Passwordless root SSH on CentOS 6 with public key

Question

I am trying to create a "passwordless" setup so that the remote server is more secure without password + I can automate the login process.

I have created a new ssh key with ssh-keygen, and copied the public file to the remote server in ./ssh/authorized_keys, however I still get prompted to enter the password.

The server is running on CentOS 6.8

Here my steps

On my local machine (OS X)

ssh-keygen (and left empty passphrase)

pbcopy < ~/.ssh/remote_server.pub (on Mac, this copies the content of the public file)

On the remote server (CentOS 6.8)

$ cd /root/.ssh

$ touch authorized_keys

$ nano authorized_keys (then pasted in the content of the public key and saved the file)

$ chmod 600 authorized_keys

$ service sshd restart

Then when I try to access via SSH service (i.e. ssh remove-server.com) I still get the normal password prompt.

Is there an issue with the file ownership/permissions?

Update

this is the content of the remote's /etc/ssh/sshd_config file

#   $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  .ssh/authorized_keys
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing, 
# and session processing. If this is enabled, PAM authentication will 
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
UsePAM yes

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem   sftp    /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   ForceCommand cvs server

Output of ssh -v

...
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/m/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Offering RSA public key: /Users/m/.ssh/centos_server
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /Users/m/.ssh/id_dsa
debug1: Trying private key: /Users/m/.ssh/id_ecdsa
debug1: Trying private key: /Users/m/.ssh/id_ed25519
debug1: Next authentication method: password

Also, have set permissions to also fix a bug with SELinux

chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
restorecon -R -v /root/.ssh

Source

Answer 1

First of all, you should not be shelling into your remote server as root! even with key authentication. The safer thing to do is to create another, normal user and add them to sudoers (use the visudo command for this). Then disable login as root using sudo passwd -l root

Then you need to edit your /etc/ssh/sshd_config file to enable pubkey authentication. Find the line that says PasswordAuthentication and set this to no (if you want to disable password challenges for all users)

Make sure that RSAAuthentication and PubkeyAuthentication are set to yes.

Also, disable root login by setting PermitRootLogin no

If in case PermitRootLogin doesn't works as you require try this alternative by adding

DenyUsers root

Answer 2

Connect with ssh -v user@host and you will have more information. Usually the .ssh folder and authorized_keys permissions cause trouble in these settings.

I use ssh-copy-id to authorize keys in remote hosts.

Answer 3

I've had this issue. in your sshd_config file, change:
#PermitRootLogin yes
to
PermitRootLogin without-password
I agree that allowing root to login in without a password is dumb, however
We have a "root trusted node." Only that machine has permission to log in as root, without a password, on all of our servers. This way, we can automate tasks when necessary.

To do this, add this phrase to the end of your authorized_key line:
root@mytrustednode (Notice the space before root)
where mytrustednode is the hostname of your "root trusted node." That way, only the root user on mytrustednode can log in to the machine without a password.

Answer 4

Typically you want the .ssh directory permissions to be 700 (drwx------) and the public key (.pub file) to be 644 (-rw-r--r--). Your private key (id_rsa) should be 600 (-rw-------).

enter link description here

Source