I'm kind of stuck here..
I am trying to disable all SSH login capabilities of root. No password login. No key-based login. Nothing. I have a user "andrew" that should only be able to SSH into my server with the private key.
Here's what I've done so far:
(on my laptop) ssh-keygen -b 4096 -t rsa
(on my laptop) cat id_rsa.pub | ssh [email protected] "cat >> /home/andrew/.ssh/authorized_keys"
(on my server) Modified /etc/ssh/sshd_config in the following ways:
- PermitRootLogin no
- PasswordAuthentication no
- AuthorizedKeysFile /home/%h/.ssh/authorized_keys
(on my server) reload ssh
When I attempt to connect to my server from my laptop, I get the following (the errors are towards the end):
andrew@andrew-asus ~/.ssh $ ssh -vvv -i id_rsa [email protected]
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to server.com [XXXXXXXXX] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "id_rsa" as a RSA1 public key
debug1: identity file id_rsa type 1
debug1: identity file id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "server.com" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup [email protected]
debug1: kex: server->client aes128-ctr [email protected] none
debug2: mac_setup: setup [email protected]
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 50:4a:6c:d9:62:82:c6:59:32:55:b9:43:09:8d:7b:07
debug3: load_hostkeys: loading entries for host "server.com" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "XXXXXXXX" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'server.com' is known and matches the ECDSA host key.
debug1: Found key in /home/andrew/.ssh/known_hosts:2
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: id_rsa (0x7f7c55f5cda0), explicit
debug2: key: andrew@andrew-asus (0x7f7c55f61950),
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: andrew@andrew-asus
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
Here is the command I run on my computer to connect:
(inside the ~/.ssh dir) ssh -vvv -i id_rsa [email protected]
I've tried using ssh-copy-id. I've tried re-creating my keypair. Deleting the "authorized_keys" entries on the server. Deleting the "known_hosts" entries on the laptop. I'm lost.
Here is a full copy of the sshd_config file on the server:
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile /home/%h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
Thanks to anyone who can help me.
EDIT: Here is the output of my auth.log file when sshd is running under DEBUG loggin mode. It looks like it can't find my "authorized_keys" file..
May 21 22:29:47 server sshd[13613]: debug1: Bind to port 22 on 0.0.0.0.
May 21 22:29:47 server sshd[13613]: Server listening on 0.0.0.0 port 22.
May 21 22:29:47 server sshd[13613]: debug1: Bind to port 22 on ::.
May 21 22:29:47 server sshd[13613]: Server listening on :: port 22.
May 21 22:29:50 server sshd[13613]: debug1: Forked child 13615.
May 21 22:29:50 server sshd[13615]: Set /proc/self/oom_score_adj to 0
May 21 22:29:50 server sshd[13615]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
May 21 22:29:50 server sshd[13615]: debug1: inetd sockets after dupping: 3, 3
May 21 22:29:50 server sshd[13615]: Connection from XXXXXXXXXX port 4446 on XXXXXXXX port 22
May 21 22:29:50 server sshd[13615]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 22:29:50 server sshd[13615]: debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
May 21 22:29:50 server sshd[13615]: debug1: Enabling compatibility mode for protocol 2.0
May 21 22:29:50 server sshd[13615]: debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 22:29:50 server sshd[13615]: debug1: permanently_set_uid: 104/65534 [preauth]
May 21 22:29:50 server sshd[13615]: debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_KEXINIT sent [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_KEXINIT received [preauth]
May 21 22:29:50 server sshd[13615]: debug1: kex: client->server aes128-ctr [email protected] none [preauth]
May 21 22:29:50 server sshd[13615]: debug1: kex: server->client aes128-ctr [email protected] none [preauth]
May 21 22:29:50 server sshd[13615]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
May 21 22:29:50 server sshd[13615]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_NEWKEYS received [preauth]
May 21 22:29:50 server sshd[13615]: debug1: KEX done [preauth]
May 21 22:29:51 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method none [preauth]
May 21 22:29:51 server sshd[13615]: debug1: attempt 0 failures 0 [preauth]
May 21 22:29:51 server sshd[13615]: debug1: PAM: initializing for "andrew"
May 21 22:29:51 server sshd[13615]: debug1: PAM: setting PAM_RHOST to "XXXXXXXXXX"
May 21 22:29:51 server sshd[13615]: debug1: PAM: setting PAM_TTY to "ssh"
May 21 22:29:51 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 22:29:51 server sshd[13615]: debug1: attempt 1 failures 0 [preauth]
May 21 22:29:51 server sshd[13615]: debug1: test whether pkalg/pkblob are acceptable [preauth]
May 21 22:29:51 server sshd[13615]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 22:29:51 server sshd[13615]: debug1: trying public key file /home//home/andrew/.ssh/authorized_keys
May 21 22:29:51 server sshd[13615]: debug1: Could not open authorized keys '/home//home/andrew/.ssh/authorized_keys': No such file or directory
May 21 22:29:51 server sshd[13615]: debug1: restore_uid: 0/0
May 21 22:29:51 server sshd[13615]: Failed publickey for andrew from XXXXXXXXX port 4446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 22:29:54 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 22:29:54 server sshd[13615]: debug1: attempt 2 failures 1 [preauth]
May 21 22:29:54 server sshd[13615]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 22:29:54 server sshd[13615]: debug1: trying public key file /home//home/andrew/.ssh/authorized_keys
May 21 22:29:54 server sshd[13615]: debug1: Could not open authorized keys '/home//home/andrew/.ssh/authorized_keys': No such file or directory
May 21 22:29:54 server sshd[13615]: debug1: restore_uid: 0/0
May 21 22:29:54 server sshd[13615]: Failed publickey for andrew from XXXXXXXX port 4446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 22:29:54 server sshd[13615]: Connection closed by XXXXXXXXX [preauth]
May 21 22:29:54 server sshd[13615]: debug1: do_cleanup [preauth]
May 21 22:29:54 server sshd[13615]: debug1: monitor_read_log: child log fd closed
May 21 22:29:54 server sshd[13615]: debug1: do_cleanup
May 21 22:29:54 server sshd[13615]: debug1: PAM: cleanup
May 21 22:29:54 server sshd[13615]: debug1: Killing privsep child 13616
May 21 22:30:01 server sshd[13613]: Received signal 15; terminating.
EDIT #2: Looks like something with permissions on the "authorized_keys" file. sshd can find it now, but can't open it. Here's the log:
May 21 23:06:58 server sshd[3880]: debug1: Forked child 3975.
May 21 23:06:58 server sshd[3975]: Set /proc/self/oom_score_adj to 0
May 21 23:06:58 server sshd[3975]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
May 21 23:06:58 server sshd[3975]: debug1: inetd sockets after dupping: 3, 3
May 21 23:06:58 server sshd[3975]: Connection from XXXXXXXXX port 53446 on 96.126.115.73 port 22
May 21 23:06:58 server sshd[3975]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 23:06:58 server sshd[3975]: debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
May 21 23:06:58 server sshd[3975]: debug1: Enabling compatibility mode for protocol 2.0
May 21 23:06:58 server sshd[3975]: debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 23:06:58 server sshd[3975]: debug1: permanently_set_uid: 104/65534 [preauth]
May 21 23:06:58 server sshd[3975]: debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_KEXINIT sent [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_KEXINIT received [preauth]
May 21 23:06:58 server sshd[3975]: debug1: kex: client->server aes128-ctr [email protected] none [preauth]
May 21 23:06:58 server sshd[3975]: debug1: kex: server->client aes128-ctr [email protected] none [preauth]
May 21 23:06:58 server sshd[3975]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
May 21 23:06:58 server sshd[3975]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
May 21 23:06:59 server sshd[3975]: debug1: SSH2_MSG_NEWKEYS received [preauth]
May 21 23:06:59 server sshd[3975]: debug1: KEX done [preauth]
May 21 23:06:59 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method none [preauth]
May 21 23:06:59 server sshd[3975]: debug1: attempt 0 failures 0 [preauth]
May 21 23:07:02 server sshd[3975]: debug1: PAM: initializing for "andrew"
May 21 23:07:02 server sshd[3975]: debug1: PAM: setting PAM_RHOST to "XXXXXX"
May 21 23:07:02 server sshd[3975]: debug1: PAM: setting PAM_TTY to "ssh"
May 21 23:07:02 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 23:07:02 server sshd[3975]: debug1: attempt 1 failures 0 [preauth]
May 21 23:07:02 server sshd[3975]: debug1: test whether pkalg/pkblob are acceptable [preauth]
May 21 23:07:02 server sshd[3975]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 23:07:02 server sshd[3975]: debug1: trying public key file /home/andrew/.ssh/authorized_keys
May 21 23:07:02 server sshd[3975]: debug1: Could not open authorized keys '/home/andrew/.ssh/authorized_keys': Permission denied
May 21 23:07:02 server sshd[3975]: debug1: restore_uid: 0/0
May 21 23:07:02 server sshd[3975]: Failed publickey for andrew from XXXXXXX port 53446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 23:07:06 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 23:07:06 server sshd[3975]: debug1: attempt 2 failures 1 [preauth]
May 21 23:07:06 server sshd[3975]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 23:07:06 server sshd[3975]: debug1: trying public key file /home/andrew/.ssh/authorized_keys
May 21 23:07:06 server sshd[3975]: debug1: Could not open authorized keys '/home/andrew/.ssh/authorized_keys': Permission denied
May 21 23:07:06 server sshd[3975]: debug1: restore_uid: 0/0
May 21 23:07:06 server sshd[3975]: Failed publickey for andrew from XXXXXXX port 53446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 23:07:07 server sshd[3975]: Connection closed by XXXXXXXXXX [preauth]
May 21 23:07:07 server sshd[3975]: debug1: do_cleanup [preauth]
May 21 23:07:07 server sshd[3975]: debug1: monitor_read_log: child log fd closed
May 21 23:07:07 server sshd[3975]: debug1: do_cleanup
May 21 23:07:07 server sshd[3975]: debug1: PAM: cleanup
May 21 23:07:07 server sshd[3975]: debug1: Killing privsep child 3976
