1

I am setting up a continuos integration(CI) server and a test web server. I would like that CI server would access web server with public key authentication. In the web server I have created an user and generated the keys

sudo useradd -d /var/www/user -m user
sudo passwd user
sudo su user
ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/var/www/user/.ssh/id_rsa):
Created directory '/var/www/user/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /var/www/user/.ssh/id_rsa.
Your public key has been saved in /var/www/user/.ssh/id_rsa.pub.

However othe side, CI server copies the key to the host but still asks password

ssh-copy-id -i ~/.ssh/id_rsa.pub user@webserver-address
user@webserver-address's password:
Now try logging into the machine, with "ssh 'user@webserver-address'", and check in:

.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

I checked on the web server and the CI server public key has been copied to web server authorized_keys but when I connect, It asks password.

  ssh 'user@webserver-address'
  user@webserver-address's password:

If I try use root user rather than my created user (both users are with copied public keys). It connects with the public key

  ssh 'root@webserver-address'
  Welcome to Ubuntu 11.04 (GNU/Linux 2.6.18-274.7.1.el5.028stab095.1 x86_64)

   * Documentation:  https://help.ubuntu.com/
  Last login: Wed Apr 11 10:21:13 2012 from *******
  root@webserver-address:~#
3
  • Did you check the ownership and permission of authorized_keys file and .ssh folder? Also, it can be useful to look at /var/log/auth.log file. You can try ssh -v to get debugging information.
    – Khaled
    Apr 11, 2012 at 7:06
  • @Khaled Well I can't see nothing like an error It offers the public key but then goes to passowrd, The ownership is correct as well as it has permission to read.
    – Rafael
    Apr 11, 2012 at 7:33
  • 1
    Check the value of PubkeyAuthentication in your sshd_config file and make sure it is set to yes.
    – Khaled
    Apr 11, 2012 at 8:01

1 Answer 1

2

Your question says you want to log in to the webserver from the CI server. But you then say you created the keys on the webserver. I'm not sure whether this is just a misunderstanding or a mistype.

Here's a brief overview of what you need to do to enable logging in to the webserver from the CI server with keys:

  1. Create the public/private key pair on the CI server
  2. Copy the public part of the key (id_rsa.pub) onto the webserver into the ~/.ssh/authroized_keys file for each user you want to log in as (root, user etc.). I usually just use scp to copy the file over to the server. If you have multiple keys that are going to be used for each user, append them to authorized_keys. Otherwise, if this is the only key for that user, you can just rename id_rsa.pub to authorized_keys.
  3. Make sure the permissions on the .ssh folder are 644 with chmod 644 .ssh and the authorized key file has permissions of 700 with chmod 700 .ssh/authorized_keys.
  4. Attempt to log into the webserver from the CI server with a username who you have copied the public key to on the webserver e.g. ssh user@webserver

It shouldn't ask for a password (this is assuming you have followed @khaled's advice regarding the sshd config file but the defaults are typically set to allow key authentication before password).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .