Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to connect to my own CentOS server using SSH; I am able to connect fine with a password; I am trying to connect with my public key, but the server does not attempt public key authentication. I have followed all instructions on this page in the CentOS wiki, and verified the following things:

  • I am running CentOS 6.0 or later

  • My sshd_config has the following:

    PermitRootLogin no
    PubkeyAuthentication Yes
    RSAAuthentication yes
    AuthorizedKeysFile .ssh/authorized_keys
    
  • I have created a private key in the .ssh/ folder in my home directory on the client

  • The full text of the public key (generated by ssh-keygen) takes up a single line in the .ssh/authorized_keys file in my home directory on the server.
  • I have the following permission modes set on both client and server:

    chmod 700 .ssh
    chmod 600 .ssh/*
    
share|improve this question
add comment

1 Answer

up vote 10 down vote accepted

According this issue report on the CentOS web site, this is caused by an upstream "feature" in SELinux; if SELinux is enforcing, it will prevent the server from using pubkey authentication. There is no indication that this behavior will change in the near future. To see if this problem applies to you, type sestatus and see if it reports "Current mode" as enforcing.

I know of two workarounds.

  • You can set SELinux to permissive mode. Type setenforce 0 to change the policy immediately, and then open /etc/selinux/config and make sure SELINUX=permissive.
  • Restore the file to the correct security context:

    restorecon -R -v ~$USER/.ssh
    
share|improve this answer
    
Was this indeed the problem? –  Andy Shinn Jun 23 '12 at 0:38
    
It was, although my sysadmin later told me that SELinux was not supposed to be running in the first place. –  ILikeFood Jun 23 '12 at 0:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.