1

I'm trying to setup ssh auto-login using rsa keys on Raspberry PI (raspbian Jesse). Almost everything I find says to create keys on local machine (ssh-keygen), append the public key to the remote's .ssh/authorized_keys file and make sure that file's permissions set to 640 or 600.

I've done all that but still get prompted for password when ssh'ing.

I performed these actions on the local machine as user foo:

~$ cd .ssh
~/.ssh$ ssh-keygen -t rsa (hit enter through all the prompts)
~/.ssh$ cat id_rsa.pub | ssh bar@remote.local 'cat >> .ssh/authorized_keys'
bar@remote.local's password: //prompted here

From another terminal that was already ssh'd to remote I verified that foo's public key was appended to bar's authorized_keys.

Tried ssh'ing as user foo to remote as user bar from a new terminal.

~$ ssh bar@remote.local
bar@remote.local's password: //prompted here

Auto login did not work. So then I found this site http://www.rebol.com/docs/ssh-auto-login.html. Followed the instructions and it works. But this sounds opposite of what I would have thought. That site says to create the keys on the remote and append the public key to the remote's authorized_keys file then download the remote's private key to the local machine and use it as an identity file.

Is that correct? Why would someone want to cp a private key to another machine? I thought the private key should stay on the machine it was created for and should be protected.

Here are the instructions for the linked page in case it moves

On server:

cd .ssh
ssh-keygen -t rsa  (hit return through prompts)
cat id_rsa.pub >> authorized_keys
chmod 600 authorized_keys
rm id_rsa.pub

On client:

cd .ssh
scp myserver.com:.ssh/id_rsa myserver.rsa
chmod 600 myserver.rsa
echo "Host myserver" >> config
echo "Hostname reblets.com" >> config
echo "IdentityFile ~/.ssh/myserver.rsa" >> config
  • arghh!! found my problem. I had IdentityFile set to a different server's file for work and it wasn't using my local machine's identity file. – km1 Apr 10 '17 at 22:26
0

The second way is (slightly) less secure as the private key exists in places it need not - but both do the same thing.

I wonder if you are running into an selinux + Redhat/Centos bug - which generally requires upgrading Centos with yum upgrade, then relabelling the filesystem (relabelling fixfiles or similar). You can check if this is the issue by temporarily disabling selinux.

  • updated question and tags with OS. (raspbian Jesse) – km1 Apr 9 '17 at 19:44
  • davidgo, thanks for the advice, I actually came across that in my searching for answer. I overlooked the fact that I had default IdentityFile pointing to a different rsa file. Found this out by using the -v option with ssh. – km1 Apr 10 '17 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.