Unable to connect to SSH server. /.ssh/authorized_keys: Permission denied

Question

I've been trying to setup a Ubuntu server with SSH authentication through RSA keys the last 4-5 hours, but i can't get it to work. Been all over google without any luck.

I'm running an Ubuntu 16.04.3 server with SSH-2.0-OpenSSH_7.2p2. Just reinstalled the server as well.

I've made sure to set the permissions on the ~/.ssh folder to 700 and /.ssh/authorized_keys to 600

The key been made by Puttygen (RSA 2048 bits) and I properly formatted it to ssh-rsa <long random string> comment before adding it to /home/user/.ssh/authorized_keys

This is the error I get when trying to login with the key:

login as: user
Server refused our key

This is the error message I get from the sshd debug log.

Feb 27 23:23:21 CSGO6 sshd[1439]: debug1: Could not open authorized keys '/home/user/.ssh/authorized_keys': Permission denied

Does anyone understand why sshd doesn't have permission to the authorized_keys file?

Here is the sshd_config

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0

Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel DEBUG3

# Authentication:
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for 
RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
user@CSGO6:~$ # Package generated configuration file
user@CSGO6:~$ # See the sshd_config(5) manpage for details
user@CSGO6:~$
user@CSGO6:~$ # What ports, IPs and protocols we listen for
user@CSGO6:~$ Port 22
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel DEBUG3

# Authentication:
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for 
RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

Here is the ls -la of both the .ssh folder and authorized_keys file

user@CSGO6:~$ ls -la /home/user/.ssh/
total 12
drwx------ 2 user user 4096 Feb 27 23:39 .
drwxr-xr-x 5 user user 4096 Feb 27 23:14 ..
-rw------- 1 root root  802 Feb 27 23:39 authorized_keys

Btw, using the same rsa-key to ssh to my raspberry pi is no problem.

@GillesQuenot True. I just saw alot of similar questions had been asked here on stackoverflow, so thats why i thought this might be a good place to ask. — FredS, Feb 27 '18 at 23:56
@zombic I added the ls -la of the .ssh folder and authorized_keys at the bottom of the post. — FredS, Feb 28 '18 at 17:52

score 0 · Answer 1 · answered Feb 28 '18 at 18:47

I finally made it work.

This is what i did: I added the key again, but this time doing it through scp (using the putty program pscp.exe) instead of pasting the key when logged on the server with an SSH session.

Then i changed the key to match the proper syntax that OpenSSH server wants, renamed it to authorized_keys2 and changed the permissions to 600. Tried logging in with putty using my key and voila.

I unfortunately have no idea why this suddenly works now but im happy it does.

Unable to connect to SSH server. /.ssh/authorized_keys: Permission denied

1 Answers1