Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was able to setup ssh login using public keys for root users and tried to apply the same logic for non-root users. I have tried to troubleshoot this issue in vain. I am using centos for both my local machine and remote server.

Here is a gist of my sshd_config file a my remote server,

RSAAuthentication yes
PublicKeyAuthentication yes
AuthorizedKeysFile /etc/ssh/user/authorized_keys

PasswordAuthentication no

UsePAM no

PermitRootLogin without-password

I have moved my authorized keys file away from the user's home to /etc/ssh/user/authorized_keys as I read about home dir encryption in centos.

I have also changed the ownership of all files/dirs associated to the non-root user.

Not sure what step I am missing in my config as the same config works very well for root remote logins.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Remove the authorized_keys entry in your config file. Restart sshd. Make a .ssh directory in your non-root user home directory. Put the key in a file called ~/.ssh/authorized keys. Make the directory 0700 and the authorized_keys file 0644. Do the same for the root user.

share|improve this answer
    
Do you want me to use the same authorized_keys file for both root and non-root user? –  user2887201 Nov 17 '13 at 4:20
    
Up to you............... –  dmourati Nov 17 '13 at 4:21
    
I am still getting the same permission denied (publickey,gssapi-keyex,gssapi-with-mic) –  user2887201 Nov 17 '13 at 4:25
    
When I tried ssh user@remotehost as a root user the authentication failed. But when I tried logging in as "user" the connection went through. This is a start, thanks a lot! –  user2887201 Nov 17 '13 at 4:32
    
The root ssh key file goes in /root/.ssh/authorized_keys –  dmourati Nov 17 '13 at 4:56

Just to be clear, you need the PUBLIC key file (e.g. ~/.ssh/id_rsa.pub) from the origin machine to be in ~/.ssh/authorized_keys on the destination machine.

If you copy over ~/.ssh/id_rsa then that won't work. Modern sshd will also insist on ~/.ssh being mode 700 and ~/.ssh/authorized_keys being mode 600 on the destination machine.

Aside: if you can, use sudo instead of allowing root logins over ssh.

share|improve this answer
    
Actually 644 is OK for authorized_keys. When all is said and done it is a list of public keys. –  Iain Nov 23 '13 at 8:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.