Cannot SSH after resetting firewall on VPS

Question

I'm having trouble trying to SSH to my Debian 5 VPS with blacknight.

It was working fine until I did the following: Logged into 'Parallels Infrastructure Manager' -> Container -> Firewall -> Set to 'Normal Firewall settings'. It told me there was an error with the IPTables and offered the option again with a checkbox to 'reset' firewall settings, I selected this.

I can see that that the default rules are been applied ( anything from anyone on any port and allowing anything to happen).

Whenever I attempt to SSH I get the following debug info:

thomas@localmachine:~/.ssh$ ssh -v thomas@hostname
OpenSSH_5.8p1 Debian-7ubuntu1, OpenSSL 1.0.0e 6 Sep 2011
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to hostname [***********] port 22.
debug1: Connection established.
debug1: identity file /home/thomas/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-4096
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-4096
debug1: identity file /home/thomas/.ssh/id_rsa-cert type -1
debug1: identity file /home/thomas/.ssh/id_dsa type -1
debug1: identity file /home/thomas/.ssh/id_dsa-cert type -1
debug1: identity file /home/thomas/.ssh/id_ecdsa type -1
debug1: identity file /home/thomas/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-5
debug1: match: OpenSSH_5.1p1 Debian-5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA *************************************
debug1: Host 'hostname' is known and matches the RSA host key.
debug1: Found key in /home/thomas/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/thomas/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/thomas/.ssh/id_dsa
debug1: Trying private key: /home/thomas/.ssh/id_ecdsa
debug1: No more authentication methods to try.
Permission denied (publickey).

I had my public/private RSA keys set up and working fine before I reset the firewall settings. I had also made the following changes to my /etc/ssh/sshd_config file on the VPS:

PermitRootLogin no
PasswordAuthentication no
X11Forwarding no
UsePAM no
UseDNS no
AllowUsers thomas

Could it be something to do with the SSH server & client having different versions between my local machine and VPS?

Any help appreciated.

Output with ssh -vvv

thomas@localcomputer:~/.ssh$ ssh -vvv thomas@****************
OpenSSH_5.8p1 Debian-7ubuntu1, OpenSSL 1.0.0e 6 Sep 2011
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ************ [*************] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/thomas/.ssh/id_rsa" as a RSA1 public key
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug3: key_read: missing keytype
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/thomas/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-4096
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-4096
debug1: identity file /home/thomas/.ssh/id_rsa-cert type -1
debug1: identity file /home/thomas/.ssh/id_dsa type -1
debug1: identity file /home/thomas/.ssh/id_dsa-cert type -1
debug1: identity file /home/thomas/.ssh/id_ecdsa type -1
debug1: identity file /home/thomas/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-5
debug1: match: OpenSSH_5.1p1 Debian-5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "*****************" from file "/home/thomas/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /home/thomas/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 127/256
debug2: bits set: 498/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA ***********************************************************
debug3: load_hostkeys: loading entries for host "*********************" from file "/home/thomas/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /home/thomas/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug1: Host '****************' is known and matches the RSA host key.
debug1: Found key in /home/thomas/.ssh/known_hosts:1
debug2: bits set: 516/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/thomas/.ssh/id_rsa (0x7fa7028b6010)
debug2: key: /home/thomas/.ssh/id_dsa ((nil))
debug2: key: /home/thomas/.ssh/id_ecdsa ((nil))
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/thomas/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/thomas/.ssh/id_dsa
debug3: no such identity: /home/thomas/.ssh/id_dsa
debug1: Trying private key: /home/thomas/.ssh/id_ecdsa
debug3: no such identity: /home/thomas/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

sshd_config

# Package generated configuration file
# See the sshd(8) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
C    hallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM no
UseDNS no

AllowUsers thomas

Thanks

issues might be in the ssh key.So, clear the ssh key found in the home dir and check it — Mughil, Dec 31 '11 at 18:16
add an additional two "v's" to your ssh to get firehose level debug output: ssh -vvv me@foo — sapeurfaire, Dec 31 '11 at 18:58
Clear the ssh key from my authorizied_keys on the server? Or remove the public/private key from my local machine? — Thomas Buckley, Dec 31 '11 at 18:59
Cheers sapp3r...see original question for new debug output with -vvv — Thomas Buckley, Dec 31 '11 at 19:04
The following link shows something similar: bugs.archlinux.org/task/22897 made a system update on my local ubuntu machine before the issues occured, therefore it may have upgraded to SSH 5.8. How can I check last time it upgraded and how can I revert to an older version? — Thomas Buckley, Dec 31 '11 at 20:57

score 1 · Answer 1 · answered Jun 21 '12 at 20:34

Looking at your debug output, it looks like you are using a PuTTY key generator for your public/private key pair. PuTTYkeygen.exe doesn’t generate keys the same way openSSH reads them and it is not compatible with authorized_keys.

Because it starts with debug2: key_type_from_name: unknown key type '-----BEGIN' and ends with debug2: key_type_from_name: unknown key type '-----END' the server is not able to read the key and authentication fails. I don’t know if this is the original problem or if you introduced it while trying to fix things, but it will need to be fixed before you continue.
You can see the file format in http://www.unix.com/man-page/All/5/authorized_keys/

The short answer is:
*No line breaks
*Starts with the protocol (ssh-rsa, ssh-dsa)
*Public key
*Ends with “=” and the key name

sapeurfaire · Answer 2 · 2011-12-31T19:50:10.067

0

UPDATED:

debug3: Could not load "/home/thomas/.ssh/id_rsa" as a RSA1 public key

Points to an issue with the key on the client side. The other error text seems to indicate a formatting issue.

I'd try to see if the key files have changed recently (by comparing to backups) or regenerating the keys.

Dumber original answer :)

So here's what my debug log looks like when a public key logon succeeds:

debug2: we sent a publickey packet, wait for reply

debug3: Wrote 528 bytes for a total of 1637

debug1: Server accepts key: pkalg ssh-dss blen 434

debug2: input_userauth_pk_ok: SHA1 (redacted)

debug3: sign_and_send_pubkey

debug3: Wrote 576 bytes for a total of 2213

debug1: Authentication succeeded (publickey).

If you compare this to your log, it looks like your key is invalid or being rejected.

The most common reason for this in my experience is problems with permission on the either the home or .ssh directories, or on your authorized_keys file (on the server side). None of them should be group -- let alone world -- writable.

Checking the logs on the server should also reveal useable debug data.

cheers!

edited Dec 31 '11 at 19:50

answered Dec 31 '11 at 19:31

sapeurfaire

475
2
6

I'm an idiot, and should also have looked at the start of your more verbose log more closely. It's got issues with the public key file itself. You might try regenerating that. – sapeurfaire Dec 31 '11 at 19:33
In fact, it looks like it's trying to load your private key *as* the public key. I'd normally expect it to use id_rsa.pub as the public portion of the key. – sapeurfaire Dec 31 '11 at 19:35
No, the message it outputs is normal. It says "Offering public key" followed by the path to the private key. I just checked it. – James O'Gorman Dec 31 '11 at 19:37
James, you're right, mine does the same. However, Thomas' output does seem to indicate an issue with his key, regardless: "debug3: Could not load "/home/thomas/.ssh/id_rsa" as a RSA1 public key" – sapeurfaire Dec 31 '11 at 19:41
Agreed, there is an issue with the private key. – James O'Gorman Dec 31 '11 at 19:44
I regenerated private/public keys via ssh-keygen -t rsa -b 4096, and copied public key into authorizied_keys uploaded to thomas/.ssh. No luck still. Permissions are all correct from /home all way up to authorized_keys file. – Thomas Buckley Dec 31 '11 at 20:02
As I suggested earlier, could it be related to different version of openSSH on my local machine(5.8) compared to server(5.1)? – Thomas Buckley Dec 31 '11 at 20:08
No, different server/client pairs can talk to each other just fine, as the underlying protocol (SSH2) is the same. – James O'Gorman Dec 31 '11 at 20:19
Ok. See my original answer for my sshd_config file. Maybe you will spot something in here that is throwing things. – Thomas Buckley Dec 31 '11 at 20:31
If you suspect one of the changes to sshd_config, it'd be best to roll them back and re-add them one at a time until something breaks ... – sapeurfaire Jan 01 '12 at 00:45

Cannot SSH after resetting firewall on VPS

Output with ssh -vvv

sshd_config

2 Answers2