ssh

rajah9 · 08-17-2005, 03:26 PM

I would like to ssh from a Win XP client (Pagent + PuTTY) to a Linux Fedora Core 4 server, running sshd.

I get a PuTTY terminal and a log in prompt. After trying to log in as root, the PuTTY log says:

Event Log: Key refused
Event Log: No supported authentications offered. Disconnecting

On the Windows client side, I generated a key pair using PuttyGen. I kept the private key on the Windows side and copied the public key to the FC4 server. The first time I use Pagent in the morning, I add the rsa key.

On the server, I placed the corresponding public key in ~/.ssh/authorized_key2. Now the things I've changed in /etc/ssh/sshd_config are:

Code:

 AllowUsers *
 Port 22
 Protocol 2
 HostKey /etc/ssh/ssh_host_rsa_key
 RSAAuthentication yes
 PubkeyAuthentication yes
 AuthorizedKeysFile .ssh/authorized_keys2
 RhostsRSAAuthentication yes
 PasswordAuthentication no
 ChallengeResponseAuthentication no
 UsePAM no

Why is the ssh daemon refusing the key? How should I fix it? Thanks.

peter_robb · 08-17-2005, 04:03 PM

You will need another couple of lines..

UsePrivilegeSeparation yes
PermitRootLogin yes
and change this line..
AuthorizedKeysFile %h/.ssh/authorized_keys2

rajah9 · 08-18-2005, 03:57 PM

Peter,

Thanks for your reply. After your three line changes in sshd_config, PuTTY is lodging the same complaint. Is there some log file that would help trace the problem?

peter_robb · 08-19-2005, 05:53 AM

Start with the log files on the FC4 server..
Also restart the sshd daemon with extra debug options..
see man sshd for options

You may have something simple like the authorized_keys file has too many permissions..
It should be 600, only root readable/writeable..

rajah9 · 08-19-2005, 01:59 PM

Thanks for setting me on the right track.

In order to turn debug on, I had to distinguish between the /etc/rc.d/init.d/sshd script, which does not understand options, from the /usr/sbin/sshd binary, which does. I restarted the script with /usr/sbin/sshd -d -d -d -D. Yes, it looks like I'm stuttering, but you can add up to three -d options to increase the level of debugging. The -D keeps a daemon from spawning, so you can see the error messages in the terminal.

This helped me see that the public key that was generated from PuTTYgen did not sit well in authorized_keys2.

I generated new keys on the Linux server with

Code:

ssh-keygen -t dsa
chmod 600 $HOME/.ssh/id_dsa
cp $HOME/.ssh/id_dsa $HOME/.ssh/authorized_keys2

Then I copied the private key to the Windows client, imported it into PuTTYgen, and added it as a key.

After this point, I could successfully ssh from the client to the server.

Thanks for your help.