Scenario:

Client machine upgrades from OS X 10.7.5 to 10.8.4.

Multiple private keys.

I am invoking the secondary key using ssh -i /path/to/pem existinguser@knownhost - which works fine.

on knownhost server, I have created newuser, and added that same pubkey to it as well.

I have confirmed that permissions on the directories and key files on both the server and client are correct (700 for the .ssh dir, 600 for the authorized_keys and pem files).

When I use the same syntax but change existinguser to newuser, authentication fails.

When I use ssh -vv to look at what's happening, here are the two outputs for both attempts:

existinguser:

debug1: Trying private key: /path/to/pem
debug1: read PEM private key done: type RSA
debug2: we sent a publickey packet, wait for reply
debug1: Authentication succeeded (publickey).

newuser:

debug1: Trying private key: /path/to/pem
debug1: read PEM private key done: type RSA
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

Same key. Correct permissions on both ends.

Here's the kicker: I have this key on a different machine which I also upgraded from 10.7.5 to 10.8.4 at the same time. This second machine can login successfully to both users without a problem.

The difference, as near as I can tell, is that the second machine uses the key as its primary id_rsa key in .ssh, whereas I'm calling the key file using -i on the problem machine.

I'll hard define it if I must, but I'd rather get to the bottom of why it's even a problem at all. For the record, this worked fine in 10.7.5.

Has anyone seen this, or know of a way to troubleshoot further or resolve it?

  • Try chmod to your key to 400 chmod 400 /path/to/pem and retry – Kit Ho Jul 23 '13 at 7:20
  • ssh wouldn't even use the key if it had wrong permissions. – slhck Jul 23 '13 at 10:39
  • Do you have a custom configuration defined for that host? ~/.ssh/config – spuder Aug 19 '13 at 4:01
  • @slhck Define wrong permissions. Perhaps 10.7 accepts 700 whereas 10.8 requires 400. I don't know if it's true, but it's not entirely implausible. – nitro2k01 Dec 20 '13 at 12:45
  • @nitro2k01 Too open permissions will probably not work. I don't know which exactly though – can't test it now. – slhck Dec 20 '13 at 13:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.