0

I have been trying to get ssh working without a password on a Linux server. I have been looking at a lot of tutorials, but I have a lack of fundamental understanding of some key concepts.

I have an old rsa public key that I generated on my client server, which I am trying to use. I log in to the Linux server, and add my public rsa key to /home/user/.ssh/authorized_keys. I am still prompted for a password when attempting to log in.

My question is whether or not that is the correct authorized_keys file to add my key to. It seems odd that I would put it in my own user directory, but most explanations I have seen on setting up ssh tell me to put my public key in ~/.ssh/authorized_keys.

As a follow up question, is the public key that I generated years ago on my client my identifier for all shh connections or do I need to generate a new one?

UPDATE The errors that are being logged read

trying public key file /home/bsayegh/.ssh/authorized_keys
Authentication refused: bad ownership or modes for file /home/bsayegh/.ssh/authorized_keys

The permissions on the file/directory are:

-rwxrwxrwx. 1 bsayegh root     401 May 24 14:30 authorized_keys
 drwx------. 2 bsayegh root    4096 May 24 14:30 .
 drwx------. 3 bsayegh bsayegh 4096 May 25 11:38 ..
  • What does ssh -v show? – Barmar Jun 1 '16 at 15:46
  • @Barmar: I just went through this exercise. ssh -v is useless for debugging it. sshd -Dd is more helpful. – Joshua Oct 11 '16 at 23:35
2

If you have access to the log files of the machine you want to look into them. Especially /var/log/messages and /var/log/secure. Typically, you will find a message why sshd did not accept your public key authentication.

In general, you need to do the following

  1. check that sshd allows public key authentication (see /etc/ssh/sshd_config) -- I think this is default, so you at least should check that options, such as RSAAuthentication and PubkeyAuthentication are not explicitly disabled.

  2. chown -R ***(your user name)*** ~/.ssh -- you own the folder

  3. chmod 700 ~/.ssh -- only you should have access to the .ssh folder. sshd enforces this by not allowing access if this is not the case.
  4. chmod 600 ~/.ssh/id_rsa -- same as for the folder. This is required for any private key you want to use
  5. chmod 600 ~/.ssh/authorized_keys -- some sshd daemons require this to add a bit more security by not letting others know which keys they need to steal
  6. restorecon -R ~/.ssh -- when your system has SELINUX activated in order to set the attributes to make the files accessible to the sshd daemon; check with ls -Z ~/.ssh to see some ssh-related attributes on the files, e.g., ssh_home_t on RedHat systems

edit (2016-06-07) -- add some more rules

  • authorized_keys doesn't need to be unreadable by others. It contains public keys, those are by definition "public". – Barmar Jun 1 '16 at 15:45
  • I have mode 644 on my authorized_keys and it works fine for me. – Barmar Jun 1 '16 at 15:48
  • @Barmar ... you could think like that ... but it is not the case in general. – John Jun 1 '16 at 15:48
  • Checked the Secure log and I see the error "Authentication refused: bad ownership or modes for directory /home/bsayegh/.ssh". That seems to point to what you are suggesting. Who should be the owner of the file? Currently it appears to be root. Ill set the permissions to 600. Thanks! – bsayegh Jun 1 '16 at 15:54
  • @bsayegh That's complaining about the directory permissions, not the authorized_keys file. Use chmod 700 ~/.ssh. – Barmar Jun 1 '16 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.