sshd refuses publickey although matched?

Question

I'm using OpenSSH 6.8 shipped with DSM 6 on my Synology NAS as a server, and OpenSSH 7.3p1 on my Arch Notebook as a client. I can login as the default user admin via password, but not via key, and can't figure out why.

The strange thing is: the server seems to accept my public key, but still postpones it?

...
debug1: userauth-request for user admin service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: test whether pkalg/pkblob are acceptable [preauth]
debug1: temporarily_use_uid: 1024/100 (e=0/0)
debug1: trying public key file /var/services/homes/admin/.ssh/authorized_keys
debug1: fd 5 clearing O_NONBLOCK
debug1: matching key found: file /var/services/homes/admin/.ssh/authorized_keys, line 1 RSA SHA256:Kq+mYIESxPced3WZ0/GXkKeYxzn5aLI8P0S8MoVPll4
debug1: restore_uid: 0/0
Postponed publickey for admin from <client IP> port 43226 ssh2 [preauth]
...

I've already tried several restarts of both machines and the sshd, and nearly all possible access permissions on user admin's home folder and it's .ssh directory. But that doesn't seem to be the issue. What's faulty here?

Any ideas are greatly appreciated! Thanks in advance,
Lukas

EDIT: The client says: "agent refused operation" after probing the key:

debug1: Offering RSA public key: /home/client/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp SHA256:Kq+m***
debug3: sign_and_send_pubkey: RSA SHA256:Kq+m***
sign_and_send_pubkey: signing failed: agent refused operation

Furthermore, I've uploaded the complete output of both the verbose client and server sessions here.

Answer 1

This is most probably an issue with the key file permissions on your server. Make sure your .ssh-folder, the files within, and the home directory where the .ssh-folder is in, have restrictive permissions. OpenSSH server refuses key operations if permissions on these are too permissive. That means, anything beyond 700 is often refused.

OpenSSH server does print warnings if the permissions are incorrect, but only as debug level 3, so they don't appear in normal output or in normal debug mode. Furthermore, permission warnings only appear as soon as someone tries to connect. Run sshd -D -ddd -e to enable third level debugging and make OpenSSH print warnings on key file permissions. Make sure to stop your OpenSSH server before in case it's running.

OpenSSH server will then wait for any incoming connection, but won't fork into background, so all output is printed to stdout. Therefore you can watch OpenSSH server while trying to establish an SSH connection from one of your clients. In case you see permission warnings as soon as you try to log in, try these commands to fix your permissions:

chmod 700 ~
chmod 700 -R ~/.ssh

where ~ is the home directory of the user you want to access via ssh.

Restart your OpenSSH server afterwards and see if the issue is fixed :)

Answer 2

debug1: Server accepts key: pkalg ssh-rsa blen 279

This is just test to match the keys

sign_and_send_pubkey: signing failed: agent refused operation

to gain access, you need to prove possession of the private key, which your ssh-agent failed and therefore you are rejected.

What is your ssh-agent and where does it take its keys?