1

I try SSH key authentification for Hetzner backup spaces. First, I generate public and private keys in my machine, then use this command:

server> cat .ssh/id_rsa.pub >> storagebox_authorized_keys

After this command

echo -e "mkdir .ssh \n chmod 700 .ssh \n put storagebox_authorized_keys .ssh/authorized_keys \n chmod 600 .ssh/authorized_keys" | sftp <username>@<username>.your-storagebox.de

I have an error after logging sftp:

Load key "/root/.ssh/id_rsa.pub": invalid format

Debug:

OpenSSH_7.6p1 Ubuntu-4ubuntu0.2, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: /etc/ssh/ssh_config line 53: Applying options for user.your-backup.de
debug1: Connecting to user.your-backup.de [2a01:4f8:b19:3000::14] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa.pub type 0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa.pub-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.2
debug1: Remote protocol version 2.0, remote software version mod_sftp
debug1: no match: mod_sftp
debug1: Authenticating to user.your-backup.de:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-rsa SHA256:EXMPL
debug1: Host 'user.your-backup.de' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:EXMPL /root/.ssh/id_rsa.pub
debug1: Server accepts key: pkalg ssh-rsa blen 279
Load key "/root/.ssh/id_rsa.pub": invalid format
debug1: Next authentication method: password

What can I do to resolve this problem?

UPD: content of id_rsa.pub: ssh-rsa string with slash and symbols

Command line that generates that debug output: ssh -v user@user.your-backup.de. Content of both files identical.

UPD2: After deleting next lines in /etc/ssh/ssh_config

Host user.your-backup.de
    User u198752
    IdentityFile  ~/.ssh/id_rsa.pub

I generate new ssh-key without passphrase for key and got new error:

debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to user.your-backup.de [2a01:4f8:b19:3000::14] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.2
debug1: Remote protocol version 2.0, remote software version mod_sftp
debug1: no match: mod_sftp
debug1: Authenticating to user.your-backup.de:22 as 'u198752'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-rsa SHA256:exmpl 
debug1: Host 'user.your-backup.de' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:2
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:lexmpl /root/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password

UPD3: I did all the steps from the beginning: created a new key pair, moved the public key to authorized_keys, returned ssh_config to its original state. Now the last line of debug output is:

debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:EXMPL /root/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
  • 1
    Are the contents of both files, id_rsa.pub and storagebox_authorized_keys, identical? – Christoph Sommer Feb 27 at 17:46
  • @ChristophSommer yes, it is. I also try to copypaste it by WinSCP – Kate Gurman Feb 27 at 17:56
  • @RalfFriedl ssh-rsa string with slash and symbols – Kate Gurman Feb 27 at 18:06
  • @RalfFriedl ssh -v user@user.your-backup.de – Kate Gurman Feb 27 at 18:08
  • @RalfFriedl get it! – Kate Gurman Feb 27 at 18:15
2

The problem is on your local computer, not on the Hetzner backup space.

If you don't specify an identity file when invoking ssh, there has to be a wrong name in one of your configuration files. It tries to load the public key as a private key.

Try

ssh -v -F /dev/null user@user.your-backup.de

For reference, compare to this command:

$ ssh -v -i /etc/issue user@user.your-backup.de
OpenSSH_7.6p1 Ubuntu-4ubuntu0.2, OpenSSL 1.0.2n  7 Dec 2017
...
Load key "/etc/issue": invalid format

The option -i is used to specify the private key, so somewhere in your configuration there has to be something that tries to load the private key from /root/.ssh/id_rsa.pub, but the file contains a public key.

Edit

To address some of the confusion in your comments:

  • You can create a key pair with ssh-keygen. This saves the public key in id_rsa.pub and the private key in id_rsa (unless you specify otherwise).
  • The private key is meant to stay private and never leaves your system.
  • The public part is copied to the authorized_keys file on the target system, not the private key.
  • You should not change the common part of ssh_config, Host *, unless you know what you are doing.
  • The suggestion with -F /dev/null was just meant to avoid loading your faulty configuration, not for real use.
  • Okay, how can i fix it? Is this done in the ssh config file? – Kate Gurman Feb 27 at 18:22
  • If the first command works for you, then there is a problem with your configuration files. Assuming you didn't change the generic part, I would look at "/etc/ssh/ssh_config line 53: Applying options for user.your-backup.de". – RalfFriedl Feb 27 at 18:24
  • First command requested passphrase for key, but I don't know it. It's not a problem, I can generate new key-pair. I found in config next line: Host user.your-backup.de User user IdentityFile ~/.ssh/id_rsa.pub . – Kate Gurman Feb 27 at 18:26
  • Line 53 commented. – Kate Gurman Feb 27 at 18:29
  • The IdentityFile should be ~/.ssh/id_rsa, which is also the default and therefor not necessary. – RalfFriedl Feb 27 at 19:32
-1

Thanks for the help, but I decided to use the information from this lesson and it helped.

Edit: Use this bash script and keychain:

#!/bin/bash
# Remote Server Rsync backup Replication Shell Script
# Local dir location
LOCALBAKPOINT=/iscsi
LOCALBAKDIR=/backups/server1.nixcraft.net.in/wwwroot
# Remote ssh server setup
SSHUER=root
SSHSERVER=server1.nixcraft.net.in
SSHBACKUPROOT=/wwwroot

# Make sure you can log in to remote server without a password
source $HOME/.keychain/$HOSTNAME-sh 

# Make sure local backup dir exists
[ ! -d ${LOCALBAKPOINT}${LOCALBAKDIR} ] && mkdir -p ${LOCALBAKPOINT}${LOCALBAKDIR}

# Start backup 
/usr/bin/rsync --exclude '*access.log*' --exclude '*error.log*' -avz -e 'ssh ' ${SSHUER}@${SSHSERVER}:${SSHBACKUPROOT} ${LOCALBAKPOINT}${LOCALBAKDIR}

# See if backup failed or not to /var/log/messages file
[ $? -eq 0 ] && logger 'RSYNC BACKUP : Done' || logger 'RSYNC BACKUP : FAILED!'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.