I tried setting up public and private keys on two computers (clementine & cfmi) so that I can ssh between them without using a password. However, I am still being requested for a password despite my inclusion of the public key in the authorized keys file under ~/.ssh.

I can log into the cfmi server when I attempt to connect from clementine, however I am prompted for my password.

It may also be relevant that I must first connect to a VPN network using Cisco AnyConnect and only then can I ssh into cfmi since it is fire-walled.

However when I try to connect from the cfmi server to clementine, I am prompted for a password that doesn't match the root password I have on that computer. Thus I can't log on from cfmi to clementine.

It gets even more mysterious... The root password works just fine when I am ssh-ing from my iphone on the local network.

Can anyone help me figure out how to get the keys to work and how to reset my password to ssh into Clementine?

EDIT: Changed name of ssh keys to id_rsa, still having issues..

Here are the contents of .ssh on the client (cfmi):

-rwx------. 1 se394 mriusers 1634 Sep 29 22:00 authorized_keys
-rwx------. 1 se394 mriusers 1633 Sep 29 22:00 authorized_keys~
-rw-------. 1 se394 mriusers 1675 Sep 29 21:17 clementine
-rw-r--r--. 1 se394 mriusers  415 Sep 28 19:52 clementine.pub
-rw-------. 1 se394 mriusers 1679 Sep 29 22:04 id_rsa
-rw-r--r--. 1 se394 mriusers  415 Sep 29 22:04 id_rsa.pub
-rw-r--r--. 1 se394 mriusers 1830 Sep 28 20:15 #known_hosts#
-rw-r--r--. 1 se394 mriusers 1043 Sep 29 00:13 known_hosts
-rw-r--r--. 1 se394 mriusers 1837 Sep 28 17:41 known_hosts~

And here is the verbose output for cfmi connecting to clementine

se394 ~ $ ssh -v -v -v shadyeldamaty@clementine.duckdns.org
OpenSSH_6.4, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 51: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to clementine.duckdns.org [162.211.160.162] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/exports/home/se394/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /exports/home/se394/.ssh/id_rsa type 1
debug1: identity file /exports/home/se394/.ssh/id_rsa-cert type -1
debug1: identity file /exports/home/se394/.ssh/id_dsa type -1
debug1: identity file /exports/home/se394/.ssh/id_dsa-cert type -1
debug1: identity file /exports/home/se394/.ssh/id_ecdsa type -1
debug1: identity file /exports/home/se394/.ssh/id_ecdsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.4
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: no match: Cisco-1.25
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "clementine.duckdns.org" from file "/exports/home/se394/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /exports/home/se394/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug2: dh_gen_key: priv key bits set: 130/256
debug2: bits set: 509/1024
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Server host key: RSA 21:f7:7a:59:f5:ef:03:1f:ee:99:23:b8:f1:c1:71:b4
debug3: load_hostkeys: loading entries for host "clementine.duckdns.org" from file "/exports/home/se394/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /exports/home/se394/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "162.211.160.162" from file "/exports/home/se394/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /exports/home/se394/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'clementine.duckdns.org' is known and matches the RSA host key.
debug1: Found key in /exports/home/se394/.ssh/known_hosts:3
debug2: bits set: 496/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /exports/home/se394/.ssh/id_rsa (0x7f052168bf10),
debug2: key: /exports/home/se394/.ssh/id_dsa ((nil)),
debug2: key: /exports/home/se394/.ssh/id_ecdsa ((nil)),
debug1: Authentications that can continue: password
debug3: start over, passed a different list password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup password
debug3: remaining preferred: ,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
shadyeldamaty@clementine.duckdns.org's password:

I've checked the authorized_keys file on the server and the key matches id_rsa.pub. Anyone have any hints on how to proceed from here?

  • providing server logs can help to diagnose the issue – Jakuje Sep 30 '15 at 15:13
  • how can i provide the server log? note i have restricted access on 'cfmi' (i also do not have a /var/log/secure) – seldamat Sep 30 '15 at 15:19

You shouldn't have renamed your private key file (id_rsa) without configuring ssh to know what other file names it should look for when searching for private keys.

  • I tried creating the keys named as 'id_rsa' and still have the same issues. – seldamat Sep 30 '15 at 17:03
  • I've also tried ssh with the -i flag ssh -i ~/.ssh/clementine to point to the private key.. still doesn't work – seldamat Sep 30 '15 at 17:04
  • @seldamat Now that you've fixed the first problem (you hadn't put a private key where ssh could find it), please post verbose logs of the new problem. – Spiff Oct 1 '15 at 7:08
  • ok doke, updated! – seldamat Oct 1 '15 at 15:23
  • @seldamat Is Clementine a Cisco box? Or running some kind of Cisco-developed SSH service? Because there's a line in your new log saying it's Cisco software. Is there maybe a NAT gateway or firewall running on a Cisco box between you and Clementine, and you're accidentally SSHing into the Cisco box? Maybe you need to put a port forwarding / port mapping rule in the Cisco box so you can actually reach Clementine? – Spiff Oct 1 '15 at 17:39

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.