Not able to set up key pair authorization Win7 / PuttyGen / Putty / CentOS7

AdultFoundry · 11-01-2015, 03:14 AM

I took the following steps:

1) I created an SSH-2 RSA key pair with puttygen (Putty Key Generator)
2) I secured the private key with a password, and I downloaded both keys to a folder on a Windows 7 machine
3) I uploaded the PUBLIC key to /home/user_one through Filezilla / sftp, as filename "public_key"
4) I run the following commands on the CentOS7 machine (as user_one)

Code:

mkdir .ssh
mv public_key .ssh
chmod 700 ~/.ssh
cat public_key >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
restorecon -Rv ~/.ssh

5) I run the following

Code:

nano /etc/ssh/sshd_config

PubkeyAuthentication yes
AuthorizedKeyFile .ssh/authorized_keys
PasswordAuthentication yes (I left it as is for now, I was going to change it later, when the key authentication works)

Code:

systemctl reload httpd.service

6) I went into Putty, and I entered the following info

IP address to connect to (my server's IP)
custom port that I set for the SSH
I went to Connection -> SSH -> Auth in Putty, and I added the private.pph that was created through the Browse... button in this menu
I then went to Session -> Open

I get:

login as: user_one
Server refused our key
password:

I can enter the user's password and log in, but keys dont work.

I was trying to create the key pair on the server too, with

Code:

ssh-keygen -t -rsa

Setting this up should not be difficult, but something is not done correctly here...

berndbausch · 11-01-2015, 04:44 AM

Perhaps putty features logging; if yes (and I am almost certain it does), figure out where the logs are and have a look at them.

You can also use verbose logging on the server side. This probably requires running an sshd process in the foreground with the -v, -vv or -vvv option, so that you can see the messages. You will see why the server refuses your key. If you need to keep your normal background sshd running at the same time, use a different port for your verbose server. This again requires opening up the firewall (you're an expert in this already

).

ondoho · 11-01-2015, 04:56 AM

Quote:

Originally Posted by AdultFoundry

Code:

mkdir .ssh
mv public_key .ssh
chmod 700 ~/.ssh
cat public_key >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
restorecon -Rv ~/.ssh

what's restorecon?
also, try setting stricter permissions (read only).

AdultFoundry · 11-01-2015, 05:16 AM

Quote:

Originally Posted by ondoho

what's restorecon?
also, try setting stricter permissions (read only).

Ensure the correct SELinux contexts are set:
$ restorecon -Rv ~/.ssh

https://wiki.centos.org/HowTos/Network/SecuringSSH

berndbausch · 11-01-2015, 05:33 AM

Quote:

Originally Posted by ondoho

what's restorecon?
also, try setting stricter permissions (read only).

0600 permissions on authorized_keys are OK. Perhaps the owner is wrong?

AdultFoundry · 11-01-2015, 05:50 AM

Quote:

Originally Posted by berndbausch

0600 permissions on authorized_keys are OK. Perhaps the owner is wrong?

The username who logs in is the owner of the file, and not root. I think I've made that mistake before, but I corrected it before asking here. I was setting everything from this users account (and not root).

AdultFoundry · 11-01-2015, 12:04 PM

Quote:

Originally Posted by berndbausch

Perhaps putty features logging; if yes (and I am almost certain it does), figure out where the logs are and have a look at them.

I turned this to on, and the log file does not say anything different than what I've been getting on the Putty screen, at least here. Logging was set to All Session Output, so this part should be correct. I will try the second part tomorrow I think (the verbose mode).

chrism01 · 11-01-2015, 06:43 PM

Ahem ...

Code:

systemctl reload httpd.service

Does anything strike you as odd about that ... seeing as you're messing with sshd ... ?

AdultFoundry · 11-02-2015, 03:09 AM

I was able to get it to work. The key that I entered to ~/.ssh/authorized_keys looked something like this:

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "rsa-key-00000000"
<random signs here>
---- END SSH2 PUBLIC KEY ----

I opened PuttyGen and loaded the private key there, it gave me the public key that I could copy, and I pasted in all on one line into the authorized_keys file (without the comments above). It worked right away, so it was a matter of the format of the key (multiple lines, instead of one, comments at the beginning and at the end, and it did not work).

I have some good and fresh Linux resources and I will be going over them, and I will post the best things on the forum, so you can check it out (like different approaches / angles, like top command for example). In the meantime, you can look at these (again, this is good):

http://myadultforum.com/forum/main-f...on-about-linux

55 separate posts there so far. Take a look at five or so different ones on different pages, and you will see that this is good. Not necessarily for reading as a whole right away, but you can bookmark it and read several posts per day, lets say (the best for people who are new and are learning).

Thanks.