LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 01-06-2012, 02:25 PM   #1
jeffrosquad
Member
 
Registered: Jan 2012
Posts: 33

Rep: Reputation: Disabled
SSH keys only work in one direction


Hello,
I have five servers Rhel5.5 Tikanga. I have used ssh-keygen several times without problem. My issue here is that servers 2,3,4, and 5 worked flawlessly. Server 1 however, only works outbound passwordless ssh. None of the other servers can ssh into server 1. I have done the following checks comparing server 1 and 2:

Ran the commands
ssh-keygen -t rsa -b 2048
ssh-copy-id ~/.ssh/id_rsa.pub servername
type password
Server 1 to 2 works
Server 2 to 1 fails

All file permissions and ownership are the same from / to ~/.ssh
Ran the command "id" on both servers and entries match
Blew away the keys and regenerated (a few times)
sshd_config files match
ssh_config files match
iptables are off on both machines

Ran ssh -vvvv from one to two (successfully) with the following output:

debug3: check_host_in_hostfile: filename /u01/app/oracle/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug3: check_host_in_hostfile: filename /u01/app/oracle/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug1: Host 'server2' is known and matches the RSA host key.
debug1: Found key in /u01/app/oracle/.ssh/known_hosts:1
debug2: bits set: 516/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /u01/app/oracle/.ssh/identity ((nil))
debug2: key: /u01/app/oracle/.ssh/id_rsa (0x2ac6d1fc1100)
debug2: key: /u01/app/oracle/.ssh/id_dsa ((nil))
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address "IPADDR".
debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /u01/app/oracle/.ssh/identity
debug3: no such identity: /u01/app/oracle/.ssh/identity
debug1: Offering public key: /u01/app/oracle/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug2: input_userauth_pk_ok: SHA1 fp 87:b7:09:cf:9c:80:28:8e:3c:0a:f0:53:dd:9f:5e:6a:7f:38:3d:7e
debug3: sign_and_send_pubkey
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).

Ran ssh -vvvv from two to one (unsuccessfully) with the following output:

debug3: check_host_in_hostfile: filename /u01/app/oracle/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug3: check_host_in_hostfile: filename /u01/app/oracle/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug1: Host 'server1' is known and matches the RSA host key.
debug1: Found key in /u01/app/oracle/.ssh/known_hosts:1
debug2: bits set: 507/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /u01/app/oracle/.ssh/identity ((nil))
debug2: key: /u01/app/oracle/.ssh/id_rsa (0x2ab65e6d8100)
debug2: key: /u01/app/oracle/.ssh/id_dsa ((nil))
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address "IPADDR".
debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug1: Unspecified GSS failure. Minor code may provide more information
Unknown code krb5 195

debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /u01/app/oracle/.ssh/identity
debug3: no such identity: /u01/app/oracle/.ssh/identity
debug1: Offering public key: /u01/app/oracle/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Trying private key: /u01/app/oracle/.ssh/id_dsa
debug3: no such identity: /u01/app/oracle/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

What have I missed?
 
Old 01-06-2012, 02:48 PM   #2
bino25
Member
 
Registered: Dec 2010
Posts: 50

Rep: Reputation: 11
You need to run "ssh key-gen" on server 2 and create an id_rsa.pub file on there. Then take the contents of that file and add/append it to the authorized_keys file on server 1.

So, let's say server 2 has this
# cat /home/user/.ssh/id_rsa.pub
123456789

on server 1, you need to have this
# cat /home/user/.ssh/authorized_keys
123456789

That should do it
 
Old 01-06-2012, 02:50 PM   #3
jeffrosquad
Member
 
Registered: Jan 2012
Posts: 33

Original Poster
Rep: Reputation: Disabled
I did that process both ways. I have an authorized_keys file on both machines now that contains each others id_rsa.pub.
 
Old 01-06-2012, 03:41 PM   #4
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Let's triple check permissions. Please post output from:
Code:
$ ls -ld /u01/app/oracle /u01/app/oracle/.ssh
(run on both hosts)
 
Old 01-09-2012, 08:33 AM   #5
jeffrosquad
Member
 
Registered: Jan 2012
Posts: 33

Original Poster
Rep: Reputation: Disabled
Face Palm...........Thank you Anomie. I think I had looked at this too long. I looked this morning, ran the ls -ld and immediately found my problem. Server1 was 775 on /u01/app/oracle and Server2 was 750. Made them both 750 and now they are happy. I swear I checked perms a dozen times. Guess I needed a break and some good advice.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
SSH host keys are not being read correctly from .ssh/known_hosts. bartonski Linux - Software 3 10-29-2009 04:40 PM
SSH host keys VS SSH keys kenneho Linux - Security 3 09-11-2008 06:03 AM
Protocols (rsync, ssh, nfs, ipp) working only in one direction hroit Linux - General 8 08-23-2007 03:27 PM
NFS will only work in 1 direction between 2 pc's MatricalDreamer Linux - Networking 1 07-12-2007 03:26 AM
Configuring SSH to accept only keys (already have keys) fr0st Linux - Security 3 11-04-2003 03:31 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 10:19 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration