LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Slackware (https://www.linuxquestions.org/questions/slackware-14/)
-   -   Can not ssh into Slack 13.37, 'Host key verification failed'. (https://www.linuxquestions.org/questions/slackware-14/can-not-ssh-into-slack-13-37-host-key-verification-failed-891758/)

camorri 07-14-2011 01:16 PM
Can not ssh into Slack 13.37, 'Host key verification failed'.
 
I have spent two days trying to get this working. I have looked at many how-tos without success.

I have Slack 64 bit installed on my desktop, sshd is running. From my netbook running Ubuntu I can not connect through ssh, I always get 'Host key verification failed' message.

I have tried a lot of things, I got to a point where I could not ssh either way. So today I removed and re-installed Openssh on both systems.

I made sure I was using the new ssh_config and sshd_config files on both systems. Right now I can ssh from the desktop ( Slack ) to Ubuntu ( netbook ) but not the other way around.

I do not get a known_hosts file created on Slack, I do get one on Ubuntu.

I don't understand why Openssh server on Slack is not accessible, and why the known_hosts file is not getting created.

/var/log/packages show
Quote:
openssh-5.5p1-x86_64-1
is what I have installed.

Most of the suggestions I have found suggest deleting the entry for the remote host. Problem is it never gets created.

How do I go about fixing this?

This is a link to the last howto I followed, after the re-install of Openssh.

-->http://www.linuxquestions.org/questi...-linux-419680/

SeRi@lDiE 07-14-2011 01:38 PM
Try


touch /home/user/.ssh/known_hosts

restart ssh

Also if you thinker with the sshd_config make sure your sshd_config is set back to default so you can narrow the issue down...

willysr 07-14-2011 06:25 PM
check your .ssh/known_hosts
probably there's a same IP address with your Slack machine, but it was a different machine, so it failed with the authentication process
the simplest way is to delete the entry and try to ssh again

allend 07-14-2011 07:58 PM
Is the sshd daemon running on the Slackware machine? (Check with 'ps ax | grep sshd').
From 'man sshd'
Quote:
/etc/ssh/ssh_host_key
/etc/ssh/ssh_host_dsa_key
/etc/ssh/ssh_host_ecdsa_key
/etc/ssh/ssh_host_rsa_key
These three files contain the private parts of the host keys. These files should only be owned by root, readable only by root, and not accessible to others. Note that sshd does not start if these files are group/world-accessible.
Check the permissions of these files are 0600.

camorri 07-15-2011 08:46 AM
Well, no success. I have looked at each suggestion. Here is what I see.

allend.

The permissions on /etc/ssh.

Quote:
/etc/ssh# ls -l
total 204
drwxr-xr-x 2 root root 4096 Jul 14 10:32 ./
drwxr-xr-x 90 root root 12288 Jul 15 08:32 ../
-rw-r--r-- 1 root root 48 Jul 13 09:58 login_file
-rw-r--r-- 1 root root 125811 Jul 14 10:17 moduli
-rw-r--r-- 1 root root 1555 Jul 14 10:33 ssh_config
-rw-r--r-- 1 root root 1555 Jul 14 10:17 ssh_config.new
-rw-r--r-- 1 root root 1577 Jul 14 10:32 ssh_config.old
-rw------- 1 root root 668 Jul 13 08:12 ssh_host_dsa_key
-rw-r--r-- 1 root root 601 Jul 13 08:12 ssh_host_dsa_key.pub
-rw------- 1 root root 227 Jul 13 08:12 ssh_host_ecdsa_key
-rw-r--r-- 1 root root 173 Jul 13 08:12 ssh_host_ecdsa_key.pub
-rw------- 1 root root 976 Jul 13 08:12 ssh_host_key
-rw-r--r-- 1 root root 641 Jul 13 08:12 ssh_host_key.pub
-rw------- 1 root root 1679 Jul 14 13:58 ssh_host_rsa_key
-rw-r--r-- 1 root root 393 Jul 14 13:58 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root 3207 Jul 14 10:24 sshd_config
-rw-r--r-- 1 root root 3207 Apr 29 2010 sshd_config.bak
-rw-r--r-- 1 root root 3207 Jul 14 10:17 sshd_config.new
-rw-r--r-- 1 root root 3582 Jul 14 10:23 sshd_config_old
Each .pub key has 600 for permissions. The rsa keys are being used.

Willysr.

The first few bytes of /home/myuser/.ssh/known_hosts.

Quote:
cat known_hosts
cliffs-mini,192.168.1.13 ssh-rsa
I can confirm this is the correct IP address for the client netbook, and the correct host name I have set. I also looked at the almost 400 characters in the .pub key, and they look identical. I can not spot any difference.

SeRi@lDiE

I tried several things. First of all, there was a known_hosts file. I could not connect. So I deleted the file, can created a new empty file with touch.

I tried to connect, it failed as before. It seems to take a few minutes for the pub key to appear in /home/myuser/.ssh/known_hosts ; it does show up. As I posted above, the host name and IP address are correct, and the almost 400 character .pub key matches with the client.

I still am stuck with 'Host key verification failed'. Stumped....

audriusk 07-15-2011 09:50 AM
Instead of guessing, you should start by adding -v (verbose) option to ssh command to see what it's doing when you try to connect from your Ubuntu box to Slackware one. You can add up to three v's to increase verbosity, though I suggest to use single -v at first so you won't be swamped with details.

willysr 07-15-2011 10:19 AM
have you make sure that the openssh daemon has been started?
check /etc/rc.d/rc.sshd permission. It should have execute permission

camorri 07-15-2011 10:59 AM
A single -v produced this:

Quote:
ssh cliff@duelie -v
OpenSSH_5.3p1 Debian-3ubuntu6, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to duelie [192.168.1.26] port 22.
debug1: Connection established.
debug1: identity file /home/cliff/.ssh/identity type -1
debug1: identity file /home/cliff/.ssh/id_rsa type -1
debug1: identity file /home/cliff/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.5
debug1: match: OpenSSH_5.5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu6
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
Host key verification failed.
Does this help? I'll post -vv if it is needed.

Yes, sshd is running. I verified that with 'ps aux | grep sshd'.

allend 07-15-2011 11:36 AM
Try explicitly specifying the use of rsa in /etc/ssh/sshd_config on the Slackware machine and turning off other key types.
Quote:
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key

camorri 07-15-2011 12:12 PM
allend,

Tried the rsa key as you suggested, no change. I also put the # back, and tried the dsa key without the #. Didn't make any difference.

camorri 07-15-2011 12:54 PM
I have found a work around. I copied the ssh_config file from slackware 13.37 and put it on the netbook. I just tested it, and I go connected. So, I'm concluding there is something in the original ssh_config file that came with Ubuntu sshd on slack doesn't like.

What gave me the clew, I dug out an old desktop, put it together, and tried it. Once I got past the the immediate disconnect caused by the hosts.allow file, I got connected to Slackware 13.37. At that point I was sure it had more to do with the Ubuntu netbook config than with sshd on slack.

Now to set up user keys.

Thank-you for all those who responded. Each one of you got me a little closer to a solution.

audriusk 07-15-2011 12:56 PM
Hmm, this is puzzling. If I understand it correctly, the client fails while trying to verify host key which it should have got from the server. I'm not sure if more verbose output from ssh client would help here, because the last few lines from your output stay mostly the same for me and, if successful, I immediately get the following:
Code:
debug1: Server host key: RSA xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
The authenticity of host '192.168.0.1 (192.168.0.1)' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)?
I've googled someone who had similar problem, and he solved it by regenerating host keys. Here's the link: http://stackoverflow.com/questions/5...e-clients-only

Not sure if that would help in your case, but the easiest way to regenerate keys in Slackware is to remove key files from /etc/ssh completely and restart sshd by running /etc/rc.d/rc.sshd restart

Edit: Oops, a little too late with my answer... Glad that you solved your problem!

camorri 07-15-2011 01:20 PM
In the interest of helping someone else, here are the lines form the original ssh_config file that came with ssh on Ubuntu 10.04.

Quote:
Host *
# ForwardAgent no
# ForwardX11 no
# ForwardX11Trusted yes
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# GSSAPIKeyExchange no
# GSSAPITrustDNS no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port 22
# Protocol 2,1
# Cipher 3des
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes
GSSAPIDelegateCredentials no
BatchMode yes
I don't pretend to know or understand why this file caused the problems I had. I compared this config to the one from slack ssh, the the most obvious difference I saw were the last five lines. I did't add these, they were there after I did a un-install and then install of the ssh client and ssh server form Ubuntu repos.

audriusk 07-15-2011 01:37 PM
Looks like BatchMode was the culprit here:

Quote:
If set to “yes”, passphrase/password querying will be disabled. This option is useful in scripts and other batch jobs where no user is present to supply the password. The argument must be “yes” or “no”. The default is “no”.
I've tried it by adding BatchMode yes to ~/.ssh/config and commenting the line of my router in ~/.ssh/known_hosts and got this infamous "Host key verification failed." message.


All times are GMT -5. The time now is 05:26 AM.