2

I'm really stuck here. I've been trying to ssh into my ec2 server from local with a public key but it is not working. -> I get permission Denied (public key).

The set up is as follows: Local: generated public key pair and copied contents of id_rsa.pub. Remote: ssh-ed into my EC2 server with the PEM file and pasted id_rsa.pub contents into new line of authorized keys file in .ssh folder.

Should work right? I noticed a common mistake is permissions, but mine seem to be set correctly:

Remote Permissions:

drwx------ 2 ec2-user ec2-user  4096 Jul 23 04:00 .ssh

and in .ssh:

-rw-r--r-- 1 ec2-user ec2-user  404 Jul 24 03:19 id_rsa.pub
-rw------- 1 ec2-user ec2-user 1679 Jul 24 03:19 id_rsa
-rw------- 1 ec2-user ec2-user  529 Jul 26 20:53 authorized_keys

Local:

drwx------    10 robvanhaaren  staff    340 Jul 26 18:43 .ssh

and in .ssh:

-rw-r--r--  1 robvanhaaren  staff   404 Jul 26 21:28 id_rsa.pub
-rw-------  1 robvanhaaren  staff  1766 Jul 26 21:28 id_rsa
-rw-r--r--  1 robvanhaaren  staff  5987 Jul 26 21:29 known_hosts

But when I run:

Robs-MacBook-Air-2:.ssh robvanhaaren$ ssh ec2-54-85-62-99.compute-1.amazonaws.com -l ec2-user -v

it returns:

OpenSSH_5.9p1, OpenSSL 0.9.8y 5 Feb 2013
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to ec2-54-85-62-99.compute-1.amazonaws.com [54.85.62.99] port 22.
debug1: Connection established.
debug1: identity file /Users/robvanhaaren/.ssh/id_rsa type 1
debug1: identity file /Users/robvanhaaren/.ssh/id_rsa-cert type -1
debug1: identity file /Users/robvanhaaren/.ssh/id_dsa type -1
debug1: identity file /Users/robvanhaaren/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 7a:d3:6c:7f:64:5d:b1:7b:2e:bb:73:0c:ce:0c:17:77
debug1: Host 'ec2-54-85-62-99.compute-1.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /Users/robvanhaaren/.ssh/known_hosts:15
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/robvanhaaren/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /Users/robvanhaaren/.ssh/id_dsa
debug1: No more authentication methods to try.
Permission denied (publickey).

The strange thing is that I CAN log in with public key to the server from my other ec2 server. So the problem seems to be on my local machine, not the remote.

Please help!

  • 1
    Have you checked /var/log/auth.log? Are there any relevant logs? – Valmiky Arquissandas Jul 27 '14 at 2:13
  • Are you using the same set of keys to log in from your other ec2 server? – heavyd Jul 27 '14 at 6:17
  • 2
    maybe you didn't add to authorized_keys properly. ssh-copy-id can do it automatically. First enable user/pass login i.e. PasswordAuthentication yes in sshd_config, and you can then use ssh-copy-id user@host then it will automatically add to authorized_keys, and next time it will use the key, and you can turn off user/pass login if you want – barlop May 4 '15 at 19:54
2

SSH issues can be a hassle. I always start with the following. I have the commands saved in a cheat sheet so I never have to fear typo's.

chmod 700 ~/.ssh && chmod 600 ~/.ssh/* \
&& chmod 644 ~/.ssh/authorized_keys \
&& chown -r <username>:<username> /home/<username>/.ssh \
&& chown -r <username>:<username> /home/<username>/.ssh/*

If that doesn't work, I'd remove authorized_keys and re create it (mind the ownership & permissions), making sure to copy the contents from notepad, or another proper text editor. Wordpad and other fat editors can mess keys up. You can also remove the remote host's entry from the known_hosts file. I remember having to do that once for something.

  • you write "If that doesn't work, I'd remove authorized_" <-- you mean authorized_keys – barlop May 4 '15 at 19:51
  • Yes, authorized_keys ^_^ (editing) – Alex Atkinson May 4 '15 at 20:00
  • It looks like the authorized_keys and id_rsa.pub files are different sizes - I would think that is the issue here. – Jacob Hume May 4 '15 at 20:27
  • @JacobHume you should elaborate on that statement, since authorized_keys may have that id_rsa.pub and more – barlop May 4 '15 at 21:09
  • You write "You can also remove the remote host's entry from the known_hosts file" <-- or remote the known_hosts file. Though the known_hosts issue is not the issue in his question.. The known_hosts issue is a dfiferent error something about a key changing.. – barlop May 4 '15 at 21:13
1

Make sure you check /var/log/auth.log as stated in the comment. Almost always you will find your answer there.

I have these permissions set for my servers and locally:

Server

drwx------ remoteuser group ~/.ssh
-rw------- remoteuser group ~/.ssh/authorized_keys

Locally

drwx------ user group ~/.ssh
-rw------- user group ~/.ssh/id_rsa
-rw----r-- user group ~/.ssh/id_rsa.pub
  • Out of curiosity, why is your authorized_keys file others readable? Isn't the authorized_keys file supposed to be 600? – JW0914 Jun 20 '18 at 1:02
  • Good catch. This is a really old response, and I should probably edit it. – Overbryd Jun 20 '18 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.