This is a generic question, of how to diagnose the error in the following SSH login trace. However, I've pasted specific details to exemplify the problem.
The main problem statement:
When using "ssh -A" to forward keys from one machine to another, the ssh connections inside the target machine may fail with permission denied errors. However, it is tricky to interpret the output of "ssh -v" command (that is - its not clear in the case where a machine has its own id_rsa.pub file, how it is that the ssh -A works ... does it try to use both public keys? or just one of them?)
Some details on the ssh setup
I have a machine "A" , with a VM "B" running in it (fedora 16).
On A , I run
A> ssh root@B
Then, on B, If i invoke "ssh-agent" , I get the following output
B> ssh-agent SSH_AUTH_SOCK=/tmp/ssh-ZJRIzYHw1418/agent.1418; export SSH_AUTH_SOCK; SSH_AGENT_PID=1419; export SSH_AGENT_PID; echo Agent pid 1419;
Finally, not sure if this is important, but , BOTH machines A and B have their own .ssh directories with id_rsa.pub keys. Is that making "ssh -A" fail (i.e. is ssh smart enough to try all available public keys?)
>ssh -v email@example.com OpenSSH_5.8p1, OpenSSL 1.0.0j-fips 10 May 2012 debug1: Reading configuration data /root/.ssh/config debug1: Applying options for * debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to github.com [126.96.36.199] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/id_rsa type 1 debug1: identity file /root/.ssh/id_rsa-cert type -1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: identity file /root/.ssh/id_dsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.5p1 Debian-6+squeeze1+github12 debug1: match: OpenSSH_5.5p1 Debian-6+squeeze1+github12 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.8 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: RSA 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48 debug1: Host 'github.com' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:10 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: /root/.ssh/id_rsa debug1: Authentications that can continue: publickey debug1: Trying private key: /root/.ssh/id_dsa debug1: No more authentication methods to try. Permission denied (publickey).