1

I tried setting up PubKey authentication between my Mac and CentOS dedi server, but something is up...

Here's the steps I took:

  ssh-keygen -t rsa

Then

  chmod 700 .ssh/ && chmod 600 .ssh/*

Then

  scp id_rsa.pub root@dedi:~/.ssh/authorized_keys

Then (sorry about all these "Then"'s)

  ssh root@dedi

And what do you know? I get prompted for my password.

Any ideas? Thanks!

EDIT: Here's the output of ssh -v root@dedi:

  SH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
  debug1: Reading configuration data /etc/ssh_config
  debug1: /etc/ssh_config line 20: Applying options for dedi
  debug1: Connecting to dediserversdomain.com.au.co.net.org.bz [198.100.145.168] port 22.
  debug1: Connection established.
  debug1: identity file /Users/someone/.ssh/id_rsa,~/.ssh/id_dsa type -1
  debug1: identity file /Users/someone/.ssh/id_rsa,~/.ssh/id_dsa-cert type -1
  debug1: Enabling compatibility mode for protocol 2.0
  debug1: Local version string SSH-2.0-OpenSSH_6.2
  debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
  debug1: match: OpenSSH_5.3 pat OpenSSH_5*
  debug1: SSH2_MSG_KEXINIT sent
  debug1: SSH2_MSG_KEXINIT received
  debug1: kex: server->client aes128-ctr hmac-md5 none
  debug1: kex: client->server aes128-ctr hmac-md5 none
  debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
  debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
  debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
  debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
  debug1: Server host key: RSA (my rsa key)
  debug1: Host 'dediserversdomain.com.au.co.net.org.bz' is known and matches the RSA host key.
  debug1: Found key in /Users/someone/.ssh/known_hosts:1
  debug1: ssh_rsa_verify: signature correct
  debug1: SSH2_MSG_NEWKEYS sent
  debug1: expecting SSH2_MSG_NEWKEYS
  debug1: SSH2_MSG_NEWKEYS received
  debug1: Roaming not allowed by server
  debug1: SSH2_MSG_SERVICE_REQUEST sent
  debug1: SSH2_MSG_SERVICE_ACCEPT received
  debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
  debug1: Next authentication method: publickey
  debug1: Trying private key: /Users/someone/.ssh/id_rsa,~/.ssh/id_dsa
  debug1: Next authentication method: password
  root@dediserversdomain.com.au.co.net.org.bz's password:

EDIT: Output of stat .ssh and stat .ssh/* from within my dedi:

  File: `.ssh'
  Size: 4096        Blocks: 8          IO Block: 4096   directory
  Device: 801h/2049d    Inode: 1175048     Links: 2
  Access: (0700/drwx------)  Uid: (    0/    root)   Gid: (    0/    root)
  Access: 2014-09-21 11:21:43.000000000 -0400
  Modify: 2014-09-21 10:52:26.000000000 -0400
  Change: 2014-09-21 11:21:49.000000000 -0400

  File: `.ssh/authorized_keys'
  Size: 411         Blocks: 8          IO Block: 4096   regular file
  Device: 801h/2049d    Inode: 1175045     Links: 1
  Access: (0600/-rw-------)  Uid: (    0/    root)   Gid: (    0/    root)
  Access: 2014-09-21 10:52:26.000000000 -0400
  Modify: 2014-09-21 10:52:26.000000000 -0400
  Change: 2014-09-21 11:21:43.000000000 -0400

EDIT: Here's the output of /usr/sbin/sshd -d

  debug1: sshd version OpenSSH_5.3p1
  debug1: read PEM private key done: type RSA
  debug1: private host key: #0 type 1 RSA
  debug1: read PEM private key done: type DSA
  debug1: private host key: #1 type 2 DSA
  debug1: rexec_argv[0]='/usr/sbin/sshd'
  debug1: rexec_argv[1]='-d'
  Set /proc/self/oom_score_adj from 0 to -1000
  debug1: Bind to port 22 on 0.0.0.0.
  Bind to port 22 on 0.0.0.0 failed: Address already in use.
  debug1: Bind to port 22 on ::.
  Bind to port 22 on :: failed: Address already in use.
  Cannot bind any address.

EDIT: Here's the output of grep 'sshd' /var/log/*: Binary file /var/log/btmp matches Binary file /var/log/btmp-20140901 matches /var/log/dovecot-info.log:Aug 08 09:10:03 pop3-login: Info: Disconnected (auth failed, 1 attempts): user=, method=PLAIN, rip=211.43.207.112, lip=198.100.145.168 /var/log/install_rtm.log:rtm hINFO_TCP_LISTEN_IP-0-0-0-0_PORT-22_procname|sshd /var/log/install_rtm.log:rtm hINFO_TCP_LISTEN_IP-0-0-0-0_PORT-22_cmdline|/usr/sbin/sshd /var/log/install_rtm.log:rtm hINFO_TCP_LISTEN_IP-0-0-0-0_PORT-22_exe|/usr/sbin/sshd /var/log/install_rtm.log:rtm hINFO_TCP_LISTEN_IP-0_PORT-22_procname|sshd /var/log/install_rtm.log:rtm hINFO_TCP_LISTEN_IP-0_PORT-22_cmdline|/usr/sbin/sshd /var/log/install_rtm.log:rtm hINFO_TCP_LISTEN_IP-0_PORT-22_exe|/usr/sbin/sshd

8
  • Did you also set up/confirm that the remote permissions on the /root/.ssh directory (0700) and /root/.ssh/authorzed_keys file (0600) are correct? (And generally remote root login should be disabled; you should log in first using an unprivileged account and than use sudo)
    – HBruijn
    Sep 21 '14 at 15:15
  • That's correct. I will add the output of stat .ssh and stat .ssh/* in my OP (executed from my dedi). Sep 21 '14 at 15:23
  • @HBruijn please see my OP. Sep 21 '14 at 15:25
  • Check the logs on the server. Sep 21 '14 at 15:31
  • 1
    @user3650841 Is rsyslog running? Restart it and check configured facilities. Sep 21 '14 at 22:41
2

In /etc/ssh/sshd_config, set LogLevel to DEBUG3, then service sshd restart

tail -F /var/log/secure > /root/tmp.txt: this is a useful way of getting only the logs relating to the test; although you'll get a few old lines beforehand. It will appear to hang (you can put it in the background if you like)

Attempt to auth again (presumably it will fail). Kill the tail -F ... job you started earlier. The reason for the failure will very likely be seen in /root/tmp.txt.

Most of the time its due to a poorly formatted (or line-wrapped) entry in your /root/.ssh/authorized_keys (mind the American English spelling).

Other common reasons:

  • AllowRoot is set to no;
  • PubKeyAuthentication is set to no (mind also RSAAuthentication, which is for SSH version 1 (which should be disabled)

You might also be on the lookout for a Limit stanza which might treat you differently.

3
  • None of this worked. Even when I changed LogLevel to DEBUG3 — and restarted sshd, as soon as I login to my server again, /var/log/secure is completely empty. Would you like me to post anything in particular on my OP? Any outputs? Sep 23 '14 at 15:21
  • You might like to grep through /var/log/ looking for 'sshd'. It might end up in 'messages' or somewhere else according to you logging configuration. Sep 23 '14 at 22:15
  • —— I'm adding the output of grep 'sshd' /var/log/* to my OP. Sep 24 '14 at 23:40
0

Check to see if selinux is running with

sestatus

Turn it off (temporarily) with

setenforce 0

If you are then allowed to login, you have two options: You can turn it off permanently by editing:

/etc/sysconfg/selinux

I cant remember exactly what this file looks like, but IIRC its very simple.

OR, you can ensure the selinux context is set correctly on the .ssh folder and files

restorecon -R ~/.ssh

1
  • This is not the problem. Sep 23 '14 at 15:24
0

Is selinux on? Check /var/log/messages to check it out. If selinux is not the problem. Try stop sshd service and start it on console:

user@server# /usr/sbin/sshd -d

This doesn't help as you got already in use the port with the main daemon.

  Bind to port 22 on :: failed: Address already in use.
  Cannot bind any address.

SSHD pub key auth may fail for:

  1. Invalid permissions on server user's home ~/.ssh with perms other than 700 (try checking out if the perms are the same of the one you put on the src)
  2. ~/.ssh/authorized_keys with perms other than 600 (try checking out if the perms are the same of the one you put on the src)
  3. Different owner of ~/.ssh or ~/.ssh/authorized_keys (if you used scp with your user I don't think this may be a problem)
  4. SElinux missconfiuration
  5. Wrong set of keys

You may check out

#tail -f /var/log/secure

When you are trying to connect

6
  • This is not the problem. Sep 23 '14 at 15:23
  • did you get the execution of /usr/sbin/sshd -d ? Sep 24 '14 at 16:15
  • Now that I've followed more info up there ^^ I have some output from that. I'll add it to my OP. Sep 24 '14 at 23:38
  • yeh, you should stop first your sshd service before executing /usr/sbin/sshd -d . Don't worry it would not log you out. Sep 25 '14 at 1:00
  • — when I stop my SSHD service (I've done it in the past) — it logs me straight out. Makes sense though, since it stops listening on port 22. Sep 26 '14 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.