Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I used the official guide to install Gerrit on a Debian server. Now I am stuck at the paragraph where I am supposed to verify that the ssh connection works:

ssh bastian@ip.of.the.server -p 29418       <-- home pc to server

This is my situation: On my home PC I have a user account bastian and I generated a key pair for ssh. On the server there is a root account: root, an account for gerrit: gerrit2, and, again, the account bastian. I added the public key into the web interface of gerrit after login in with OpenID. By advise I also added the public key to /root/.ssh/authorized_keys and /home/bastian/.ssh/authorized_keys (on the server). Then I created the file /home/gerrit2/.ssh/config/ (on the server) with the content:

IdentityFile ~/.ssh/id_rsa

Checking the ssh connection verbosely results in:

OpenSSH_6.0p1 Debian-3ubuntu1, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to [] port 29418.
debug1: Connection established.
debug1: identity file /home/bastian/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/bastian/.ssh/id_rsa-cert type -1
debug1: identity file /home/bastian/.ssh/id_dsa type -1
debug1: identity file /home/bastian/.ssh/id_dsa-cert type -1
debug1: identity file /home/bastian/.ssh/id_ecdsa type -1
debug1: identity file /home/bastian/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version GerritCodeReview_2.5.4 (SSHD-CORE-0.5.1-R1095809)
debug1: no match: GerritCodeReview_2.5.4 (SSHD-CORE-0.5.1-R1095809)
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Server host key: RSA e9:fc:38:b3:86:f6:72:47:de:79:59:ba:c6:c6:de:7e
debug1: Host '[]:29418' is known and matches the RSA host key.
debug1: Found key in /home/bastian/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/bastian/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/bastian/.ssh/id_dsa
debug1: Trying private key: /home/bastian/.ssh/id_ecdsa
debug1: No more authentication methods to try.
Permission denied (publickey).
share|improve this question
Why does it say offering public key, but offer up the id_rsa, and not the ? – NickW May 21 '13 at 10:27
up vote 2 down vote accepted

In your .ssh/config file, what is the IdentityFile line referring to? If it is pointing to the .pub file, you will have issues.. also, where you are being prompted for the password in the log, do you actually have the possibility to enter a password? You may need to use something like ssh-agent.

EDIT : After a lot of double checking and reading through logs and program documentation, we found out that the issue was that the username had not been entered during the initial setup process, which can happen, unfortunately the program did not signal this to the user, I've recommended he open a bug with the Gerrit team. BTW, he had created everything correctly on the system for the users, but Gerrit launches it's own instance of Open-SSH, and the usernames are contained in the Gerrit DB, not on the system itself.

share|improve this answer
Also, is PermitRootLogin enabled in /etc/ssh/sshd_config? – NickW May 21 '13 at 11:24
~/.ssh/config does not exist, but /home/gerrit2/.ssh/config does and it contains the line IdentityFile ~/.ssh/id_rsa. PermitRootLogin is actually enabled. – Bastian May 21 '13 at 13:25
After of the Enter passphrase for key '/root/.ssh/id_rsa': lines I can enter a password, so that is 3 times altogether. – Bastian May 21 '13 at 13:29
Cool, so it isn't accepting the password.. can you recreate the id_rsa without a password? Just as a test obviously.. – NickW May 21 '13 at 13:43
Yes it is, if you're going to connect to the server as a user, that user has to have an account (with password, shell, home directory, etc) on the remote server as well. – NickW May 22 '13 at 12:07

Put your into ~/.ssh/authorized_keys (/home/bastian/.ssh/authorized_keys).

Remember to:

  • make ~/.ssh directory owned by bastian and chmod it to 700
  • make ~/.ssh/authorized_keys file owned by bastian and chmod it to 600

You can make sure above is correct with:

cat > /home/bastian/.ssh/authorized_keys
chown -R bastian /home/bastian/.ssh
chmod -R go-rwx /home/bastian/.ssh

Then use this command to connect:

ssh -i id_rsa bastian@localhost -p 29418
share|improve this answer
@Bastian, @Mike just got to the point, since you are connecting from root account to bastian account, the key must be authorized to bastian. If you happen to try and connect from bastian to bastian, then you will have to create another set of keys to this user and add a copy of bastian's into authorized_keys. – fboaventura May 23 '13 at 18:22
If you read through the comments under mine, we arrived at that a day or so before.. – NickW May 24 '13 at 8:20

You should move your id_rsa and your under .ssh directory. That is the default place where ssh client will be looking for private key. And in your case I see it in /root directory and needs to be in /root/.ssh/ If you want to change that default location you need to modify either your .ssh/config file for local changes to your ssh client settings or in /etc/ssh/ssh_config.

share|improve this answer
Well I forgot to mention that these files are already in /root/.ssh/. So this cannot be the cause. Any other suggestions? – Bastian May 12 '13 at 7:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.