37

I want to set up ssh tunnel to the mysql server which is in computer which has virtual machine. Also the tunnel has to work if the machine is restarted.

So lets say A is computer with linux software. B - virtual machine in computer A.

MySQL is in B.

C - is a virtual machine in computer A which wants to connect to MySQL in B.

Now by this article: http://www.thegeekstuff.com/2008/11/3-steps-to-perform-ssh-login-without-password-using-ssh-keygen-ssh-copy-id/

I try to copy the public key to remote server. I guess I need to copy it to computer A.

ssh-copy-id -i id_rsa.pub.bak [user]@[IP of A] -p [port of A]
Enter passphrase for key '/home/[user]/.ssh/id_rsa':
Permission denied (publickey).

Now I tried entering passphrase of the file id_rsa.pub.bak. It denied.

Then I see that it uses key in /home/[user]/.ssh/id_rsa which is different from the public key I am trying to copy, I mean of course private key is different, but I mean I copy public key of another private key. So I tried using passphrase of it. Also denied.

How could I debug why is passphrase denied?

Update

Based on comments I created new public file called id_rsa.pub where everything is in one line now

and run and still get error.

ssh-copy-id -i id_rsa.pub [host and port] -vvv
Enter passphrase for key '/home/[user]/.ssh/id_rsa':
Permission denied (publickey).

Update

Checked the permissions on .ssh folder and authorized_keys file in the A computer - they are 700 and 600 so as the comment say they are good.

Update

Tried setting password authentication yes on A computer and to restart the service. Restarting as by the answer did not work, it wrote sshd not recognized, so I restarted using:

sudo /etc/init.d/ssh restart

Then tried again on C machine to copy to A machine.

ssh-copy-id -i id_rsa.pub [user@host] -p [port] -v

and still the same:

Enter passphrase for key '/home/[user]/.ssh/id_rsa':
Permission denied (publickey).

If I go to copy the key manually to authorized_keys, I see that the public key is already existing, the same which I want to copy. I asked my coworker, he said he did not copy it. So I do not even understand how it can be there.

Ok, if it is there it would be good, but by staying there it does not let me connect with ssh without entering a passphrase. But I was able to connect by entering a passphrase. So something is clearly still wrong here. And the key which I am trying to copy is with an empty passphrase. When I connected with ssh - I entered a passphrase which was not empty.

The same public key cannot accept empty passphrase and and non empty passphrase, that makes sense. But then why public key which I am trying to upload is the same with the one in authorized_keys file if passphrases are different? I did not check every single character, but its unlikely that keys would be so similar that beginning and ending would be the same even when passphrase different I think.

Andrew T.
  • 3
  • 3
Darius.V
  • 539
  • 1
  • 4
  • 9
  • Which files starting with `id_rsa` do you have? I would expect `ssh-copy-id` to fail with an error message the way you call it, as it expects a file ending with `.pub`. As yours ends with `.bak` it would probably use `id_rsa.pub.bak.pub`. – nlu Apr 21 '15 at 13:43
  • @nlu - I have id_rsa which I copied by dragging and dropping the file using notepad ftp explorer. Also have id_rsa.bak which I created with nano and pasted contents with mouse from notepad++ but it looked that it made same text but somehow 2 columns. And also I have id_rsa.pub.bak which also made with nano. Actually it has 3 lines, but original has all in one line. Do not know does it matter. But as we see I did not get error message about filenames. – Darius.V Apr 21 '15 at 13:46
  • 1
    It does. See here for example: http://www.snailbook.com/faq/publickey-userauth.auto.html ("If you use a text editor, take care that it doesn't break the lines in this file. "). – nlu Apr 21 '15 at 13:50
  • Question is closed because they think that its not system in business environment, but I was solving business environment problem. – Darius.V Jul 01 '15 at 09:23

3 Answers3

35

You actually need to login to copy your key, you don't have any access to the remote machine (invalid key and password authentication disabled):

Re-enable passwd authentication in /etc/ssh/sshd_config:

PasswordAuthentication yes

Then restart the service:

service sshd restart

Copy your public key:

ssh-copy-id -i ~/.ssh/id_rsa.pub USER@HOST -p PORT
[Enter user password]

Try to login again, no password should be required.

Then disable password authentication.

Nabil Bourenane
  • 775
  • 4
  • 11
  • What if I set PasswordAuth to yes in the server which I want to login, and I can connect with putty using password, but ssh-copy-id still does not ask password and just writes Permission denied (publickey). ? – Darius.V Jul 01 '15 at 09:37
  • hey i want to say thank you!!! you saved my day!!! thanks so much!!! – 尤川豪 Dec 19 '17 at 07:53
  • Thanks to @Nabil, this works as of Ubuntu 18.04 as well. Just a caution to future readers: Edit /etc/ssh/sshd_config as per instructions and NOT ssh_config, by oversight (like I did!). Also, ssh-copy-id USER@HOST is evidently sufficient. – Snidhi Sofpro Oct 30 '19 at 13:48
14

Permission denied (publickey) is the remote SSH server saying "I only accept public keys as an authentication method, go away".

That's your main challenge: Getting onto the remote system. Once you can do that, you can upload your key:

  • Using ssh-copy-id - it will allow you to specify a different key if you're in the process of replacing your old one, for example.
  • Edit the remote user's ~/.ssh/authorized_keys to append your key manually.
Oli
  • 1,799
  • 19
  • 27
6

Found the problem finally.

Actually I did not need to copy the public key. Same public key is for both private keys - with passphrase and without passphrase. I thought I have private key without passphrase, but actually I did not. I had only .ppk without passphrase. That was miss communication. So coworker made private key without passphrase and so now I could login using ssh without passphrase. I read that having without passphrase is bad, but coworker says its ok. I needed without passphrase because I need to run shell script on reboot - I want to start autossh on computer reboot.

So kind of solution is this time - if you want to login without passphrase - check if your private key is without passphrase really.

Darius.V
  • 539
  • 1
  • 4
  • 9