1

SSH Keys are broken and I've read many threads trying to fix this. Any advice?

I've masked possibly sensitive information such as the IP addresses and SSH keys with [REMOTE_IP_ADDRESS], [LOCAL_IP_ADDRESS] and XXXXXXXXXXXXXX.

ON LOCAL MACHINE

SELinux is off

getenforce Disabled
sestatus 
SELinux status:                 disabled

STANDARD KEY TRANSFER

cat .ssh/id_rsa.pub | ssh jnowacki@[REMOTE_IP_ADDRESS] 'cat >> .ssh/authorized_keys' 
ssh jnowacki@[REMOTE_IP_ADDRESS] "chmod 700 .ssh; > chmod 640 .ssh/authorized_keys" 
ssh jnowacki@[REMOTE_IP_ADDRESS] "chmod > 700 .ssh; chmod 640 .ssh/authorized_keys" 
ssh jnowacki@[REMOTE_IP_ADDRESS]

FAILED. It still asks for a password. Made multiple attempts.

I did this and it didn't help:

ssh-agent bash 
ssh-add ~/.ssh/id_rsa

ALSTERNATIVE KEY TRANSFER

ssh-copy-id -i jnowacki@[REMOTE_IP_ADDRESS] 
ssh jnowacki@[REMOTE_IP_ADDRESS] ssh 'jnowacki@11.22.81.50'

FAIL: ASKS FOR PASSWORD

LOCAL SERVER SSH KEY PERMISSIONS

ls -ltrh ~/.ssh/  | awk '{print $1 "\t" $9}' 
-rw-r--r--      id_rsa.pub
-rw-------      id_rsa
-rw-------      known_hosts.old
-rw-------      known_hosts
-rw-r-----      authorized_keys

REMOTE MACHINE

I ran this ssh-agent bash ssh-add ~/.ssh/id_rsa

LOCAL SERVER SSH KEY PERMISSIONS

ls -ltrh ~/.ssh/  | awk '{print $1 "\t" $9}'
-rw-r--r--      id_rsa.pub
-rw-------      id_rsa
-rw-------      known_hosts.old
-rw-------      known_hosts
-rw-r-----      authorized_keys

Each time checked to make sure only 1 key is in the files.

cat authorized_keys  | grep ssh-rsa | wc -l 
1

cat id_rsa.pub  | grep ssh-rsa | wc -l 
1

DEBUGGING on REMOTE SERVER

root@Ubuntu-Z800F:/etc/ssh# /usr/sbin/sshd -d -p 2222
debug1: sshd version OpenSSH_7.2, OpenSSL 1.0.2g  1 Mar 2016
debug1: private host key #0: ssh-rsa SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
debug1: private host key #1: ssh-dss SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
debug1: private host key #2: ecdsa-sha2-nistp256 SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
debug1: private host key #3: ssh-ed25519 SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: rexec_argv[2]='-p'
debug1: rexec_argv[3]='2222'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 2222 on 0.0.0.0.Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.Server listening on :: port 2222.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3Connection from [LOCAL_IP_ADDRESS] port 41850 on [REMOTE_IP_ADDRESS] port 2222
debug1: Client protocol version 2.0; client software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: permanently_set_uid: 105/65534 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: diffie-hellman-group-exchange-sha256 [preauth]
debug1: kex: host key algorithm: ssh-rsa [preauth]
debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha1 compression: none [preauth]
debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha1 compression: none [preauth]
debug1: expecting SSH2_MSG_KEX_DH_GEX_REQUEST [preauth]
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received [preauth]
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent [preauth]
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT [preauth]
debug1: rekey after 4294967296 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: rekey after 4294967296 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user jnowacki service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "jnowacki"
debug1: PAM: setting PAM_RHOST to "[LOCAL_IP_ADDRESS]"
debug1: PAM: setting PAM_TTY to "ssh"

It then asks for a password on local server. This is the last line I see. Screenshot provided for proof.

Last Line

SSH -VV ON LOCAL SERVER

ssh -vv -p 2222 jnowacki@[REMOTE_SERVER]
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to [LOCAL_SERVER} [[LOCAL_SERVER}] port 2222.
debug1: Connection established.
debug1: identity file /home/bckadm/nowackj1/.ssh/id_dsa type -1
debug1: identity file /home/bckadm/nowackj1/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-sha1
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug2: mac_setup: found hmac-sha1
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 159/320
debug2: bits set: 1030/2048
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: checking without port identifier
debug1: Host '[LOCAL_SERVER}' is known and matches the RSA host key.
debug1: Found key in /home/bckadm/nowackj1/.ssh/known_hosts:2
debug1: found matching key w/out port
debug2: bits set: 1008/2048
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/bckadm/nowackj1/.ssh/id_dsa ((nil))
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/bckadm/nowackj1/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
jnowacki@[LOCAL_SERVER}'s password:
  • Can you also include the client output with ssh -vv (extra verbose logging)? Pay attention to messages like “offering key”, and if they don’t appear, it means the client isn’t trying key based authentication. – Rouben Feb 5 at 4:20
  • 1
    Please post the rest of the ssh server debug log. – Michael Hampton Feb 5 at 4:21
  • 1
    And please post your sshd configuration as well. – Gerald Schneider Feb 5 at 6:56
  • 1
    Also check the lines containing IdentityFile /etc/ssh/ssh_config on the local machine. – Jenny D Feb 5 at 8:19
  • 1
    In any case, disabling SELinux is a bad way to solve a problem. – bviktor Feb 5 at 16:39
1

The line

debug1: identity file /home/bckadm/nowackj1/.ssh/id_dsa

indicates that your ssh client is only finding and using a dsa key, where all your other commands refer to rsa keys.

Since OpenSSH 7.0 the dss (dsa) algorithm is disabled by default 1 (which I think the subsequent debugging lines hint at):

debug1: Trying private key: /home/bckadm/nowackj1/.ssh/id_dsa
debug2: we did not send a packet, disable method

So IMHO that explains why you can't log on, but as to why that happens... I can't tell you.

0

I had to type this command:

vim /etc/ssh/ssh_config

And then activate id_rsa by un-commenting it. Thank you so much guys! You are awesome!

Broken:

 # IdentityFile ~/.ssh/identity
 # IdentityFile ~/.ssh/id_rsa 
 IdentityFile ~/.ssh/id_dsa

Working:

#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_dsa

Key error in log file:

debug1: Trying private key: /home/bckadm/nowackj1/.ssh/id_dsa debug2: we did not send a packet, disable method

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.