2

I'm kind of stuck here..

I am trying to disable all SSH login capabilities of root. No password login. No key-based login. Nothing. I have a user "andrew" that should only be able to SSH into my server with the private key.

Here's what I've done so far:

(on my laptop) ssh-keygen -b 4096 -t rsa
(on my laptop) cat id_rsa.pub | ssh root@server.com "cat >> /home/andrew/.ssh/authorized_keys"
(on my server) Modified /etc/ssh/sshd_config in the following ways:
    - PermitRootLogin no
    - PasswordAuthentication no
    - AuthorizedKeysFile      /home/%h/.ssh/authorized_keys
(on my server) reload ssh

When I attempt to connect to my server from my laptop, I get the following (the errors are towards the end):

andrew@andrew-asus ~/.ssh $ ssh -vvv -i id_rsa andrew@server.com
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to server.com [XXXXXXXXX] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "id_rsa" as a RSA1 public key
debug1: identity file id_rsa type 1
debug1: identity file id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "server.com" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: setup hmac-md5-etm@openssh.com
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug2: mac_setup: setup hmac-md5-etm@openssh.com
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 50:4a:6c:d9:62:82:c6:59:32:55:b9:43:09:8d:7b:07
debug3: load_hostkeys: loading entries for host "server.com" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "XXXXXXXX" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'server.com' is known and matches the ECDSA host key.
debug1: Found key in /home/andrew/.ssh/known_hosts:2
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: id_rsa (0x7f7c55f5cda0), explicit
debug2: key: andrew@andrew-asus (0x7f7c55f61950),
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: andrew@andrew-asus
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

Here is the command I run on my computer to connect:

(inside the ~/.ssh dir) ssh -vvv -i id_rsa andrew@server.com

I've tried using ssh-copy-id. I've tried re-creating my keypair. Deleting the "authorized_keys" entries on the server. Deleting the "known_hosts" entries on the laptop. I'm lost.

Here is a full copy of the sshd_config file on the server:

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      /home/%h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

Thanks to anyone who can help me.

EDIT: Here is the output of my auth.log file when sshd is running under DEBUG loggin mode. It looks like it can't find my "authorized_keys" file..

May 21 22:29:47 server sshd[13613]: debug1: Bind to port 22 on 0.0.0.0.
May 21 22:29:47 server sshd[13613]: Server listening on 0.0.0.0 port 22.
May 21 22:29:47 server sshd[13613]: debug1: Bind to port 22 on ::.
May 21 22:29:47 server sshd[13613]: Server listening on :: port 22.
May 21 22:29:50 server sshd[13613]: debug1: Forked child 13615.
May 21 22:29:50 server sshd[13615]: Set /proc/self/oom_score_adj to 0
May 21 22:29:50 server sshd[13615]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
May 21 22:29:50 server sshd[13615]: debug1: inetd sockets after dupping: 3, 3
May 21 22:29:50 server sshd[13615]: Connection from XXXXXXXXXX port 4446 on XXXXXXXX port 22
May 21 22:29:50 server sshd[13615]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 22:29:50 server sshd[13615]: debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
May 21 22:29:50 server sshd[13615]: debug1: Enabling compatibility mode for protocol 2.0
May 21 22:29:50 server sshd[13615]: debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 22:29:50 server sshd[13615]: debug1: permanently_set_uid: 104/65534 [preauth]
May 21 22:29:50 server sshd[13615]: debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_KEXINIT sent [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_KEXINIT received [preauth]
May 21 22:29:50 server sshd[13615]: debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none [preauth]
May 21 22:29:50 server sshd[13615]: debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none [preauth]
May 21 22:29:50 server sshd[13615]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
May 21 22:29:50 server sshd[13615]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_NEWKEYS received [preauth]
May 21 22:29:50 server sshd[13615]: debug1: KEX done [preauth]
May 21 22:29:51 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method none [preauth]
May 21 22:29:51 server sshd[13615]: debug1: attempt 0 failures 0 [preauth]
May 21 22:29:51 server sshd[13615]: debug1: PAM: initializing for "andrew"
May 21 22:29:51 server sshd[13615]: debug1: PAM: setting PAM_RHOST to "XXXXXXXXXX"
May 21 22:29:51 server sshd[13615]: debug1: PAM: setting PAM_TTY to "ssh"
May 21 22:29:51 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 22:29:51 server sshd[13615]: debug1: attempt 1 failures 0 [preauth]
May 21 22:29:51 server sshd[13615]: debug1: test whether pkalg/pkblob are acceptable [preauth]
May 21 22:29:51 server sshd[13615]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 22:29:51 server sshd[13615]: debug1: trying public key file /home//home/andrew/.ssh/authorized_keys
May 21 22:29:51 server sshd[13615]: debug1: Could not open authorized keys '/home//home/andrew/.ssh/authorized_keys': No such file or directory
May 21 22:29:51 server sshd[13615]: debug1: restore_uid: 0/0
May 21 22:29:51 server sshd[13615]: Failed publickey for andrew from XXXXXXXXX port 4446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 22:29:54 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 22:29:54 server sshd[13615]: debug1: attempt 2 failures 1 [preauth]
May 21 22:29:54 server sshd[13615]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 22:29:54 server sshd[13615]: debug1: trying public key file /home//home/andrew/.ssh/authorized_keys
May 21 22:29:54 server sshd[13615]: debug1: Could not open authorized keys '/home//home/andrew/.ssh/authorized_keys': No such file or directory
May 21 22:29:54 server sshd[13615]: debug1: restore_uid: 0/0
May 21 22:29:54 server sshd[13615]: Failed publickey for andrew from XXXXXXXX port 4446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 22:29:54 server sshd[13615]: Connection closed by XXXXXXXXX [preauth]
May 21 22:29:54 server sshd[13615]: debug1: do_cleanup [preauth]
May 21 22:29:54 server sshd[13615]: debug1: monitor_read_log: child log fd closed
May 21 22:29:54 server sshd[13615]: debug1: do_cleanup
May 21 22:29:54 server sshd[13615]: debug1: PAM: cleanup
May 21 22:29:54 server sshd[13615]: debug1: Killing privsep child 13616
May 21 22:30:01 server sshd[13613]: Received signal 15; terminating.

EDIT #2: Looks like something with permissions on the "authorized_keys" file. sshd can find it now, but can't open it. Here's the log:

May 21 23:06:58 server sshd[3880]: debug1: Forked child 3975.
May 21 23:06:58 server sshd[3975]: Set /proc/self/oom_score_adj to 0
May 21 23:06:58 server sshd[3975]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
May 21 23:06:58 server sshd[3975]: debug1: inetd sockets after dupping: 3, 3
May 21 23:06:58 server sshd[3975]: Connection from XXXXXXXXX port 53446 on 96.126.115.73 port 22
May 21 23:06:58 server sshd[3975]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 23:06:58 server sshd[3975]: debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
May 21 23:06:58 server sshd[3975]: debug1: Enabling compatibility mode for protocol 2.0
May 21 23:06:58 server sshd[3975]: debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 23:06:58 server sshd[3975]: debug1: permanently_set_uid: 104/65534 [preauth]
May 21 23:06:58 server sshd[3975]: debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_KEXINIT sent [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_KEXINIT received [preauth]
May 21 23:06:58 server sshd[3975]: debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none [preauth]
May 21 23:06:58 server sshd[3975]: debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none [preauth]
May 21 23:06:58 server sshd[3975]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
May 21 23:06:58 server sshd[3975]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
May 21 23:06:59 server sshd[3975]: debug1: SSH2_MSG_NEWKEYS received [preauth]
May 21 23:06:59 server sshd[3975]: debug1: KEX done [preauth]
May 21 23:06:59 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method none [preauth]
May 21 23:06:59 server sshd[3975]: debug1: attempt 0 failures 0 [preauth]
May 21 23:07:02 server sshd[3975]: debug1: PAM: initializing for "andrew"
May 21 23:07:02 server sshd[3975]: debug1: PAM: setting PAM_RHOST to "XXXXXX"
May 21 23:07:02 server sshd[3975]: debug1: PAM: setting PAM_TTY to "ssh"
May 21 23:07:02 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 23:07:02 server sshd[3975]: debug1: attempt 1 failures 0 [preauth]
May 21 23:07:02 server sshd[3975]: debug1: test whether pkalg/pkblob are acceptable [preauth]
May 21 23:07:02 server sshd[3975]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 23:07:02 server sshd[3975]: debug1: trying public key file /home/andrew/.ssh/authorized_keys
May 21 23:07:02 server sshd[3975]: debug1: Could not open authorized keys '/home/andrew/.ssh/authorized_keys': Permission denied
May 21 23:07:02 server sshd[3975]: debug1: restore_uid: 0/0
May 21 23:07:02 server sshd[3975]: Failed publickey for andrew from XXXXXXX port 53446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 23:07:06 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 23:07:06 server sshd[3975]: debug1: attempt 2 failures 1 [preauth]
May 21 23:07:06 server sshd[3975]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 23:07:06 server sshd[3975]: debug1: trying public key file /home/andrew/.ssh/authorized_keys
May 21 23:07:06 server sshd[3975]: debug1: Could not open authorized keys '/home/andrew/.ssh/authorized_keys': Permission denied
May 21 23:07:06 server sshd[3975]: debug1: restore_uid: 0/0
May 21 23:07:06 server sshd[3975]: Failed publickey for andrew from XXXXXXX port 53446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 23:07:07 server sshd[3975]: Connection closed by XXXXXXXXXX [preauth]
May 21 23:07:07 server sshd[3975]: debug1: do_cleanup [preauth]
May 21 23:07:07 server sshd[3975]: debug1: monitor_read_log: child log fd closed
May 21 23:07:07 server sshd[3975]: debug1: do_cleanup
May 21 23:07:07 server sshd[3975]: debug1: PAM: cleanup
May 21 23:07:07 server sshd[3975]: debug1: Killing privsep child 3976
2

Looks like your authorized_keys file is invalid. You did the cat command while connecting to the server as root, therefore the file will be owned by the root account and not andrew. You need to

chown andrew /home/andrew/.ssh/authorized_keys

Also for future reference, you'd be better off including (and looking at) the SSHD log output from the server with debug output on.

[Edit]

The line:

AuthorizedKeysFile      /home/%h/.ssh/authorized_keys

is also wrong. %h contains the full path to the home directory already, so you are in effect specifying /home/home/username/.ssh.

You should really not modify this setting. The default you get when you comment out the line is fine and does what you want already. Alternatively if you want to specify explicitly, use

AuthorizedKeysFile     %h/.ssh/authorized_keys

OR

AuthorizedKeysFile     /home/%u/.ssh/authorized_keys
  • Thanks for your help. I chown'd the file and things are still not working out for me. I'll update my OP with the log output from sshd – Andrew Paglusch May 21 '15 at 22:25
  • Answer updated - please see edits above. – qasdfdsaq May 21 '15 at 22:32
  • Changed back to %h/.ssh/authorized_keys. Still seeming to have the same issue connecting. I'll post the updated DEBUG output above.. – Andrew Paglusch May 21 '15 at 22:38
  • Are you sure you saved and restarted sshd after changing the %h line? The debug log clearly shows it's still trying /home//home/username/.ssh (i.e. /home/%h/.ssh). Again, I would recommend commenting that line out completely. – qasdfdsaq May 21 '15 at 22:49
  • Added another update to the OP. It's seeing the autorized_keys file now, but can't open it. I've run chmod 700 /home/andrew/.ssh chmod 600 /home/andrew/.ssh/authorized_keys – Andrew Paglusch May 21 '15 at 23:20
0

Problem resolved, thanks to a fellow co-worker of mine. Here's what I had to do:

chown the /home/andrew/.ssh directory for andrew

chmod the /home/andrew/.ssh directory to be the following:

drwx------ 2 andrew root   4.0K May 21 18:03 .ssh

chmod the /home/andrew/.ssh/authorized_keys file in the /home/andrew/.ssh directory to the following:

-rw-r--r-- 1 andrew root  745 May 21 22:21 authorized_keys

The trick was to give other users read permissions to the authorized_keys file.

Thanks to all who helped me with this problem!

-1

Keep in mind the default permissions enforced by sshd with StrictMode. See the second answer in this post for a more detailed explanation.

  • After following qasdfdsaq's suggestion, I changed "StrictMode" to "no". Reloaded ssh and still received the same error. Thanks for your help so far! – Andrew Paglusch May 21 '15 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.