Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm completely at a loss as to what is preventing my local machine from authenticating the connection that is being forwarded from the remote server.

I've read a ton of the posts on here regarding this and man, I swear I've tried damn near everything.

The guide I've been following can be found here: http://www.zeespencer.com/articles/building-a-remote-pairing-setup/

Basically where I'm stuck at is in forcing passwordless authentication. If I allow passwords in sshd_config, when I connect to pair@pair-server I am prompted for my local user password and am able to login remotely, so I am being forwarded. But, as soon as I turn it off, I get the following

   λ   ssh pair@pair-server 
Permission denied (publickey).
Connection to pair-server closed.

Verbose output here: https://gist.github.com/anonymous/0c2b3892596d5ded6abb

I currently have my local user key.pub in pair@pair-server's .ssh/authorized_keys which are command directed to ssh back to localhost. pair@pair-server has it's own key, on my computer I've added pair@pair-server's key.pub to .ssh/authorized_keys.

Seemingly relevant lines in sshd_config:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys
PermitEmptyPasswords no
PasswordAuthentication no
UseLogin no

account and session settings in /etc/pam.d/sshd on pair-server:

account    required     pam_nologin.so
account    include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

password-auth configuration:

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
share|improve this question
What does the server have in its PAM configuration for account and session? –  Andrew B Jul 11 '13 at 3:19
@AndrewB updated my question to include the server's PAM configuration for account and session. –  Dan Schmidt Jul 11 '13 at 4:29
What about the contents of the password-auth file that is being included? –  Andrew B Jul 11 '13 at 13:43
@AndrewB updated my question to include password-auth config –  Dan Schmidt Jul 12 '13 at 6:08
can you do a ls -la /home/pair/.ssh/authorized_keys ? –  Yann Sagon Jan 20 '14 at 13:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.