LinuxQuestions.org - OpenSSH Public Key Authentication

- Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)

- - OpenSSH Public Key Authentication (https://www.linuxquestions.org/questions/linux-server-73/openssh-public-key-authentication-719139/)

OpenSSH Public Key Authentication

I swear to god that I got this working before, but somehow this time I'm stuck. I'm trying to set up RSA public key authentication w/o password in OpenSSH server.

My RSA key is used currently in multiple locations so I don't think that's the problem. This is how my configuration file looks:

Code:

# Package generated configuration file

# See the sshd(8) manpage for details



# What ports, IPs and protocols we listen for

Port 22

# Use these options to restrict which interfaces/protocols sshd will bind to

#ListenAddress ::

#ListenAddress 0.0.0.0

Protocol 2

# HostKeys for protocol version 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_dsa_key

#Privilege Separation is turned on for security

UsePrivilegeSeparation yes



# Lifetime and size of ephemeral version 1 server key

KeyRegenerationInterval 3600

ServerKeyBits 768



# Logging

SyslogFacility AUTH

LogLevel INFO



# Authentication:

LoginGraceTime 120

PermitRootLogin no

StrictModes yes



RSAAuthentication yes

PubkeyAuthentication yes

AuthorizedKeysFile "%h/.ssh/authorized_keys"



# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

# For this to work you will also need host keys in /etc/ssh_known_hosts

RhostsRSAAuthentication no

# similar for protocol version 2

HostbasedAuthentication no

# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication

#IgnoreUserKnownHosts yes



# To enable empty passwords, change to yes (NOT RECOMMENDED)

PermitEmptyPasswords no



# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication no



# Change to no to disable tunnelled clear text passwords

PasswordAuthentication no



# Kerberos options

#KerberosAuthentication no

#KerberosGetAFSToken no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes



# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes



X11Forwarding yes

X11DisplayOffset 10

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

#UseLogin no



#MaxStartups 10:30:60

#Banner /etc/issue.net



# Allow client to pass locale environment variables

AcceptEnv LANG LC_*



Subsystem sftp /usr/lib/openssh/sftp-server



UsePAM yes

My rsa_id.pub is located in "/home/adm1n/.ssh/".

When I try to establish a session:

Code:

root# ssh adm1n@192.168.2.20

It fails (public key). The client has the private key (rsa_id) which works with other servers that I have running an ssh deamon.

Thanks

Quote:

Originally Posted by adri_ht_

My rsa_id.pub is located in "/home/adm1n/.ssh/".

The contents of that public key need to be added/appended to ~/.ssh/authorized_keys on the server side.

Quote:

Originally Posted by anomie (Post 3509027)

The contents of that public key need to be added/appended to ~/.ssh/authorized_keys on the server side.

The public key is already in the server. The connection is refused. Thanks tredager for those two links. They didn't solve my problem but they are very useful!

I think you should change

AuthorizedKeysFile "%h/.ssh/authorized_keys"

to

AuthorizedKeysFile "~/.ssh/authorized_keys"

Im not 100% will effect anything, but try it. Also I can put one of my configurations which work perfectly if you want to.

Ahh forgot, make sure that ~/.ssh has mode 700 and your public and private keys should be 600 or 400, other way u wont be able to use them, its a security risk.

Good luck!

And don't forget that

Code:

ssh -vvv user@remotehost

will tell you what is(n't) happening, in great detail and will help with debugging.

Quote:

Originally Posted by tredegar (Post 3509772)

And don't forget that

Code:

ssh -vvv user@remotehost

will tell you what is(n't) happening, in great detail and will help with debugging.

Hahaha, triple v? I won't need it though. I got it working the other day. It seemed like the public key I placed on the server was corrupted or something. This time I copied the public key through samba and it worked right after it! Thanks to all of you