Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've spent a few hours trying to solve this, but have gotten nowhere.

The server is running CentOS 6 and using OpenSSH. The client is running OpenSSH too.

I created a public key on the client (my PC) using ssh-keygen -t rsa and then sent it to the server using ssh-copy-id user@host.

After, I logged onto the server (using password) and saw the file was there and has some stuff in it. I changed its permissions to 600 as stated on the CentOS Wiki.

I then tried to SSH into the server again, but I had to enter a password. Here's the output using the verbose option:

matthew@Matthew-PC ~ $ ssh censored@censored -v
OpenSSH_6.0p1 Debian-3ubuntu1, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to censored [censored] port 22.
debug1: Connection established.
debug1: identity file /home/matthew/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/matthew/.ssh/id_rsa-cert type -1
debug1: identity file /home/matthew/.ssh/id_dsa type -1
debug1: identity file /home/matthew/.ssh/id_dsa-cert type -1
debug1: identity file /home/matthew/.ssh/id_ecdsa type -1
debug1: identity file /home/matthew/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 92:67:19:72:5f:ed:b1:a3:14:7f:f3:82:e2:4d:ef:16
debug1: Host 'censored' is known and matches the RSA host key.
debug1: Found key in /home/matthew/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/matthew/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Offering RSA public key: /home/matthew/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/matthew/.ssh/id_dsa
debug1: Trying private key: /home/matthew/.ssh/id_ecdsa
debug1: Next authentication method: password
censored@censored's password: 

In the server's SSHD configuration I have uncommented and modified a couple of options like so:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile /home/%u/.ssh/authorized_keys

I have also tried running ssh-add on the server, but when I do ssh-add -l, none show up.

Any help would be really appreciated.

edit: the problem may be client side. I tried to set this up with my Raspberry Pi and get this when connecting too:

matthew@Matthew-PC ~ $ ssh pi@raspberrypi -v
OpenSSH_6.0p1 Debian-3ubuntu1, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to raspberrypi [192.168.1.70] port 22.
debug1: Connection established.
debug1: identity file /home/matthew/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/matthew/.ssh/id_rsa-cert type -1
debug1: identity file /home/matthew/.ssh/id_dsa type -1
debug1: identity file /home/matthew/.ssh/id_dsa-cert type -1
debug1: identity file /home/matthew/.ssh/id_ecdsa type -1
debug1: identity file /home/matthew/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-3
debug1: match: OpenSSH_6.0p1 Debian-3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 72:e3:36:15:72:c9:ca:9f:66:a9:d5:3f:88:d0:7a:e7
debug1: Host 'raspberrypi' is known and matches the ECDSA host key.
debug1: Found key in /home/matthew/.ssh/known_hosts:3
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/matthew/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
Agent admitted failure to sign using the key.
debug1: Offering RSA public key: /home/matthew/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/matthew/.ssh/id_dsa
debug1: Trying private key: /home/matthew/.ssh/id_ecdsa
debug1: Next authentication method: password
pi@raspberrypi's password: 
share|improve this question

3 Answers 3

In the steps listed, I don't see anything that suggests you added the public key to the `authorized_keys files.

On the server, try:

cat /path/to/key.pub >> ~/.ssh/authorized_keys{,2}

Shell expansion should do both files hopefully.

Locally, you may need to include an ~/.ssh/config file which would be permissions of 600. If you think you need it I'll post mine as an example. In it you can specify usernames and easier hostnames to use (rather than user@superuser.com it would just be ssh chosenname)

Also, is your local key in ~/.ssh?

share|improve this answer
    
Thanks for your reply. I used ssh-copy-id which appeared to work because before there was no authorized_keys file, yet after there way. I tried cat earlier after copying the key with scp, but I got the same results. –  Nysepho Jan 26 '13 at 23:38
    
@Matthew - do you have both authorized_keys and authorized_keys2? Does your sshd_config file allow or deny any protocol (1/2)?bsinve making edits, have you restarted the service? –  nerdwaller Jan 26 '13 at 23:40
    
No, there's only authorized_keys. In sshd_config I see Protocol 2 the stuff above is commented out. edit: yeah, I've done "sudo service sshd restart" after each modification of the config. –  Nysepho Jan 26 '13 at 23:43
    
I'd try cat /path/to/publickey.pub >> ~/.ssh/authorized_keys2 (whatever path you added for sshd to use). I'd probably comment out the custom path in sshd until you get it working. But I've never messed with that option before. –  nerdwaller Jan 26 '13 at 23:51
    
I tried that after scping the id_key.pub, but it still doesn't work. :S –  Nysepho Jan 27 '13 at 0:07

Or just:

restorecon -R -v /root/.ssh
share|improve this answer
up vote 0 down vote accepted

Solved. Reddit user Tylerdurdon helped me solve this issue.

Server refused our key means it is not finding the matching key on the server end. You sure you didn't encrypt your profile? If the profile is encrypted, then like I was mentioning, the server cannot access it until you are logged in, so you have to store it elsewhere.

Link to solution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.