0

A new server is being setup by referring to an existing server. Passwordless ssh from the server to other machines needs to be supported with multiple key files (more than 6). By referring to the existing server, MaxAuthTries in /etc/ssh/sshd_config has been remarked and the key files have been specified as a list of IdentityFile in /etc/ssh/ssh_config. However, "Too many authentication failures" error is shown for the new server but not for the existing one. From the Verbose mode, it can be observed that the existing server is able to scan more than 6 keys without "Too many authentication failures" error! I have no idea what setting is missed in the new server. How to make it work like the existing one?

For both servers, Ssh config contains a list of IdentityFile only, no host. All other default lines are remarked. All lines in Sshd config remarked. And I tried to ps and cannot see ssh-agent but only sshd.

Ssh client log at server not working well:

debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/appusr/.ssh/KEY1
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering RSA public key: /home/appusr/.ssh/KEY2
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering RSA public key: /home/appusr/.ssh/KEY3
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering RSA public key: /home/appusr/.ssh/KEY4
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering RSA public key: /home/appusr/.ssh/KEY5
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering RSA public key: /home/appusr/.ssh/KEY6
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
Received disconnect from 10.99.72.123: 2: Too many authentication failures
debug1: Authentication succeeded (publickey).
Authenticated to targethost ([10.99.72.123]:22).
...
Connection to targethost closed by remote host.
Connection closed
  • It's unclear whether you try to repair SSH client settings or SSH server settings. – kubanczyk May 5 '18 at 15:20
  • Regardless of client or server settings, just want to enable passwordless ssh support of multiple key files. See if anyone knows what settings could be missed or can be checked. – bboy May 6 '18 at 6:34
  • You didn't clarify the picture. You say that one of side of communication works well. Another side is not working because you're now setting it up. Please clarify which side runs ssh blabla and which side runs a listening sshd. – kubanczyk May 6 '18 at 7:18
  • I understand what you want to know now. Let me define existing server (works well) as A, new server (not OK) as B. Both A & B needs to ssh to C,D,E,F,G,H,I (over 6 servers/keys). – bboy May 6 '18 at 8:13
1

In the ssh config, use Host patterns to limit IdentityFile to a key that will be accepted by that host. (Remember that it will try every matching key in ssh-agent or the config.)

Host unixbox*.example.org
  IdentifyFile ~/.ssh/id_ecdsa

Also, there appears to be a quirk if you have IdentitiesOnly yes in a Host pattern and use ssh-agent. The filtering effect means many keys can be loaded into ssh-agent. What SSH identities will be offered to a remote server and when

  • Thanks! But I still cannot understand why for the working server, from its ssh verbose log, it can shows "Offering RSA public key ..." more than 6 times (actually15 times). And can I know from verbose log whether the key being tried is from ssh-agent or config or command-line? – bboy May 6 '18 at 16:47
  • You will need to carefully review the client and server configuration, ssh -vv and sshd -vv output, and possibly compile time options and patches if custom built. If you collect this data, add it to your question. – John Mahowald May 6 '18 at 23:28
  • Let me supplement the log and config in my question. Thanks in advance. – bboy May 7 '18 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.