Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have set up passwordless ssh authentication (via authorized_keys) numerous times successfully and with ease, usually on servers that did not have any custom ssh-related configuration changes prior to that.

Now I need to set it up on a CentOS server where another person previously disabled this feature due to "security concerns" expressed by an ill-informed manager. That person is no longer available and I cannot figure out how to make this work.

I have this in the sshd_config:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys
UsePAM yes

There are other settings, but I thought they did not make a difference. Any suggestions what I should check to make this work?

share|improve this question
    
Permissions on authorized_keys and .ssh? try connecting with -vv and post the results. –  Bart De Vos May 18 '11 at 15:13
    
What error message are you seeing ? Can you add the ouput of ssh -vvv ... to you question? –  Iain May 18 '11 at 15:13
    
It was the permissions on authorized_keys, now I almost feel stupid ;). But not as stupid as I would have been if I kept torturing the sshd config to try to get it to work :) –  SaltyNuts May 18 '11 at 15:23
add comment

3 Answers

up vote 6 down vote accepted

The most common reason I have seen is permissions to ~/.ssh/authorized keys is too permissive. The authorized keys file must have read/write ONLY for the owner (chmod 600 ~/.ssh/authorized_keys). The directory itself can also not allow any writes (chmod 700 ~/.ssh)

share|improve this answer
    
chmod 600 ~/.ssh/authorized keys I think –  Paweł Brodacki May 18 '11 at 15:17
    
You are correct...bad place to typo :) –  Alex May 18 '11 at 15:19
    
I cannot believe I got fooled by this simple thing! Thank you! –  SaltyNuts May 18 '11 at 15:20
add comment

You can actually comment out AuthorizedKeysFile, as it's the default.

What's the server logging when failing currently? Have you checked permissions on .ssh and authorized_keys and/or disabled StrictModes?

Increase the LogLevel if necessary and/or run sshd in detached mode.

share|improve this answer
add comment

Quick-and-dirty solution: copy /etc/ssh/sshd_config and /etc/ssh/ssh_config from a server where it works.

You could also strip all comments from the files on working and non-working server (e.g. run egrep -v '^#' /etc/ssh/sshd_config | sort | uniq and compare results on both servers.

Also look at the directory and file permissions, as Alex suggested.

share|improve this answer
    
vote up for the very handy grep command –  SaltyNuts May 18 '11 at 15:21
    
ssh_config controls the client-side of ssh, copying it to the server you want to connect to is not useful. –  rsl May 18 '11 at 15:27
    
Right, there's no point copying client's config to the server side. –  Paweł Brodacki May 19 '11 at 5:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.