SSH without password

Question

I'm unable to ssh without a password for some reason on a new CentOS box.

I've tried following these guides:

• http://linuxproblem.org/art_9.html
• http://www.thegeekstuff.com/2008/11/3-steps-to-perform-ssh-login-without-password-using-ssh-keygen-ssh-copy-id/

But neither are working. I even checked my /etc/ssh/sshd_config file. PubkeyAuthentication yes was originally commented out so I uncommented that line and restarted sshd but still to no avail. Any thoughts of anything else that could be missing?

I'm trying to ssh from server A to server B as root. Thus, logged in as root on one box, then ssh to the next as root without being prompted for a password.

UPDATE

I ran a ssh -v ... but cannot copy/paste into here. Everything looked good until this line:

debug1: Next authentication method:  gssapi-with-mic
debug1: Unspecified GSS failure.  Minor Code may provide more information
Unknown code krb5 195

Answer 1

A small how-to for public key based authentication for CentOS/Red Hat/etc...

On the SSH client:

ssh-keygen # Accept all defaults, do not enter a password.
ssh-copy-id USER@SERVER_IP
restorecon -R ~/.ssh

On the SSH server:

# Login to the server normally (with password)
restorecon -R ~/.ssh

Public key based authentication should now work.

Answer 2

These problems (which are usually permissions related) are much more easily debugged from the server side. I recommend that you start another sshd in debug mode with: /usr/sbin/sshd -d -p 2222 which will start another sshd on port 2222, then run ssh -p 2222 user@sshserver on the client side. Watch what comes out of the sshd when your client tries to authenticate.

Permissions problems don't have to be just /home/$USER/.ssh. it could also be a problem with /, /home, or /home/$USER. If any of those are group writable it can be a problem.

Another common problem is that you mis-paste and put linebreaks in the middle of your key in the authorized_keys file

Answer 3

serverA# ls -lah /root
serverA# ls -lah /root/.ssh
serverA# selinuxenabled 
serverA# echo $?

serverB# ls -lah /root
serverB# ls -lah /root/.ssh
serverB# senlinuxenabled
serverB# echo $?

If that doesn't show you the problem, try the following. ServerA is the client and serverB the ssh server.

On serverB, edit /etc/ssh/sshd_config. Find the line that looks like:

LogLevel INFO

Change it to:

LogLevel VERBOSE

Then:

serverB# /etc/init.d/sshd restart

On serverA:

serverA# ssh -vvv root@serverb

You can now reivew the /var/log/secure file on serverB for clues.

As a final tip, please review:

http://www.ibm.com/developerworks/library/l-keyc/index.html

Answer 4

Check your permissions, they should be

drwx------

for your .ssh directory and

-rw-------

for your authorized_keys file.

So, to set the permissions properly, try this:

chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Answer 5

If you have SELinux enabled, then this is a common problem...

Run the following on the SSH server:

restorecon -R /home/$USER/.ssh

or, for root:

restorecon -R /root/.ssh

'Nuff Said...