1

I know that ssh problems were already discussed here still before down-vote this question, please, read. :-)

I have two freshly installed virtually equal servers under CentOS 6. They are used in DRBD/HA environment. All settings on both of them, AFAIK, are the same. Most of them where copied with rsync.

I can log-in as root with my key being accepted to both servers; however I can log-in as normal user only on one of them (master1).

Some more info.

User: The permissions on users home-directory and his .ssh are 700. The files: authorized_keys, id_dsa, id_rsa are 600. Whole structure of /HOME is exactly the same on both machines (rsynced).

Configuration: GSSAPI, Kerberos and PAM are deactivated. sshd_config and ssh_config files are exactly the same on both machines (rsynced). The same is true for /etc/hosts, /etc/passwd, /etc/group, /etc/shadow, network settings (except IPs and MACs), running services (except that these started with heartbeat are not running on master2)...

A try to loggin as a user xxxx from master1 to master2 looks like:

ssh -v master2
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to master2 [XXX.XXX.XX.2] port 22.
debug1: Connection established.
debug1: identity file /home/xxxx/.ssh/identity type -1
debug1: identity file /home/xxxx/.ssh/id_rsa type 1
debug1: identity file /home/xxxx/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'master2' is known and matches the RSA host key.
debug1: Found key in /home/xxxx/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/xxxx/.ssh/identity
debug1: Offering public key: /home/xxxx/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: /home/xxxx/.ssh/id_dsa
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: password
xxxx@master2's password:

Now comes the fun:

I've started the sshd in debug/non-forking mode (in temp_sshd I've changed port to 12345):

cp /etc/ssh/sshd_config ~/temp_sshd_config
vi  ~/temp_sshd_config
/usr/sbin/sshd -f ~/temp_sshd_config -dd

Than loggin as normal user works with public-key:

ssh -v -p 12345 master2
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to master2 [XXX.XXX.XX.2] port 12345.
debug1: Connection established.
debug1: identity file /home/xxxx/.ssh/identity type -1
debug1: identity file /home/xxxx/.ssh/id_rsa type 1
debug1: identity file /home/xxxx/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: checking without port identifier
debug1: Host 'master2' is known and matches the RSA host key.
debug1: Found key in /home/xxxx/.ssh/known_hosts:2
debug1: found matching key w/out port
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/xxxx/.ssh/identity
debug1: Offering public key: /home/xxxx/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Last login: Wed Feb 29 15:06:25 2012 from master1

As I want to set PasswordAuthentication NO in sshd, I need to have public-key loggin running.

Any help most welcome.

1 Answer 1

1

Please show/examine ssh server's log (/var/log/secure) at master2 as well. Since it's the server who decides whether to accept the public key, the answer should be there.

Personally, I suspect it has something to do with SELinux context (not copied by rsync without -X).

2
  • You were right. I was sure that I disabled SELinux on both nodes, but I was wrong. I did it only on master1. Thank you! Unfortunately I can't vote-up your answer. Once again thanks.
    – Kris_R
    Mar 1, 2012 at 19:51
  • You can check it as the chosen answer instead... Mar 2, 2012 at 22:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .