SSH configuration, publickeys, Permission denied (publickey,password). error

Question

My task: login from Mac OS Snow Leopard client to Ubuntu 10.10 server without password.

Commands:

client$ mkdir ~/.ssh
client$ chmod 700 ~/.ssh 
client$ ssh-keygen -q -f ~/.ssh/id_rsa -t rsa 
Enter passphrase (empty for no passphrase): [empty]
client$ chmod go-w ~/ 
client$ chmod 700 ~/.ssh 
client$ chmod go-rwx ~/.ssh/* 
client$ scp ~/.ssh/id_rsa.pub lorddaedra@server.domain.ltd:~ 
server$ mkdir ~/.ssh 
server$ chmod 700 ~/.ssh 
server$ cat ~/id_rsa.pub >> ~/.ssh/authorized_keys 
server$ chmod 600 ~/.ssh/authorized_keys 
server$ rm ~/id_rsa.pub 
client$ ssh -o PreferredAuthentications=publickey server.domain.ltd

and...

Permission denied (publickey,password).

Debug output(with -v):

XX-XX-XXX-XXX:~ lorddaedra$ ssh -o PreferredAuthentications=publickey server.domain.ltd -v
OpenSSH_5.2p1, OpenSSL 0.9.8l 5 Nov 2009
debug1: Reading configuration data /etc/ssh_config
debug1: Connecting to server.domain.ltd [XXX.XX.XX.XX] port 22.
debug1: Connection established.
debug1: identity file /Users/lorddaedra/.ssh/identity type -1
debug1: identity file /Users/lorddaedra/.ssh/id_rsa type 1
debug1: identity file /Users/lorddaedra/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.5p1 Debian-4ubuntu5
debug1: match: OpenSSH_5.5p1 Debian-4ubuntu5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'server.domain.ltd' is known and matches the RSA host key.
debug1: Found key in /Users/lorddaedra/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/lorddaedra/.ssh/identity
debug1: Offering public key: /Users/lorddaedra/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/lorddaedra/.ssh/id_dsa
debug1: No more authentication methods to try.
Permission denied (publickey,password).

So my question is where is my error and how to fix it? Thank you!

P.S.

server$ cat /etc/ssh/sshd_config
# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
UseDNS no
AllowUsers lorddaedra

P.P.S.

server$ cat /var/log/auth.log

Feb  3 19:15:38 electra sudo: lorddaedra : TTY=pts/0 ; PWD=/home/lorddaedra ; USER=root ; COMMAND=/bin/cat /var/log/auth.log
Feb  3 19:16:01 electra CRON[19081]: pam_unix(cron:session): session opened for user lorddaedra by (uid=0)
Feb  3 19:16:01 electra CRON[19080]: pam_unix(cron:session): session opened for user lorddaedra by (uid=0)
Feb  3 19:16:02 electra CRON[19080]: pam_unix(cron:session): session closed for user lorddaedra
Feb  3 19:16:02 electra sshd[19088]: Authentication refused: bad ownership or modes for directory /home/lorddaedra
Feb  3 19:16:02 electra sshd[19088]: Authentication refused: bad ownership or modes for directory /home/lorddaedra
Feb  3 19:16:06 electra CRON[19081]: pam_unix(cron:session): session closed for user lorddaedra
Feb  3 19:16:07 electra sudo: lorddaedra : TTY=pts/0 ; PWD=/home/lorddaedra ; USER=root ; COMMAND=/bin/cat /var/log/auth.log


client$ ls -al /Users/lorddaedra/.ssh
total 40
drwx------    6 lorddaedra  staff   204  3 фев 01:54 .
drwxr-xr-x+ 183 lorddaedra  staff  6222 31 янв 11:37 ..
-rw-------@   1 lorddaedra  staff  6148 21 ноя  2008 .DS_Store
-rw-------    1 lorddaedra  staff  1675  3 фев 01:53 id_rsa
-rw-------    1 lorddaedra  staff   427  3 фев 01:53 id_rsa.pub
-rw-r--r--    1 lorddaedra  staff   414  3 фев 01:54 known_hosts


server$ ls -al /home/lorddaedra/.ssh
итого 12
drwx------  2 lorddaedra lorddaedra 4096 2011-02-03 01:55 .
drwxrwxr-x 13 lorddaedra lorddaedra 4096 2011-02-03 01:55 ..
-rw-------  1 lorddaedra lorddaedra  427 2011-02-03 01:55 authorized_keys

check server's /var/log/auth.log . Also, shouldn't you `ssh` to `lorddaedra@server.domain.ltd` instead of just `server.domain.ltd` ? Also, who is the owner of `~/.ssh` and contained files? — Piskvor left the building, Feb 03 '11 at 15:08
Piskvor is right. If you leave `lorddaedra@` out, ssh will try to use your local username as the login name, which probably isn't lorddaedra. — thevilledev, Feb 03 '11 at 15:17
Please look at P.P.S. section.. Eugene, is it possible to move this question to serverfault? Or should I do it manually? [Sorry, n00b here].. "bad ownership or modes for directory /home/lorddaedra", hmm... 775 is bad? But what is good? :-) — Alexander Ovchinnikov, Feb 03 '11 at 16:48

score 4 · Accepted Answer · answered Feb 03 '11 at 17:26

4

Command

sudo chmod -c g-w /home/lorddaedra

fixed my problem. So need change 775 to 755 on user home directory. If anyone know reason why 775 is bad please comment..

answered Feb 03 '11 at 17:26

Alexander Ovchinnikov

283
2
3
11

Group write permissions are bad, if the users homedir belongs to say, group 'staff' or 'users'. – Alex Holst Feb 04 '11 at 08:29
I do not have enough reputation to comment, so this goes in a separate answer. The reason that you had to change the permissions to 755 is that you have StrictMode set to yes, which means: StrictModes yes The option StrictModes specifies whether ssh should check user's permissions in their home directory and rhosts files before accepting login. This option must always be set to yes because sometimes users may accidentally leave their directory or files world-writable. From http://www.faqs.org/docs/securing/chap15sec122.html – Feb 04 '11 at 07:42
@AlexanderOvchinnikov This was my problem when connecting OS X Yosemite 10.10.1 to my Ubuntu server. The permissions on my server were incorrectly set. This fixed it! Now I can leave `StrictModes` in my `sshd_config` file on. Thank you very much! – Jonathan Komar Jan 16 '15 at 18:51

score 2 · Answer 2 · edited Apr 20 '11 at 11:07

In my case, I found that SELinux is the problem.

$ less /var/log/messages
Apr 20 00:16:12 vb-fc14-0 setroubleshoot: SELinux is preventing /usr/sbin/sshd from read access on the file authorized_keys. For complete SELinux messages. run sealert -l 174e87e8-bec5-4ae6-840c-44994ad5e2b3

$ sealert -l 174e87e8-bec5-4ae6-840c-44994ad5e2b3

SELinux is preventing /usr/sbin/sshd from read access on the file authorized_keys.

Plugin sshd_root (91.4 confidence) suggests:

If you want to allow sshd to have read access on the authorized_keys file Then you must fix the labels. Do: /sbin/restorecon -Rv /root/.ssh

Plugin catchall (9.59 confidence) suggests:

If you believe that sshd should be allowed read access on the authorized_keys file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing:

$ grep sshd /var/log/audit/audit.log | audit2allow -M mypol
$ semodule -i mypol.pp

score 0 · Answer 3 · answered Jun 14 '20 at 22:20

0

I just go to /etc/ssh/sshd_config file and edited PasswordAuthentication value to be yes, in my case it was set to be no

That solved the problem for me.

answered Jun 14 '20 at 22:20

NAND

105
4

score 0 · Answer 4 · edited Jan 19 '17 at 10:04

0

The .ssh directory shouldn't be group writable. The command

chmod g-w $HOME/.ssh

solved my problem.

edited Jan 19 '17 at 10:04

peterh

4,953
13
30
44

answered Jan 19 '17 at 02:28

Changshu Li

1

SSH configuration, publickeys, Permission denied (publickey,password). error

4 Answers4

Linked

Related