If you are having authentication problems with ssh, the first thing to investigate is what the client says with some debugging:
% ssh -v host
...
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/david/.ssh/id_dsa
debug1: Server accepts key: pkalg ssh-dss blen 433
debug1: Enabling compression at level 6.
debug1: Authentication succeeded (publickey).
...
is a successful publickey connection.
% ssh -v host
...
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/david/.ssh/id_dsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/david/.ssh/identity
debug1: Trying private key: /home/david/.ssh/id_rsa
debug1: Next authentication method: password
david@ace's password:
...
This doesn't really offer much information as to why publickey authentication was being refused. The best information is available on the server. Sshd will log to the AUTH syslog facility, so you can find information where ever that is logged to (in the case of Debian /var/log/auth/
).
Aug 19 08:18:36 ace sshd[10100]: Authentication refused: bad ownership or modes
for directory /home/david/.ssh
This tells us that the permissions for .ssh is wrong and we can easily fix it.
Aug 19 08:26:41 ace sshd[12156]: error: key_read: uudecode
ZAAAAB3NzaC1kc3MAAACBAIUuAmpj9FuE71EfqJDVAfI+pUZ++xSWbUvEh7U36WW/...
This tells us that it failed to read that particular key, so we know to fix that.
If you don't get any useful information from the logs, you can turn up the logging. Edit /etc/ssh/sshd_config
and change the LogLevel
line to:
LogLevel DEBUG
Then run
/etc/init.d/ssh reload
Now when you try to connect you should see some logs like:
Aug 19 08:32:12 ace sshd[13537]: debug1: Checking blacklist file
/usr/share/ssh/blacklist.DSA-1024
Aug 19 08:32:12 ace sshd[13537]: debug1: Checking blacklist file
/etc/ssh/blacklist.DSA-1024
Aug 19 08:32:12 ace sshd[13537]: debug1: temporarily_use_uid: 1002/513 (e=0/0)
Aug 19 08:32:12 ace sshd[13537]: debug1: trying public key file
/home/david/.ssh/authorized_keys
Aug 19 08:32:12 ace sshd[13537]: debug1: fd 4 clearing O_NONBLOCK
Aug 19 08:32:12 ace sshd[13537]: debug1: matching key found: file
/home/david/.ssh/authorized_keys, line 1
Aug 19 08:32:12 ace sshd[13537]: Found matching DSA key:
1c:46:89:52:c1:79:c8:8f:43:3c:4e:77:ad:a1:5d:1b
This was a successful login.
If you need more information, you can use DEBUG2 and DEBUG3 to get further information. Don't forget to change your log level back again (probably to INFO) when you've fixed the problem.