LinuxQuestions.org - ssh public key authentication

This is continued from my unresolved problem here.

Let me explain my problem in context. My sister, a technophobe, uses a pentium 60 MHz computer. She is running debian with X and windomaker (hostname lisacomp). She only uses her computer to check email with sylpheed, ocassionally play xgalaga, and talk to friends with gaim. She occasionally needs/wants to browse the web. I used to have dillo installed on her computer, but it didn't (and still doesn't) render many pages correctly. It also didn't support flash which one of her textbook's website required. I tried installing mozilla firebird on her computer. This didn't work very well -- it took way too long to start and worked slowly. I set up ssh with pubkey authentication so that she could log into my computer (hostname teacup) without a password. I then placed an icon on her desktop that ran

Code:

ssh -X teacup firewhatever

This worked magnificently for a long period of time. Then, my hard drive kicked the bucket, I lost all of my data, and I reinstalled slackware. Since I reinstalled slackware, I cannot ssh from lisacomp to teacup without a password. I tried sshing with my account and my sister's account, but I had no success. Public key authentication from teacup to lisacomp works fine. I correctly regenerated all of the necessary keys. I searched all over this forum. I deleted all the keys and regenerated them as rsa instead of dsa. I tried giving authorized_keys, id_rsa.pub, id_rsa the most liberal permissions possible. I scoured the manpages for ssh, sshd, ssh_config, and sshd_config. I diffed her ssh_config with my ssh_config, and I diffed her sshd_config with my sshd_config. I found no significant differences. Remember, ssh with a password works correctly, my problem is getting it to work without one. Here is some sample output:

Code:

pcurry@lisacomp:~$ ssh -vv teacup

OpenSSH_3.8.1p1 Debian 1:3.8.1p1-4, OpenSSL 0.9.7d 17 Mar 2004

debug1: Reading configuration data /etc/ssh/ssh_config

debug2: ssh_connect: needpriv 0

debug1: Connecting to teacup [192.168.0.2] port 22.

debug1: Connection established.

debug1: identity file /home/pcurry/.ssh/identity type -1

debug2: key_type_from_name: unknown key type '-----BEGIN'

debug2: key_type_from_name: unknown key type '-----END'

debug1: identity file /home/pcurry/.ssh/id_rsa type 1

debug1: identity file /home/pcurry/.ssh/id_dsa type -1

debug1: Remote protocol version 2.0, remote software version OpenSSH_3.8p1

debug1: match: OpenSSH_3.8p1 pat OpenSSH*

debug1: Enabling compatibility mode for protocol 2.0

debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1 Debian 1:3.8.1p1-4

debug1: SSH2_MSG_KEXINIT sent

debug1: SSH2_MSG_KEXINIT received

debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

debug2: kex_parse_kexinit: ssh-rsa,ssh-dss

debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr

debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr

debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96

debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96

debug2: kex_parse_kexinit: none,zlib

debug2: kex_parse_kexinit: none,zlib

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit: first_kex_follows 0

debug2: kex_parse_kexinit: reserved 0

debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

debug2: kex_parse_kexinit: ssh-rsa,ssh-dss

debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr

debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr

debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96

debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96

debug2: kex_parse_kexinit: none,zlib

debug2: kex_parse_kexinit: none,zlib

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit: first_kex_follows 0

debug2: kex_parse_kexinit: reserved 0

debug2: mac_init: found hmac-md5

debug1: kex: server->client aes128-cbc hmac-md5 none

debug2: mac_init: found hmac-md5

debug1: kex: client->server aes128-cbc hmac-md5 none

debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent

debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

debug2: dh_gen_key: priv key bits set: 125/256

debug2: bits set: 501/1024

debug1: SSH2_MSG_KEX_DH_GEX_INIT sent

debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

debug1: Host 'teacup' is known and matches the RSA host key.

debug1: Found key in /home/pcurry/.ssh/known_hosts:1

debug2: bits set: 508/1024

debug1: ssh_rsa_verify: signature correct

debug2: kex_derive_keys

debug2: set_newkeys: mode 1

debug1: SSH2_MSG_NEWKEYS sent

debug1: expecting SSH2_MSG_NEWKEYS

debug2: set_newkeys: mode 0

debug1: SSH2_MSG_NEWKEYS received

debug1: SSH2_MSG_SERVICE_REQUEST sent

debug2: service_accept: ssh-userauth

debug1: SSH2_MSG_SERVICE_ACCEPT received

debug2: key: /home/pcurry/.ssh/identity ((nil))

debug2: key: /home/pcurry/.ssh/id_rsa (0x808b1b8)

debug2: key: /home/pcurry/.ssh/id_dsa ((nil))

debug1: Authentications that can continue: publickey,password,keyboard-interactive

debug1: Next authentication method: publickey

debug1: Trying private key: /home/pcurry/.ssh/identity

debug1: Offering public key: /home/pcurry/.ssh/id_rsa

debug2: we sent a publickey packet, wait for reply

debug1: Authentications that can continue: publickey,password,keyboard-interactive

debug1: Trying private key: /home/pcurry/.ssh/id_dsa

debug2: we did not send a packet, disable method

debug1: Next authentication method: keyboard-interactive

debug2: userauth_kbdint

debug2: we sent a keyboard-interactive packet, wait for reply

debug1: Authentications that can continue: publickey,password,keyboard-interactive

debug2: we did not send a packet, disable method

debug1: Next authentication method: password

pcurry@teacup's password:

Here is the sshd_config file on teacup:

Code:

#        $OpenBSD: sshd_config,v 1.65 2003/08/28 12:54:34 markus Exp $



# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.



# This sshd was compiled with PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin



# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options change a

# default value.



Port 22

Protocol 2

#ListenAddress 0.0.0.0

#ListenAddress ::



# HostKey for protocol version 1

#HostKey /etc/ssh/ssh_host_key

# HostKeys for protocol version 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_dsa_key



# Lifetime and size of ephemeral version 1 server key

KeyRegenerationInterval 3600

ServerKeyBits 768



# Logging

#obsoletes QuietMode and FascistLogging

#SyslogFacility AUTH

#LogLevel INFO



# Authentication:



LoginGraceTime 120

PermitRootLogin no

StrictModes yes



RSAAuthentication yes

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys



# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

RhostsRSAAuthentication no

# similar for protocol version 2

HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# RhostsRSAAuthentication and HostbasedAuthentication

#IgnoreUserKnownHosts no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes



# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication yes

PermitEmptyPasswords no



# Change to no to disable s/key passwords

#ChallengeResponseAuthentication yes



# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes



# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCreds yes



# Set this to 'yes' to enable PAM authentication (via challenge-response)

# and session processing. Depending on your PAM configuration, this may

# bypass the setting of 'PasswordAuthentication'

#UsePAM no



#AllowTcpForwarding yes

#GatewayPorts no

X11Forwarding yes 

X11DisplayOffset 10

X11UseLocalhost yes

PrintMotd yes

PrintLastLog yes

#KeepAlive yes

UseLogin no

UsePrivilegeSeparation yes

#PermitUserEnvironment no

#Compression yes

#ClientAliveInterval 0

#ClientAliveCountMax 3

UseDNS yes

#PidFile /var/run/sshd.pid

#MaxStartups 10



# no default banner path

#Banner /some/path



# override default of no subsystems

Subsystem        sftp        /usr/libexec/sftp-server

Here is the ssh_config file on lisacomp:

Code:

 #      $OpenBSD: ssh_config,v 1.19 2003/08/13 08:46:31 markus Exp $



# This is the ssh client system-wide configuration file.  See

# ssh_config(5) for more information.  This file provides defaults for

# users, and the values can be changed in per-user configuration files

# or on the command line.



# Configuration data is parsed as follows:

#  1. command line options

#  2. user-specific file

#  3. system-wide file

# Any configuration value is only changed the first time it is set.

# Thus, host-specific definitions should be at the beginning of the

# configuration file, and defaults at the end.



PubkeyAuthentication yes

# Site-wide defaults for various options



# Host *

#  ForwardAgent no

#  ForwardX11 no

#  ForwardX11Trusted yes

#  RhostsRSAAuthentication no

#  RSAAuthentication yes

#  PasswordAuthentication yes

#  HostbasedAuthentication no

#  BatchMode no

#  CheckHostIP yes

#  AddressFamily any

#  ConnectTimeout 0

#  StrictHostKeyChecking ask

#  IdentityFile ~/.ssh/identity

#  IdentityFile ~/.ssh/id_rsa

#  IdentityFile ~/.ssh/id_dsa

#  Port 22

#  Protocol 2,1

#  Cipher 3des

#  Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc

#  EscapeChar ~

Here is the .ssh directory on lisacomp:

Code:

pcurry@lisacomp:~/.ssh$ ls -la ~ | grep ssh; ls -l

drwx------    2 pcurry  pcurry      4096 Jul 14 09:14 .ssh

total 16

-rw-------    1 pcurry  pcurry        223 Jul 14 09:12 authorized_keys

-rw-------    1 pcurry  pcurry        883 Jul 14 09:14 id_rsa

-rw-------    1 pcurry  pcurry        225 Jul 14 09:14 id_rsa.pub

-rw-------    1 pcurry  pcurry        228 Jul 14 09:14 known_hosts

Here is the .ssh directory on teacup:

Code:

drwx------  2 pcurry users    168 Jul 14 09:15 .ssh/

total 16

-rw-------  1 pcurry users 225 Jul 14 09:15 authorized_keys

-rw-------  1 pcurry users 883 Jul 14 09:12 id_rsa

-rw-------  1 pcurry users 223 Jul 14 09:12 id_rsa.pub

-rw-------  1 pcurry users 230 Jul 14 09:11 known_hosts

I've spent many hours trying to get this to work and would appreciate assistance. Thank you.