Unable to set ssh passwordless authentication
I am unable to ssh with passwordless authentication from Windows client onto UBuntu server. The ssh version on UBuntu is OpenSSH_5.8p1 Debian-7ubuntu1, OpenSSL 1.0.0e , while SSH on Windows Client is OpenSSH_5.1p1, OpenSSL 0.9.8k. I turned on ssh debugging and noticed these messages on server and client:
Code:
/usr/bin/sshd -d -p 2222 on server:
adminuser@server:~/.ssh$ /usr/sbin/sshd -d -p 2222
debug1: sshd version OpenSSH_5.8p1 Debian-7ubuntu1
debug1: could not open key file '/etc/ssh/ssh_host_rsa_key': Permission denied
Could not load host key: /etc/ssh/ssh_host_rsa_key
debug1: could not open key file '/etc/ssh/ssh_host_dsa_key': Permission denied
Could not load host key: /etc/ssh/ssh_host_dsa_key
debug1: could not open key file '/etc/ssh/ssh_host_ecdsa_key': Permission denied
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: rexec_argv[2]='-p'
debug1: rexec_argv[3]='2222'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 10.221.84.65 port 2414
debug1: Client protocol version 2.0; client software version OpenSSH_5.1
debug1: match: OpenSSH_5.1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1
debug1: list_hostkey_types:
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup
ssh -vvv on client:
C:\Documents and Settings\clientuser>ssh -vvv -p 2222
OpenSSH_5.1p1, OpenSSL 0.9.8k 25 Mar 2009
debug2: ssh_connect: needpriv 0
debug1: Connecting to server.com port 2222.
debug1: Connection established.
debug1: identity file /cygdrive/c/Documents and Settings/clientuser/.ssh/identi
ty type -1
debug3: Not a RSA1 key file /cygdrive/c/Documents and Settings/clientuser/.ssh/
id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /cygdrive/c/Documents and Settings/clientuser/.ssh/id_rsa
type 1
debug1: identity file /cygdrive/c/Documents and Settings/clientuser/.ssh/id_dsa
type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debia
n-7ubuntu1
debug1: match: OpenSSH_5.8p1 Debian-7ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
Read from socket failed: Connection reset by peer
I verified that the permissions on authorized_keys, .ssh etc on host are correct. I regenerated host keys to get around the 'Could not load host keys' and restarted ssh services, but problem persists. Here are contents of sshd_config:
Code:
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
Any suggestions on what could be wrong? The host private keys are unable to load because they are owned by 'root' user. Changing their permissions to anything other than mode 600 is not allowed. I appreciate any solutions. I am stuck at this point.. please help!
Last edited by Scott; 11-12-2012 at 06:40 PM..
Reason: Code tags
First, I would make sure that the passwordless ssh works to localhost on both hosts. This way, you are dealing with one .ssh directory. The id_rsa file seems messed up from the printout. I often just "scp -rp .ssh wherever:." once I get localhost working, and then the keys match perfectly, although perversely any localhost//127.0.0.1 keys do not and it will tell you where they are to discard them so they can be reset for the local host keys.
Yes, having the right permissions on $HOME and everything from .ssh*/ down is very important. Hence, I scp them with -p, so I do not get umask derived permissions.
1. the sshd_config files seems ok, I don't think you should edit it.
2. check for correct permissions on the server-side ~/.ssh directory of the user you are going to login with; they should be:
700 (rwx --- ---) for ~/.ssh directory
600 (rw- --- ---) for all the files inside ~/.ssh directory
3. please check that the public key you are using to perform passwordless authentication is correctly stored in server-side file ~/.ssh/authorized_keys
The format of the key should be something like:
be aware that the newlines in public key are just a consequence of the fact that the text may be wrapped by the text editor/viewer: the key itself should not contain newline characters (sometimes ssh_keygen on windows may produce weird output results).
For the same reason, if you generated the key pair on a windows machine, make sure to sanitize the content of the private and public key in order to comply with the server newline standard (see for example 'man dos2unix').
4. when invoking ssh on the client, please remember to specify the user to login with and try to explicitly indicate the private key you want to use in order to authenticate (using the -i switch of ssh).
Hey team
I have to enable password less authentication betweeen A to B server and A to C server and A to D server.
For this I generated a ssh key on server A using ssh-keygen command and copied the key using ssh-copy-id command to B, C and D server. Everything is working fine as of now but... (5 Replies)
Hi,
I am in the process FTPing some of my report files from my production server to another FTP server through batch/Shell Script.
This is working fine with the password less authentication.
Once i place all my report files in the ftp server the end users need to download ... (3 Replies)
Hello,
Need a suggestion to setup private key passwordless authentication. I am not sure this can done or not :wall:
here is the sincerio
I have two servers, sever1 with a user "user1" and servera with usera
here dataflow: usera from servera, will pull/push files to server1 on user1... (2 Replies)
hi,
i have tried with passwordless shh in google..
i followed the below steps ...
user:~> ssh-keygen -t rsa
Enter file in which to save the key (/home/cantin/.ssh/id_rsa):key.txt
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
till this step i... (0 Replies)
I have experience in setting up passwordless authentication by sharing ssh public keys manually.Currently I am in the process to the write a script to perform the same functionality from one source(host) to multiple destinations.
I have one source host (Host A) whose public keys has to be shared... (9 Replies)
Dear All
I need to discuss about the problem which has been discussed so many times here. I need to transfer a file from server A to server B via passwordless SFTP script. By reading the threads on this topic here, I followed the below steps but still it's not working ..
Pls find the steps... (13 Replies)
Hi,
Can someone help me on ssh-keygen usage...?
I used ssh-keygen after which "id.pub" file was generated in system1's > .ssh directory...
I copied the same into the remote system system2 > .ssh directory as "authorized_keys" file.
Now i tried ssh connection from system 1 to system... (7 Replies)
Hello,
I would like to issue a couple of commands as root on a remote machine without having to enter the root password. I used "ssh-keygen -t rsa" to generate the encryption keys, copied the public key to the remote machine, etc.
I also tried playing around with the sshd_config file and... (3 Replies)
I am trying to implement passwordless authentication via ssh2. I have used the well documented technique of generating a key pair with a blank passphrase on my client machine, and installing the public key on the destination server (AIX 5.3) in the user's .ssh2 directory. I have used this technique... (1 Reply)
