Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I know that ssh problems were already discussed here still before down-vote this question, please, read. :-)

I have two freshly installed virtually equal servers under CentOS 6. They are used in DRBD/HA environment. All settings on both of them, AFAIK, are the same. Most of them where copied with rsync.

I can log-in as root with my key being accepted to both servers; however I can log-in as normal user only on one of them (master1).

Some more info.

User: The permissions on users home-directory and his .ssh are 700. The files: authorized_keys, id_dsa, id_rsa are 600. Whole structure of /HOME is exactly the same on both machines (rsynced).

Configuration: GSSAPI, Kerberos and PAM are deactivated. sshd_config and ssh_config files are exactly the same on both machines (rsynced). The same is true for /etc/hosts, /etc/passwd, /etc/group, /etc/shadow, network settings (except IPs and MACs), running services (except that these started with heartbeat are not running on master2)...

A try to loggin as a user xxxx from master1 to master2 looks like:

ssh -v master2
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to master2 [XXX.XXX.XX.2] port 22.
debug1: Connection established.
debug1: identity file /home/xxxx/.ssh/identity type -1
debug1: identity file /home/xxxx/.ssh/id_rsa type 1
debug1: identity file /home/xxxx/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'master2' is known and matches the RSA host key.
debug1: Found key in /home/xxxx/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/xxxx/.ssh/identity
debug1: Offering public key: /home/xxxx/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Offering public key: /home/xxxx/.ssh/id_dsa
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: password
xxxx@master2's password:

Now comes the fun:

I've started the sshd in debug/non-forking mode (in temp_sshd I've changed port to 12345):

cp /etc/ssh/sshd_config ~/temp_sshd_config
vi  ~/temp_sshd_config
/usr/sbin/sshd -f ~/temp_sshd_config -dd

Than loggin as normal user works with public-key:

ssh -v -p 12345 master2
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to master2 [XXX.XXX.XX.2] port 12345.
debug1: Connection established.
debug1: identity file /home/xxxx/.ssh/identity type -1
debug1: identity file /home/xxxx/.ssh/id_rsa type 1
debug1: identity file /home/xxxx/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: checking without port identifier
debug1: Host 'master2' is known and matches the RSA host key.
debug1: Found key in /home/xxxx/.ssh/known_hosts:2
debug1: found matching key w/out port
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/xxxx/.ssh/identity
debug1: Offering public key: /home/xxxx/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Last login: Wed Feb 29 15:06:25 2012 from master1

As I want to set PasswordAuthentication NO in sshd, I need to have public-key loggin running.

Any help most welcome.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Please show/examine ssh server's log (/var/log/secure) at master2 as well. Since it's the server who decides whether to accept the public key, the answer should be there.

Personally, I suspect it has something to do with SELinux context (not copied by rsync without -X).

share|improve this answer
    
You were right. I was sure that I disabled SELinux on both nodes, but I was wrong. I did it only on master1. Thank you! Unfortunately I can't vote-up your answer. Once again thanks. –  Kris_R Mar 1 '12 at 19:51
    
You can check it as the chosen answer instead... –  ivan_pozdeev Mar 2 '12 at 22:47
    
however I can do it now :-) Thanks again –  Kris_R Mar 29 '13 at 14:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.