on the webserver. You can use the following command to do that automatically

ssh-copy-id -i /root/.ssh/
share|improve this answer
still get the issue. It did work and granted me with 'your identification has been saved with the new passphrase'. but then still asks for a passphrase the next time I try and login. I'm not sure what else to try... – Andrew Atkinson Nov 20 '12 at 21:52
check my updated answer... maybe that helps... – andrekeller Nov 20 '12 at 22:15
thank you, it seems I was possibly trying to compare the public key to the public key... I did not need to remove the passphrase – Andrew Atkinson Nov 20 '12 at 22:25
Fact that I was using my pub to authenticate (a stupid mistake) was the issue. Thanks! – Qix Aug 7 '14 at 17:55

This happened to me when the private key I had was not in OpenSSH format.

I originally generated my key on windows using PuttyGen and was getting bounced with this same thing.

I was able to fix it by loading the key in PuttyGen and clicking "Conversions" to get it to OpenSSH format.

share|improve this answer
Thanks for this!! – scampbell Aug 28 '15 at 13:41
You saved me :) Thanks. – nicolas Feb 11 at 11:46

There are a few things.

Primarily, if the KEY is asking for a password, the key was generated with it. Secondly, if the system is prompting for a password after, then the key is not authenticating. Meaning, you will need to regenerate your SSH key (or change it as suggested by @rbtux) and fix the authorized_keys files.

ssh-keygen -t {dsa|rsa} -b {1024|2048|4096} -C "optional comment" -f id_examplekey

The items in curly brackets are options, type and bit size (To state the obvious: dsa > rsa, 4096 > 1024 - in terms of "security").

Then you need to add the public key (.pub) to the authorized_keys and authorized_keys2 files (it's a common misconception to say the .pub is for local use, however it is intended to be compared against) So in the server's .ssh folder.

$ cat >> authorized_keys{,2}

Then on your end, you should make sure the key permissions are chmod 600 id_example and to alleviate typing all that, you can set up the config file: ~/.ssh/config on your local box (that is a skeleton, you can customize this a ton):

    IdentityFile ~/.ssh/id_examplekey
share|improve this answer
but the section in the debug which reads: debug1: Server accepts key: pkalg ssh-dss blen 433 does this not mean that the key has been accepted? I have recreated again with no passphrase, still the same? - i am out of ideas? Thank you – Andrew Atkinson Nov 20 '12 at 22:09
@AndrewAtkinson Looks like you got it below. You need the private key on the from machine (local, client, whatever) and the key added to the authorized_keys files. My other suggestions should help save you time :D Good luck! – nerdwaller Nov 20 '12 at 22:27
You write "Primarily, if the KEY is asking for a password, the key was generated with it. " <-- yeah though I just tested what the questioner did, so, doing -i with public key $ ssh user@comp -i ~/.ssh/ and it said wrong permissions and private key will be ignored .. so I changed permissions to 600 like id_rsa would be, and it asked for a passphrase. So, indeed, it will then ask for a passphrase if you specify the public key, even though both the public key and the private key were not generated with a passphrase – barlop Oct 13 '14 at 5:09

For me since the key itself was encrypted, I followed the following steps:

  • Start ssh-agent: $ ssh-agent bash
  • Add standard identity key to the key manager: $ ssh-add
  • If you want to add a different key, then: $ ssh-add /location/of/key

To inspect at any time, the list of currently loaded keys:

$ ssh-add -l

More details can be obtained from this link

share|improve this answer


It is kind of a wrap on ssh-agent and ssh-add

Pros: No need to input the password repeatedly as long as you don't reboot. Could be used in crontab.

It might be help.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.