42

I have a public/private key pair. Neither of them have any sort of passphrase associated with them.

Whenever I try to ssh using either the private or public(and I'm pretty sure I should only be using the public key), I get queried for a passphrase, and then of course can't connect up.

Anyone have any idea how to get around this? Am I typing some command incorretly? I am trying to ssh into a server that I have setup in my ~/.ssh/config file(correctly, since this exact same setup works on another server) with the key stored in ~/.ec2/key.ppk

I've also tried using puttygen.exe to generate a new private key WITH a passphrase, and then using that key, and when I type the passphrase, it still fails.

13 Answers 13

32

First off it's the private key that will have the pass-phrase. This validates against the public key stored on the remote server.

Best guess is that your are trying to use a putty private key (ppk) key format with openssh this doesn't work.... PuTTYgen has an export option for openssh if this is the case.

ssh-rsa AAAAB3NzaC1y...... etc

I also assume that the server you are trying to ssh to has your public key stored correctly in the authorized key file (in ~/.ssh/authorized_keys generally).

Another guess would be that the correct key isn't be selected. Some things I would try are:

Resetting the keys pass-phrase using ssh-keygen, like this...

$ ssh-keygen -f ~/.ec2/key.ppk -p

This will confirm if in fact your key does (or does not) have a pass-phrase on it already.

Secondly I'd try connecting using a verbose output, specifying your public key explicitly output:

$ ssh host -i ~/.ec2/key.ppk -vvv

This will give you more of an idea of what is going on.

5
  • Correct, this is a key generated by puttygen from a key that works in putty. When I putty into the same server(from the machine that hosts the cygwin instance) it works fine with the exact same key. When i try to connect via ssh from cygwin, it bombs out. I'm confused how to make this work.
    – llaskin
    Jun 25, 2010 at 13:38
  • 7
    I think mrverrall's points is that the file format for the PuTTY private key is not the same as the file format used for OpenSSH (the ssh client in cygwin). So OpenSSH is just failing to use the private key data because it can't figure out what the data means. But PuTTY has an "export" option, so you can get data in the "PEM" format needed.
    – Phil P
    Jan 23, 2011 at 21:44
  • This error also is given if the file is in correct format - so double and triple check you copied and pasted properly if manually creating it. Sep 3, 2015 at 19:40
  • Is ssh-rsa AAAAB3NzaC1y...... etc is the format from openssh, right? I have this format in my private key. The header states: PuTTY-User-Key-File-2: ssh-rsa Encryption: none Comment: imported-openssh-key Public-Lines: 6 But the file is stored as a id_rsa file. Does this mean that this is still in .ppk format, even though the name of the file is just id_rsa
    – alpha_989
    Jan 15, 2018 at 14:59
  • Found out the answer for the different formats here. In my case even though the extension of the file didnt have .ppk, it still was in putty format, which confused me, as it was showing all kinds of errors, but not giving me any direct hint that the problem was with the format of the key: stackoverflow.com/a/44391850/4752883
    – alpha_989
    Jan 15, 2018 at 16:12
21

You could run ssh-agent. See here for a discussion.

The short version that worked for me (in bash):

$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-rnRLi11880/agent.11880; export SSH_AUTH_SOCK;
SSH_AGENT_PID=11881; export SSH_AGENT_PID;
echo Agent pid 11881;

I took the 3 lines it echoes out, and executed them. Another way to do that is take the output of -s:

$ eval `ssh-agent -s`

Then I added my credentials to it:

$ ssh-add ~/.ssh/id_rsa
Enter passphrase for /home/me/.ssh/id_rsa: 
Identity added: /home/me/.ssh/id_rsa (/home/me/.ssh/id_rsa)

Now the agent supplies the credentials instead of me having to type in my passphrase.

I believe ssh-agent goes away when the shell does, so this should be scripted upon startup for maximum convenience. The link I shared describes scripting as well.

8

Check that the private key id_rsa doesn't have extra line breaks at the end, in some cases extra line breaks will make ssh-keygen to ask for the passphrase, try this:

sed  '/^$/d' /path/to/key > id_rsa

test:

ssh-keygen -yf id_rsa
1
  • 2
    OMG this was my problem. an extra newline after the -----END RSA PRIVATE KEY----- was causing it to ask for the passphrase on a key that didn't have one set!
    – edk750
    Jan 29, 2019 at 2:06
4

When you set up your public key, you probably (perhaps inadvertently) set it up with a passphrase.

You probably need to start fresh -- I haven't used puttygen, but you can delete (or rename) the public key in your .ssh directory, use ssh-keygen to generate a new one (being sure not to provide a passphrase), and then share the public_key out to the authorized_keys file on the server you're trying to connect to.

You may need to also remove your old passphrase-key from the authorized-keys file on the server you're connecting to.

3

One thing to check, if your sshd_config file has StrictModes=yes , then the $HOME directory or $HOME/.ssh directory must not be world writable to group or other. Otherwise authentication fails no matter what.

3

I ran into this problem the other day. Specifically, I was trying to copy/paste a private AWS key from one machine to another.

I have a bad habit of either missing the first or last character. It turns out that if you don't grab every hyphen at the end of your private key–even though it has nothing to do with the key text itself–you will be prompted for a passphrase for the private key until add every character from the key you copied from (in my case this meant adding a a single hyphen to the end of the key.)

I suppose this means that best practice is to SSH the text file across the wire instead of trying to copy and paste between Terminal windows.

1

I made the mistake of accidentally overwriting my ~/.ssh/id_rsa file with my ~/.ssh/id_rsa.pub. Doing that will cause ssh to ask for a pass phrase.

1

On OSX I was able to just run:

$ ssh-add ~/.ssh/id_rsa Enter passphrase for /Users/me/.ssh/id_rsa: `Identity added: /Users/mikekilmer/.ssh/id_rsa (/Users/mikekilmer/.ssh/id_rsa)

The password was stored by the Keychain Access application, which is in the Applications > Utilities folder. I just entered id_ in the search field.

1
  • 1
    You have to add -K (ssh-add -K) to store password in keychain otherwise password is not stored (i don't know in which release apple changes that).
    – Stephane
    Apr 23, 2020 at 11:38
0

Try viewing the log files on the server. See /var/log/authlog (e.g., /var/log/authlog for OpenSSH, although I've seen some operating systems use Portable OpenSSH and use /var/log/auth.log) and check the end of that file.

The most common causes I've seen are incorrect permissions (as noted by TD1's answer), although other issues could be with the public key (stored on the server) not being in the right file, or that key being commented out, or a misspelled username.

It may also be helpful (for troubleshooting) to give the account a passphrase temporarily, just to verify that the account can be successfully logged in when you do that.

If viewing the log file doesn't quickly lead you to a resolution, I suggest posting a new question (since this is a great generalized question) which does include the specific details from the log file, so that more specific directions can be provided.

0

On my team, when this happens it isn't an issue with anything locally. The user's ssh key and/or access hasn't been configured correctly on the server they're connecting to (in our case a hosting platform). For some reason this triggers a prompt for a non-existent ssh key.

0

You might be using the wrong key.

The public key is not the one to use from the client side. The client creates the private key and stores the public key on the server. If you want to log in from another client you need to use the private key of the first client.

0

If it is confirmed that the same key never asked for a passphrase, then the key file might have got tampered with. Just check for any spaces or newlines at the beginning of the file or end of the file or if any characters got deleted at the beginning or end (apart from checking the rest of the contents are as good as they should be).

In other words:

The SSH key file should begin with five dashes ----- (the very first character on the file should be - not a space or new line) and should end with five dashes ----- (the last character on the file should be - not a space or a new line) without any additional whitespaces or new lines before or after

-----BEGIN RSA PRIVATE KEY-----
...
...
...
-----END RSA PRIVATE KEY-----
0

In some cases (it was my case) you just need to add your private key identity (normally ~/.ssh/id_rsa) to your ssh agent, namely simply by running

ssh-add

Not the answer you're looking for? Browse other questions tagged or ask your own question.