1

After generating a new ssh private key (id_rsa) on one server and distributing it across a server network, one server is failing to use the new key, and falls back to password authentication instead.

Copying the id_rsa to a new file and using it instead works.

$ ssh -i id_rsa user@server
user@server's password:
$ cp id_rsa id_rsa.copy
$ chmod --reference=id_rsa id_rsa.copy
$ ssh -i id_rsa.copy user@server
Last login: Wed Apr  2 06:30:36 2014 from otherhost
[user@server ~]$

Running ssh -vvv debug:

id_rsa:

debug3: Not a RSA1 key file id_rsa.
...
debug1: identity file id_rsa type 1
...
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-with-mic,password

id_rsa.copy:

debug3: Not a RSA1 key file id_rsa.copy.
...
debug1: identity file id_rsa.copy type -1
...
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: id_rsa.copy
debug1: read PEM private key done: type RSA
debug3: sign_and_send_pubkey
debug2: we sent a publickey packet, wait for reply
debug1: Authentication succeeded (publickey).

So for some reason OpenSSH is handling the key files differently. But why?

1 Answer 1

0

Turns out the server that experienced the problem had both id_rsa and id_rsa.pub key files copied before. While copying the new key files I only overwrote id_rsa leaving id_rsa.pub in place. This caused ssh to use id_rsa incorrectly.

Removing id_rsa.pub or updating it with the correct version solved the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.