[SOLVED] passwordless ssh stopped working

arich · 08-18-2011, 04:26 AM

There are a few threads about this but none seem to help me.

I have 3 machines setup with a nfs home directory on machine 1.

I have created keys using ssh-keygen -t rsa (and left everything blank), then as user on machine 1 run

Code:

cat id_rsa.pub >> authorized_keys2
chmod 644 ~/.ssh/*

this used to work until I upgraded to ubuntu 11.04 (from 9.04), and now it requires a password to ssh. I have tried several times deleting ~/.ssh/* and recreating, to no luck

Below is the results when I try to ssh into -2 from -1:

Code:

user@cassandra-1:~$ ssh -vv cassandra-2
OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to cassandra-2 [172.16.26.211] port 22.
debug1: Connection established.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /shared/home/user/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /shared/home/user/.ssh/id_rsa-cert type -1
debug1: identity file /shared/home/user/.ssh/id_dsa type -1
debug1: identity file /shared/home/user/.ssh/id_dsa-cert type -1
debug1: identity file /shared/home/user/.ssh/id_ecdsa type -1
debug1: identity file /shared/home/user/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debian-1ubuntu3
debug1: match: OpenSSH_5.8p1 Debian-1ubuntu3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-1ubuntu3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: RSA 23:9f:d6:88:cc:4c:36:b4:00:5a:dd:b8:83:54:aa:c8
debug1: Host 'cassandra-2' is known and matches the RSA host key.
debug1: Found key in /shared/home/user/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /shared/home/user/.ssh/id_rsa (0x7fd826ac8750)
debug2: key: /shared/home/user/.ssh/id_dsa ((nil))
debug2: key: /shared/home/user/.ssh/id_ecdsa ((nil))
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /shared/home/user/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /shared/home/user/.ssh/id_dsa
debug1: Trying private key: /shared/home/user/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: password

permissions are:

Code:

-rw-r--r-- 1 user users  398 2011-08-18 18:16 authorized_keys2
-rw-r--r-- 1 user users 1675 2011-08-18 18:15 id_rsa
-rw-r--r-- 1 user users  398 2011-08-18 18:15 id_rsa.pub
-rw-r--r-- 1 user users 2654 2011-08-18 18:19 known_hosts

I thought maybe the comments "-----BEGIN RSA PRIVATE KEY-----" and "-----END RSA PRIVATE KEY-----" in id_rsa were upsetting it so I deleted those lines, and now I get:

Code:

user@cassandra-1:~/.ssh$ ssh -vv cassandra-2
OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to cassandra-2 [172.16.26.211] port 22.
debug1: Connection established.
debug1: identity file /shared/home/user/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /shared/home/user/.ssh/id_rsa-cert type -1
debug1: identity file /shared/home/user/.ssh/id_dsa type -1
debug1: identity file /shared/home/user/.ssh/id_dsa-cert type -1
debug1: identity file /shared/home/user/.ssh/id_ecdsa type -1
debug1: identity file /shared/home/user/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debian-1ubuntu3
debug1: match: OpenSSH_5.8p1 Debian-1ubuntu3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-1ubuntu3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: RSA 23:9f:d6:88:cc:4c:36:b4:00:5a:dd:b8:83:54:aa:c8
debug1: Host 'cassandra-2' is known and matches the RSA host key.
debug1: Found key in /shared/home/user/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /shared/home/user/.ssh/id_rsa (0x7f916323d750)
debug2: key: /shared/home/user/.ssh/id_dsa ((nil))
debug2: key: /shared/home/user/.ssh/id_ecdsa ((nil))
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /shared/home/user/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /shared/home/user/.ssh/id_dsa
debug1: Trying private key: /shared/home/user/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: password

Can anyone give me some ideas as to what I'm doing wrong?

(dumb question, but shouldn't the offered RSA public key be id_rsa.pub rather than id_rsa?)

jv2112 · 08-18-2011, 04:34 AM

In order to make it clean with the new upgrade I would suggest starting from scratch:

> .ssh/known_hosts # Delete content

ssh-keygen # generate new key

ssh-copy-id user@IPaddress # repeat as needed for each machine you ssh to.

timur91 · 08-18-2011, 03:35 PM

what do you get in /var/log/secure on the server you are connecting to?

java socket

arich · 08-18-2011, 05:35 PM

Thanks for the help.

Quote:

Originally Posted by jv2112

In order to make it clean with the new upgrade I would suggest starting from scratch:

> .ssh/known_hosts # Delete content

ssh-keygen # generate new key

ssh-copy-id user@IPaddress # repeat as needed for each machine you ssh to.

I've done steps 1) and 2) repeatedly, but adding on step 3) didn't work

Quote:

Originally Posted by timur91

what do you get in /var/log/secure on the server you are connecting to?

Do you mean /var/log/auth.log (I'm running Ubuntu)? I cleared it and ssh-ed into -2 and this is the log file there:

Code:

Aug 19 08:35:03 cassandra-2 sshd[4626]: Received disconnect from 172.16.26.210: 11: disconnected by user
Aug 19 08:35:03 cassandra-2 sshd[4555]: pam_unix(sshd:session): session closed for user user
Aug 19 08:35:06 cassandra-2 sshd[4740]: Authentication refused: bad ownership or modes for file /shared/home/user/.ssh/authorized_keys
Aug 19 08:35:06 cassandra-2 sshd[4740]: Authentication refused: bad ownership or modes for file /shared/home/user/.ssh/authorized_keys2
Aug 19 08:35:09 cassandra-2 sshd[4740]: pam_sm_authenticate: Called
Aug 19 08:35:09 cassandra-2 sshd[4740]: pam_sm_authenticate: username = [user]
Aug 19 08:35:09 cassandra-2 sshd[4740]: Accepted password for user from 172.16.26.210 port 41357 ssh2
Aug 19 08:35:09 cassandra-2 sshd[4740]: pam_unix(sshd:session): session opened for user user by (uid=0)

is the "bad ownership or modes for file authorized_keys2" the problem? I assume authorized_keys was created when I followed jv2112's advice since it's never been there before

edit: I've changed the file permissions to be:

Code:

drwx------  2 user users 4096 2011-08-19 10:59 .
drwxr-x--- 49 user users 4096 2011-08-18 18:18 ..
-rw-------  1 user users  397 2011-08-19 10:37 authorized_keys2
-r--------  1 user users 1675 2011-08-19 08:50 id_rsa
-rw-------  1 user users  398 2011-08-19 08:50 id_rsa.pub
-rw-------  1 user users 2654 2011-08-19 10:26 known_hosts

authorized_keys2 consists of a single key:

Code:

ssh-rsa AAAAB3NzaC1y(*stuff chopped out*)PZznnxR user@cassandra-1

I assume a single code for 3 machines is correct because they have a shared nfs home directory. Is this correct?

I am now able to ssh into -1 from -2 and -3 without a password, but am still not able to ssh into -2 or -3 without password.

timur91 · 08-19-2011, 11:50 AM

Quote:

Originally Posted by arich

authorized_keys2 consists of a single key:

Code:

ssh-rsa AAAAB3NzaC1y(*stuff chopped out*)PZznnxR user@cassandra-1

I assume a single code for 3 machines is correct because they have a shared nfs home directory. Is this correct?

I am now able to ssh into -1 from -2 and -3 without a password, but am still not able to ssh into -2 or -3 without password.

authorized_keys2 is for DSA keys but I can see the key you have there is RSA, that's why it is not working

java socket

arich · 08-19-2011, 11:00 PM

I thought authorized_keys2 was for ssh 2. I see it's not necessary any more (apparently).

At any rate, I conceded defeat to linux changed my users so that they all have their home directories locally and each home directory contains a link to the /shared directory which is on the nfs and where I plan to install everything. It works for now.