0

Scenario:

Client machine upgrades from OS X 10.7.5 to 10.8.4.

Multiple private keys.

I am invoking the secondary key using ssh -i /path/to/pem existinguser@knownhost - which works fine.

on knownhost server, I have created newuser, and added that same pubkey to it as well.

I have confirmed that permissions on the directories and key files on both the server and client are correct (700 for the .ssh dir, 600 for the authorized_keys and pem files).

When I use the same syntax but change existinguser to newuser, authentication fails.

When I use ssh -vv to look at what's happening, here are the two outputs for both attempts:

existinguser:

debug1: Trying private key: /path/to/pem
debug1: read PEM private key done: type RSA
debug2: we sent a publickey packet, wait for reply
debug1: Authentication succeeded (publickey).

newuser:

debug1: Trying private key: /path/to/pem
debug1: read PEM private key done: type RSA
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

Same key. Correct permissions on both ends.

Here's the kicker: I have this key on a different machine which I also upgraded from 10.7.5 to 10.8.4 at the same time. This second machine can login successfully to both users without a problem.

The difference, as near as I can tell, is that the second machine uses the key as its primary id_rsa key in .ssh, whereas I'm calling the key file using -i on the problem machine.

I'll hard define it if I must, but I'd rather get to the bottom of why it's even a problem at all. For the record, this worked fine in 10.7.5.

Has anyone seen this, or know of a way to troubleshoot further or resolve it?

  • Try chmod to your key to 400 chmod 400 /path/to/pem and retry – Kit Ho Jul 23 '13 at 7:20
  • ssh wouldn't even use the key if it had wrong permissions. – slhck Jul 23 '13 at 10:39
  • Do you have a custom configuration defined for that host? ~/.ssh/config – spuder Aug 19 '13 at 4:01
  • @slhck Define wrong permissions. Perhaps 10.7 accepts 700 whereas 10.8 requires 400. I don't know if it's true, but it's not entirely implausible. – nitro2k01 Dec 20 '13 at 12:45
  • @nitro2k01 Too open permissions will probably not work. I don't know which exactly though – can't test it now. – slhck Dec 20 '13 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.