1

I have an OS X 10.6.8 installation that allows ssh into it (but not necessarily much further). However when it comes to ssh out from this installation, it fails in the two instances I can test, both with Permission denied (publickey,password) or Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive).

A sanitized debugging of the connection

ssh -v muser@IP_ADDRESS
OpenSSH_5.2p1, OpenSSL 0.9.8y 5 Feb 2013
debug1: Reading configuration data /Users/muser/.ssh/config
debug1: Applying options for *
debug1: Reading configuration data /etc/ssh_config
debug1: Connecting to IP_ADDRESS [IP_ADDRESS] port 22.
debug1: Connection established.
debug1: identity file /Users/muser/.ssh/id_rsa type 1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2
debug1: match: OpenSSH_5.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'IP_ADDRESS' is known and matches the RSA host key.
debug1: Found key in /Users/muser/.ssh/known_hosts:3
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/muser/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive).

even

MacMini2:~ muser$ ssh muser@SELF_IP
Permission denied (publickey,keyboard-interactive).

It feels as if the public key is not being sent off...

ssh-add -l

returns The agent has no identities. (I am not certain this means anything because the same command on another installation returns the no-identity error, but can ssh to other machines.)
.ssh directory with ls -l returns

-rw-------  1 muser  staff   818 Aug 27 10:49 authorized_keys
-rw-r--r--  1 muser  staff   399 Sep  1 22:39 authorized_keys2
-rw-r--r--@ 1 muser  staff   266 Sep 20 09:15 config
-rw-------  1 muser  staff  1743 Sep 20 09:08 id_rsa
-rw-r--r--  1 muser  staff   412 Sep 20 09:08 id_rsa.pub
-rw-r--r--  1 muser  staff  1589 Sep 20 08:52 known_hosts

the following were run:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa

Keychain Access indicates two sets of keychains (kerberos and systemdefault) both show 1024 bit encryption. I had created via ssh-keygen an RSA 2048-bit key set, but that is apparently not seen by the system.

How do I get ssh running outgoing from this installation?

  • 2
    debug1: Offering public key: /Users/muser/.ssh/id_rsa The client sent the key. The server didn't accept it. You're going to have to investigate the server side to figure out why. – Kenster Sep 20 '14 at 19:27
  • That's what I initially thought, but I find it hard to reconcile with the fact that I cannot ssh self to self_ip ssh muser@SELF_IP – Jerome Sep 20 '14 at 20:59
  • To add another data point. I can ssh root@xxx.62.xx.xx from two other instances (with password) but not from this one. – Jerome Sep 20 '14 at 21:14
  • Kenster, you had the gist of it correct. For some reason I could never send my public key to the server side. I copied it locally, then sent is to the would-be server and ssh is now running. As for the connection to self, I configured sshd_config to PasswordAuthentication yes (previously commented out) to get that running. Curious how defaults for the same OS behave differently (thank you Apple?)... Not fully convinced that this issue will not rear its head anew... – Jerome Sep 21 '14 at 10:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.