0

I am trying to connect to the remote server using ssh, but I have Permission denied (publickey)..

I've gone through all possible reasons I can suggest and other questions suggest.

  • I am sure that my key is correct, I checked many times and I am able to login to the target server from other machine using that key;
  • I set rights on a file to 700

Well, what gives ssh -v:

OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: Reading configuration data /root/.ssh/config
debug1: Applying options for fmbnew
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to --myhost-- [--myip--] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file "~/.ssh/host-key" type -1
debug1: loaded 1 keys
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 
Debian-5+deb8u2
debug1: match: OpenSSH_6.7p1 Debian-5+deb8u2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Host '--myhost--' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:24
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: "~/.ssh/host-key"
debug1: No more authentication methods to try.
Permission denied (publickey).

And this is what found in the auth.log on the server (not much):

Apr  1 12:15:33 host-07 sshd[23955]: Connection closed by --my-client-ip-- [preauth]

I should say that this client machine is pretty old, it has Centos 5. But I need to be sure before I start digging deeper.

Any ideas how can I at least figure out what exactly goes wrong?

EDIT: More verbose server side log (DEBUG1):

Apr  1 13:19:11 host-07 sshd[25465]: debug1: Forked child 25512.
Apr  1 13:19:11 host-07 sshd[25512]: Set /proc/self/oom_score_adj to 0
Apr  1 13:19:11 host-07 sshd[25512]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
Apr  1 13:19:11 host-07 sshd[25512]: debug1: inetd sockets after dupping: 3, 3
Apr  1 13:19:11 host-07 sshd[25512]: Connection from --- port 55088 on --- port 22
Apr  1 13:19:11 host-07 sshd[25512]: debug1: Client protocol version 2.0; client software version OpenSSH_4.3
Apr  1 13:19:11 host-07 sshd[25512]: debug1: match: OpenSSH_4.3 pat OpenSSH_4* compat 0x00000000
Apr  1 13:19:11 host-07 sshd[25512]: debug1: Enabling compatibility mode for protocol 2.0
Apr  1 13:19:11 host-07 sshd[25512]: debug1: Local version string SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u2
Apr  1 13:19:11 host-07 sshd[25512]: debug1: permanently_set_uid: 104/65534 [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: SSH2_MSG_KEXINIT sent [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: SSH2_MSG_KEXINIT received [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: kex: client->server aes128-ctr hmac-sha1 none [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: kex: server->client aes128-ctr hmac-sha1 none [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: expecting SSH2_MSG_KEXDH_INIT [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: SSH2_MSG_NEWKEYS received [preauth]
Apr  1 13:19:11 host-07 sshd[25512]: debug1: KEX done [preauth]
Apr  1 13:19:12 host-07 sshd[25512]: debug1: userauth-request for user myuser service ssh-connection method none [preauth]
Apr  1 13:19:12 host-07 sshd[25512]: debug1: attempt 0 failures 0 [preauth]
Apr  1 13:19:12 host-07 sshd[25512]: debug1: PAM: initializing for "myuser"
Apr  1 13:19:12 host-07 sshd[25512]: debug1: PAM: setting PAM_RHOST to "--myip--"
Apr  1 13:19:12 host-07 sshd[25512]: debug1: PAM: setting PAM_TTY to "ssh"
Apr  1 13:19:12 host-07 sshd[25512]: Connection closed by --myip-- [preauth]
Apr  1 13:19:12 host-07 sshd[25512]: debug1: do_cleanup [preauth]
Apr  1 13:19:12 host-07 sshd[25512]: debug1: monitor_read_log: child log fd closed
Apr  1 13:19:12 host-07 sshd[25512]: debug1: do_cleanup
Apr  1 13:19:12 host-07 sshd[25512]: debug1: PAM: cleanup
Apr  1 13:19:12 host-07 sshd[25512]: debug1: Killing privsep child 25513
  • You need detailed logs from the server. This may involve putting the daemon into debug mode and.or overhauling its syslog setup. – MadHatter Apr 1 '17 at 12:25
  • Done the more verbose log. – confused-demon Apr 1 '17 at 13:29
  • @confused-demon your public file ~/.ssh/id_rsa.pub should be chmod 644 ~/.ssh/id_rsa.pub or whatever key you are using. The ~/.ssh directory must have 700 permissions as suggested by Jeff. – Valentin Bajrami Apr 1 '17 at 13:36
  • This is already so. I have eliminated problem with permissions in the beginning. Why do you think the issue is in that? – confused-demon Apr 1 '17 at 13:37
  • 1
    Ok, you wouldn't believe what stupid was the problem. Because I have written in .ssh/config IdentityFile in quotes. Thanks for help. So in the end it all again squared to the key file, hell... – confused-demon Apr 1 '17 at 13:49
2

If you have root, run sshd in the foreground & in debug mode with sshd -D -d. You'll need to stop the sshd daemon first. The server gives much more specific info on why a key fails.

You mention the file is 0700. What's .ssh? It must also be 0700.

  • Also 0700. I've made a more verbose log, but unfortunately I still cannot parse out any clue for me. Can you look, please? – confused-demon Apr 1 '17 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.