Hi,

I try to setup a public/private key access using SSH , but it only work when i connect from 'root' to 'root' user.


LOCAL - Remote(server)
root root Ok
user user Asking for passw
root user Asking for passw
user root Asking for passw

My (local) ~./ssh/id_dsa.pub = my (remote) /root/./ssh/authorized_keys = /home/user/./ssh/authorized_keys



Here is a part of the output of #ssh user@remote.server -vv
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: identity (0x9501618)
debug2: key: /root/.ssh/identity ((nil))
debug2: key: /root/.ssh/id_rsa ((nil))
debug2: key: /root/.ssh/id_dsa (0x95000c8)
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: identity
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Trying private key: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Offering public key: /root/.ssh/id_dsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive


A part of /etc/ssh/sshd_config

#RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts no
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
RhostsRSAAuthentication yes
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
IgnoreUserKnownHosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no


Any inputs are welcome
Thanks,

That's because you're putting the public key into the server's /root/.ssh/authorized_keys file.

The key-pair is generated by and for a particular user. You generated the key set on the client machine as root and then copied the public key into the root user's authorized_keys file, so naturally only root to root will work.

If you'd like it otherwise, you'll have to copy the public key file from your root user (which is presumably who you want to connect from) to whoever else's account on the ssh server you want to access.

For example, I generated a key as user "michael" on my client and then copied it to the server in user "raven"'s ~/.ssh/authorized_keys file. Then, from the client, as "michael" I just ssh raven@host and I'm in, as user raven.

EDIT There may be a way to add it globally, like say /etc/ssh/authorized_keys, but if there is I don't know of it.

Sorry if i wasen't clear but it exactly what i have done.

root(local) priv key in root/.ssh/ dir and i copied public key to root's account on the server. and it work correctly

root(local) priv key in root/.ssh/ dir and i copied public key to ~user/.ssh/ account on the server. and diddint work

user(local priv key in ~user/.ssh/ dir and copied public key to user/.ssh/ account on server but didint work


Thanks,

Are you by chance trying to log into a chroot'ed shell on the server? I'm aware there's a common patch for ssh which chroots shells where the user's home dir is contains /./, and I've had experience in the past where I've been unable to sign into chroot'ed shells using publickey but password worked fine. Unfortunately I found no way round this.

User are not (yet) chrooted

When you say it's in ~/.ssh/ you mean ~/.ssh/authorized_keys right ? Because the public key doens't just go in the folder it gets added inline to the authorized_keys file.

Yes keys are in file
~/.ssh/authorized_keys

Like i said on my first post, it work fine when i connect from root(local) to root(remote) , but i cant connect from user(local) to otheruser(remote)

The howto i follow to make sure what i was doing was right :
http://www.linuxquestions.org/questi...ticle&artid=79


Thanks,

Anyone ? please ...