Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having difficulties logging in to a VPS running CentOS 5.5 using Public key authentication. I can log in to both a standard user account and the root account using password authentication. I am using Windows and Cygwin, all Cygwin and Windows stuff has been working completely fine for months; I am sure the issue is server side.

I have used ssh-keygen to create both an id_rsa private key and an id_rsa.pub public key. I have copied this into the user directory on the server and done cat id_rsa.pub >> authorized_keys. My /home/myuser/.ssh directory is set to 700, the authorized_keys file is set to 600.

When logging in my system reports the following (-vvv):

Next authentication method: publickey
Offering RSA public key /.ssh/id_rsa
send_pubkey_test
we sent a publickey packet, wait for reply
Authentications that can continue: publickey,password

Then asks me for a password. From my server's /var/log/auth file I have the following related to the public key process

sshd[28249]: input_userauth_request: try method publickey
sshd[28249]: test whether pkalg/pkblob are acceptable
sshd[28249]: mm_key_allowed entering
sshd[28249]: mm_request_send entering: type 21
sshd[28249]: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED
sshd[28249]: mm_request_receive_expect entering: type 22
sshd[28248]: monitor_read: checking request 21
sshd[28249]: mm_request_receive entering
sshd[28248]: mm_answer_keyallowed entering
sshd[28248]: mm_answer_keyallowed: key_from_blob: 0x2b6ea1049910
sshd[28248]: temporarily_use_uid: 10022/10022 (e=0/0)
sshd[28248]: trying public key file /home/myuser/.ssh/authorized_keys
sshd[28248]: secure_filename: checking '/home/myuser/.ssh'
sshd[28248]: secure_filename: checking '/home/myuser'
sshd[28248]: secure_filename: terminating check at '/home/myuser'
sshd[28248]: restore_uid: 0/0
sshd[28248]: key not found
sshd[28248]: temporarily_use_uid: 10022/10022 (e=0/0)
sshd[28248]: trying public key file /home/myuser/.ssh/authorized_keys
sshd[28248]: secure_filename: checking '/home/myuser/.ssh'
sshd[28248]: secure_filename: checking '/home/myuser'
sshd[28248]: secure_filename: terminating check at '/home/myuser '
sshd[28248]: restore_uid: 0/0
sshd[28248]: key not found
sshd[28248]: Normalising mapped IPv4 in IPv6 address
sshd[28248]: Failed publickey for myuser from 87.115.220.187 port 59636 ssh2

As if it can't find the authorized_keys file. However the command nano /home/myuser/.ssh/authorized_keys opens the file without issue.

From /etc/ssh/sshd_config:

PubkeyAuthentication yes
AuthorizedKeysFile  .ssh/authorized_keys

Some people have reported that line breaks in the authorized_keys file can cause issues so I've made sure there are none (only 1 key in it anyway). The file begins with ssh-rsa then has the long key and finally a space and M1ke@M1ke-PC.

Anyone got any ideas?

share|improve this question
    
Also the myuser directory is also set to 700. Can't remember if I did that or it was already that way. –  M1ke Mar 10 '12 at 19:00
    
What about file ownerships? Does myuser own all the relevant dirs and files on the server side? –  Steven Monday Mar 10 '12 at 19:58
1  
Can you append the following output to your question: ls -ld /home/myuser/.ssh{,/authorized_keys}. I suspect that perhaps the user doesn't own the directory and file? –  Beaming Mel-Bin Mar 10 '12 at 20:01
    
Run sshd with debug, then it logs very clear info about permission issues via syslog. –  Jiri Xichtkniha Mar 10 '12 at 20:28
    
@JiriXichtkniha In RHEL/CentOS this sort of information is logged to /var/log/secure without any modification to the configuration. –  Kyle Smith Mar 10 '12 at 22:11
show 9 more comments

2 Answers

Is SELinux enabled ? If yes, the file requires context to be set.

share|improve this answer
    
a) How do I find out if it is enabled? b) If so, how do I "set context"? –  M1ke Mar 11 '12 at 19:26
    
The link on the post has that information. Anyways, run "sestatus" as root to view the current selinux status. If it is enabled, you could disable selinux altogether as a temporary measure, until you completely read and understand on managing SELinux. –  Shyam Sundar C S Mar 11 '12 at 19:36
    
I looked up SELinux and ran "sestatus". It is set to "disabled". –  M1ke Mar 11 '12 at 19:45
    
What are the "PubkeyAuthentication" and "AuthorizedKeysFile" directives in /etc/ssh/sshd_config set to ? –  Shyam Sundar C S Mar 11 '12 at 20:24
    
Edited it into OP. –  M1ke Mar 12 '12 at 10:26
show 3 more comments

If you really did do this cat id_rsa.pub < authorized_keys then your authorized_keys file won't then contain a public key to match the private key you are using so ssh falls back to password authentication. To fix the problem

cat id_rsa.pub >>authorized_keys

to add the new public key to your authorized_keys.

share|improve this answer
    
Um, no. cat id_rsa.pub < authorized_keys doesn't overwrite anything. But it definitely doesn't do anything useful, either. I suspect the question simply has a typo, replacing < for >. –  Steven Monday Mar 10 '12 at 23:08
    
You're right! but if the op did that then authorized_keys still won't have the correct public key and would be asked for the password. –  Iain Mar 10 '12 at 23:11
    
True, but later in the question, OP mentions that he has inspected the authorized_keys file, and that it does contain (what he assumes to be) his public key. –  Steven Monday Mar 10 '12 at 23:16
    
ass u me - without any other evidence ... –  Iain Mar 10 '12 at 23:19
    
Aha, now I believe I can agree with your answer. +1. –  Steven Monday Mar 10 '12 at 23:30
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.