1

I have been using FreeBSD running an a virtual machine at DigitalOcean.com.

I use Secure Shell (SSH) from my Mac to remote into a console session on the VM. I used ssh-keygen to create the pair of encryption keys.

I deployed the public one copied to the FreeBSD SSH server. I did so via a back-door web-page supplied by Digital Ocean, pasting the text contents of the public key to a text field in a form.

That works well, logging me in for both root and freebsd users present by default on my new FreeBSD VM. When I connect via either the root or freebsd user accounts via ssh, I am prompted to provide the passphrase protecting my local private key.

ssh root@192.0.2.10

…or…

ssh freebsd@192.0.2.10

Then I installed the Postgres database system onto this FreeBSD server. As part of the scripts used to build and install Postgres, a third user account is added to the FreeBSD machine. By convention, the new account is named postgres. I gave that user a password using the passwd utility.

When I connect to the FreeBSD server as that user:

ssh postgres@192.0.2.10

I am prompted for that postgres user’s own password. I am not prompted for the password protecting my local private encryption key.

➥ Why is the postgres user treated differently than root & freebsd with regard to using the public/private SSH keys to log me in?

FYI, I never touched any authorized_keys file on the remote SSH server (my FreeBSD VM).

My Question here may be a duplicate of Public SSH keys not working for all users on same server, I’m not sure.

  • Did you add your key to that users authorized keys file? – Sven Dec 9 '18 at 0:42
  • @Sven If you mean did I edit the authorized_keys file on the remote SSH server (my FreeBSD VM server), I never did that for any of the three users, not for root or freebsd (predefined when I spun up the new FreeBSD instance), and not for the newly-installed postgres user. – Basil Bourque Dec 9 '18 at 0:45
  • Then you either need to change your cloudinit script to also add that key to the freebsd user or to the script that installs Postgresql. – Sven Dec 9 '18 at 0:50
  • @Sven What key? I used ssh-keygen once, deployed the one public key to the SSH server once, and it worked for both root and freebsd. Why is a third added user treated differently? – Basil Bourque Dec 9 '18 at 0:52
1

Add your public key to the postgresql users authorized keys file. This doesn’t happen during the init phase of your instance like with the root and freebsd user (cloud providers use scripts that do things like deploying ssh keys to a set of predefined users). This can be the same as the freebsd public key or you can use a different keypair for that purpose.

  • Are there multiple authorized_keys files on the SSH server machine? I only know of one: /root/.ssh/authorized_keys. Using cat shows that it has my public SSH key, the key used to auto-login root and freebsd users, presumably. So the problem remains: Why is a newly created postgres user not auto-logged-in? Am I supposed to create another authorized_keys file somewhere else? – Basil Bourque Dec 10 '18 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.