1

I have two users on the same machine and am attempting to set up SSH for user#2. SSH was still asking for a password for the second user so I copied the .rsa file from user#1 to user#2. although they have identical files and permissions and although no password is asked of user#1, SSH still asks for a password from user#2. What could cause two users on the same machine with identical .rsa files to have different responses from SSH?

2
  • 1
    The output of ssh -v when user2 tries to log in would be useful, as well as ls -la ~/.ssh for user2. Are both user1 and user2 logging in as the same user on the remote machine?
    – mgorven
    Jun 3, 2012 at 0:00
  • login was as different users on the same remote machine. Jun 3, 2012 at 4:27

3 Answers 3

3

All the directories starting from root and up to the .ssh directory in your home directory must not have write permission for either 'group' or 'other'. This is a requirement of ssh for added security. If the permissions were not so set, an attacker would have a means to get in and modify or copy the .ssh, starting from the first directory to which they had write permissions, and copy the private key to another user of their choosing or update the keys to be of their choosing and thus allow themselves to spoof you and log in as you using ssh and not being asked for the password. Therefore, the .ssh keys fail to work if they are not properly protected with adequate permissions.

2

I am answering under the assumption that user1 and user2 are on a remote server and that you are connecting to that using a private key locally.

If you are instead trying to use a local user1/user2 account to connect to a remote server then my answer does not apply.


On the remote server you need to add the contents of the public key to:

~/.ssh/authorized_keys

The contents of the file will then look something like this:

enter image description here

1
  • This was an issue previously, but i had already accounted for the authorized_keys. Jun 3, 2012 at 4:25
2

Someone gave a reasonable answer before (they must have deleted it) suggesting that the permissions for .rsa and the included files were incorrect. Although this was not the issue it was very nearly correct. It turns out that all folders leading to .rsa need to have proper permissions.

Once I made them the same the prompt-less ssh works, prompting to accept the host key the first time but not on the next connection.

[root@computer ~]# ls -ld /home/user2 /home/user1

drwxrwx--- 24 user2 user2  4096 Jun  2 13:13 /home/user2
drwxr-xr-x 97 user1 user1 12288 Jun  2 13:06 /home/user1



[root@computer ~]# chmod -v 755 /home/user2

mode of `/home/user2' changed to 0755 (rwxr-xr-x)



[root@computer ~]# ls -ld /home/user2 /home/user1

drwxr-xr-x 24 user2 user2  4096 Jun  2 13:13 /home/user2
drwxr-xr-x 97 user1 user1 12288 Jun  2 13:06 /home/user1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .