1

I set my ssh-public-key in authorized_keys.

Note: The same key has worked in another server

and then set

authorized_keys 0644
.ssh 0600 

Is there anything I need to do ?

These are the ssh verbose log below.

I updated the log more detailed use -vvv option

OpenSSH_7.4p1, LibreSSL 2.5.0
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: resolving "whitebear.vs.sakura.ne.jp" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to whitebear.vs.sakura.ne.jp [153.126.185.74] port 22.
debug1: Connection established.
debug1: identity file /Users/whitebear/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/whitebear/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/whitebear/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/whitebear/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/whitebear/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/whitebear/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/whitebear/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/whitebear/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 5 setting O_NONBLOCK
debug1: Authenticating to whitebear.vs.sakura.ne.jp:22 as 'whitebear'
debug3: hostkeys_foreach: reading file "/Users/whitebear/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/whitebear/.ssh/known_hosts:58
debug3: load_hostkeys: loaded 1 keys from whitebear.vs.sakura.ne.jp
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: MACs ctos: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: MACs stoc: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:w0dV1hhjGfRhwief8u5GxHgPw1fnUMANPA7xyjJpOvY
debug3: hostkeys_foreach: reading file "/Users/whitebear/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/whitebear/.ssh/known_hosts:58
debug3: load_hostkeys: loaded 1 keys from whitebear.vs.sakura.ne.jp
debug3: hostkeys_foreach: reading file "/Users/whitebear/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/whitebear/.ssh/known_hosts:58
debug3: load_hostkeys: loaded 1 keys from 153.126.185.74
debug1: Host 'whitebear.vs.sakura.ne.jp' is known and matches the ECDSA host key.
debug1: Found key in /Users/whitebear/.ssh/known_hosts:58
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /Users/whitebear/.ssh/id_rsa (0x7ffda8e01220)
debug2: key: /Users/whitebear/.ssh/id_dsa (0x0)
debug2: key: /Users/whitebear/.ssh/id_ecdsa (0x0)
debug2: key: /Users/whitebear/.ssh/id_ed25519 (0x0)
debug3: send packet: type 5
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/whitebear/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /Users/whitebear/.ssh/id_dsa
debug3: no such identity: /Users/whitebear/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /Users/whitebear/.ssh/id_ecdsa
debug3: no such identity: /Users/whitebear/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /Users/whitebear/.ssh/id_ed25519
debug3: no such identity: /Users/whitebear/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

I added the log ls -lsa also.

8 -r--------  1 whitebear  staff  1679  7 10  2014 /Users/whitebear/.ssh/id_rsa
8 -rw-r--r--  1 whitebear  staff   424  7 10  2014 /Users/whitebear/.ssh/id_rsa.pub
8 -rw-r--r--@ 1 whitebear  staff   382  4 28 16:20 /Users/whitebear/.ssh/id_rsa.pub_mixhost

I also checked out these three lines are written in /etc/ssh/sshd_config

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      ~/.ssh/authorized_key
  • Did you put your public key, into the authorised keys file? Made sure there's no extra spaces or anything like that? You'll want to look at the servers log files to see what's going wrong. – djsmiley2k TMW May 3 '17 at 5:43
  • Yes, I checked I set public key correctly. and checking /var/log/secure ... – whitebear May 3 '17 at 6:52
1

There seems to be two issues here:

  1. Client side

You should place your private key in the client host (the one you are running the ssh client` in:

/.ssh/id_rsa

/.ssh/id_rsa permission should be only readable by you:

chmod 400 ~/.ssh/id_rsa
  1. Server Side

According to your question you set the Server.ssh folder permission to be 600, the proper permission should be 700 - which includes execute (or change-dir).

Please change the .ssh folder permission to be 700, e.g. by:

chmod 700 ~/.ssh

You can review Ubuntu OpenSSH page which also mentioned that the ~/.ssh folder permission should be 700

Please note that the same OpenSSH page also recommend that authorized_keys file permission will be 600 (read/write by owner):

chmod 600 ~/.ssh/authorized_keys

Copy public key using ssh-copy-id

One easy way to copy the public key from the client to the SSH Server is using ssh-copy-id:

ssh-copy-id is a command that automates transfer of your public key to the server. To perform the transfer you will need to log in, so do not disable password authentication until after you confirm the key is working.

ssh-copy-id -i key_name user@server

ssh-copy-id -i id_rsa bodhi@ssh.server.com
  • I changed each permissions and confirm it corrects. however it doesn't work... – whitebear May 3 '17 at 6:53
  • @whitebear - please edit your question, with the output of ssh command after the changes you made – Yaron May 3 '17 at 7:28
  • I added the log to the question after changing permissions. – whitebear May 3 '17 at 7:33
  • please execute ls -lsa ~/.ssh/id_rsa* on your client machine (which execute the ssh command), and add the output to your question – Yaron May 3 '17 at 7:35
  • 1
    @whitebear may be worth including a log showing the errors, when trying to do ssh, now that you have run ssh-copy-id it claimed success, and auto logging in with ssh is still not working – barlop May 3 '17 at 12:03
0

You have not mentioned your distro etc, but I have frequently come across similar problems on (correctly configured) Centos 6 systems. The issue is down to SELinux. Try temporarily disabling SELinux and see if it fixes the problem. If it does, ensure you are running the latest version and relabeling the filesystem to update the ssh permissions.

  • > getenforce returns Disabled. My Selinux seems not working – whitebear May 3 '17 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.