Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to connect two servers. I got the id_dsa.pub key from user john from server A and paste into authorized_keys of user mike from server B.

Then I tried to connect from server A to server B using mike login, however it is still asking for password.

In mike's .ssh/ directory I have only authorized_keys file, like this:

bash-3.00$ ls -l
total 16
-rw-------   1 mike users    2422 Oct  8 14:47 authorized_keys
bash-3.00$

The admin guy from server B assured that having only this file it's enough to let us connect at B server.

Am I missing something?

Thanks guys!

EDIT: Here is the Log:

johndbb3:/home/john/.ssh> ssh -vvv mike@fpnld1.uk.db.com
Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: ssh_connect: needpriv 0
debug1: Connecting to fpnld1.uk.db.com [10.240.1.215] port 22.
debug1: Connection established.
debug1: identity file /home/john/.ssh/identity type -1
debug3: Not a RSA1 key file /home/john/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/john/.ssh/id_rsa type 1
debug3: Not a RSA1 key file /home/john/.ssh/id_dsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: no key found
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug3: key_read: no space
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: no key found
debug1: identity file /home/john/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1.3
debug1: no match: Sun_SSH_1.1.3
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-Sun_SSH_1.1
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes128-cbc,arcfour,3des-cbc,blowfish-cbc
debug2: kex_parse_kexinit: aes128-ctr,aes128-cbc,arcfour,3des-cbc,blowfish-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: i-default
debug2: kex_parse_kexinit: i-default
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug1: SSH2_MSG_KEXINIT sent
debug3: kex_reset_dispatch -- should we dispatch_set(KEXINIT) here? 0 && !0
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes128-cbc,arcfour,3des-cbc,blowfish-cbc
debug2: kex_parse_kexinit: aes128-ctr,aes128-cbc,arcfour,3des-cbc,blowfish-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: i-default
debug2: kex_parse_kexinit: i-default
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes128-cbc,arcfour,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
debug2: kex_parse_kexinit: aes128-ctr,aes128-cbc,arcfour,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: ar-EG,ar-SA,bg-BG,ca-ES,cs-CZ,da-DK,de,de-AT,de-CH,de-DE,de-LU,el-CY,el-GR,en-AU,en-CA,en-GB,en-IE,en-MT,en-NZ,en-US,es,es-AR,es-BO,es-CL,es-CO,es-CR,es-EC,es-ES,es-GT,es-MX,es-NI,es-PA,es-PE,es-PY,es-SV,es-UY,es-VE,et-EE,fi-FI,fr,fr-BE,fr-CA,fr-CH,fr-FR,fr-LU,he-IL,hr-HR,hu-HU,is-IS,it,it-IT,kk-KZ,lt-LT,lv-LV,mk-MK,mt-MT,nb-NO,nl-BE,nl-NL,nn-NO,pl,pl-PL,pt-BR,pt-PT,ro-RO,ru,ru-RU,sh-BA,sk-SK,sl-SI,sq-AL,sr-CS,sv,sv-SE,tr-TR,ar,ca,cz,da,el,et,fi,he,hu,lt,lv,nl,no,no-NO,no-NY,nr,pt,sr-SP,sr-YU,tr,i-default,uk-UA
debug2: kex_parse_kexinit: ar-EG,ar-SA,bg-BG,ca-ES,cs-CZ,da-DK,de,de-AT,de-CH,de-DE,de-LU,el-CY,el-GR,en-AU,en-CA,en-GB,en-IE,en-MT,en-NZ,en-US,es,es-AR,es-BO,es-CL,es-CO,es-CR,es-EC,es-ES,es-GT,es-MX,es-NI,es-PA,es-PE,es-PY,es-SV,es-UY,es-VE,et-EE,fi-FI,fr,fr-BE,fr-CA,fr-CH,fr-FR,fr-LU,he-IL,hr-HR,hu-HU,is-IS,it,it-IT,kk-KZ,lt-LT,lv-LV,mk-MK,mt-MT,nb-NO,nl-BE,nl-NL,nn-NO,pl,pl-PL,pt-BR,pt-PT,ro-RO,ru,ru-RU,sh-BA,sk-SK,sl-SI,sq-AL,sr-CS,sv,sv-SE,tr-TR,ar,ca,cz,da,el,et,fi,he,hu,lt,lv,nl,no,no-NO,no-NY,nr,pt,sr-SP,sr-YU,tr,i-default,uk-UA
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: Peer sent proposed langtags, ctos: ar-EG,ar-SA,bg-BG,ca-ES,cs-CZ,da-DK,de,de-AT,de-CH,de-DE,de-LU,el-CY,el-GR,en-AU,en-CA,en-GB,en-IE,en-MT,en-NZ,en-US,es,es-AR,es-BO,es-CL,es-CO,es-CR,es-EC,es-ES,es-GT,es-MX,es-NI,es-PA,es-PE,es-PY,es-SV,es-UY,es-VE,et-EE,fi-FI,fr,fr-BE,fr-CA,fr-CH,fr-FR,fr-LU,he-IL,hr-HR,hu-HU,is-IS,it,it-IT,kk-KZ,lt-LT,lv-LV,mk-MK,mt-MT,nb-NO,nl-BE,nl-NL,nn-NO,pl,pl-PL,pt-BR,pt-PT,ro-RO,ru,ru-RU,sh-BA,sk-SK,sl-SI,sq-AL,sr-CS,sv,sv-SE,tr-TR,ar,ca,cz,da,el,et,fi,he,hu,lt,lv,nl,no,no-NO,no-NY,nr,pt,sr-SP,sr-YU,tr,i-default,uk-UA
debug1: Peer sent proposed langtags, stoc: ar-EG,ar-SA,bg-BG,ca-ES,cs-CZ,da-DK,de,de-AT,de-CH,de-DE,de-LU,el-CY,el-GR,en-AU,en-CA,en-GB,en-IE,en-MT,en-NZ,en-US,es,es-AR,es-BO,es-CL,es-CO,es-CR,es-EC,es-ES,es-GT,es-MX,es-NI,es-PA,es-PE,es-PY,es-SV,es-UY,es-VE,et-EE,fi-FI,fr,fr-BE,fr-CA,fr-CH,fr-FR,fr-LU,he-IL,hr-HR,hu-HU,is-IS,it,it-IT,kk-KZ,lt-LT,lv-LV,mk-MK,mt-MT,nb-NO,nl-BE,nl-NL,nn-NO,pl,pl-PL,pt-BR,pt-PT,ro-RO,ru,ru-RU,sh-BA,sk-SK,sl-SI,sq-AL,sr-CS,sv,sv-SE,tr-TR,ar,ca,cz,da,el,et,fi,he,hu,lt,lv,nl,no,no-NO,no-NY,nr,pt,sr-SP,sr-YU,tr,i-default,uk-UA
debug1: We proposed langtags, ctos: i-default
debug1: We proposed langtags, stoc: i-default
debug1: Negotiated lang: i-default
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: Remote: Negotiated main locale: C
debug1: Remote: Negotiated messages locale: C
debug1: dh_gen_key: priv key bits set: 129/256
debug1: bits set: 1594/3191
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: filename /home/john/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 120
debug3: check_host_in_hostfile: filename /home/john/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 119
debug1: Host 'fpnld1.uk.db.com' is known and matches the RSA host key.
debug1: Found key in /home/john/.ssh/known_hosts:120
debug1: bits set: 1573/3191
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug3: kex_reset_dispatch -- should we dispatch_set(KEXINIT) here? 0 && !0
debug1: newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: done: ssh_kex2.
debug1: send SSH2_MSG_SERVICE_REQUEST
debug2: service_accept: ssh-userauth
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,password,keyboard-interactive
debug3: start over, passed a different list gssapi-keyex,gssapi-with-mic,publickey,password,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-keyex
debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-keyex
debug1: Next authentication method: gssapi-keyex
debug2: we did not send a packet, disable method
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/john/.ssh/identity
debug3: no such identity: /home/john/.ssh/identity
debug1: Trying public key: /home/john/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,password,keyboard-interactive
debug1: Trying public key: /home/john/.ssh/id_dsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,password,keyboard-interactive
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:

johndbb3:/home/john/.ssh>
share|improve this question
1  
Could you do something like "ssh -v mike@serverb" and upload the output somewhere? Without this it is really hard to see what might be wrong here. –  fschmitt Oct 8 '10 at 18:20
    
As noted below, check the server logs to see why the key is rejected. If you don't see anything useful, you can try starting sshd with debug logging enabled. –  Bill B Oct 9 '10 at 16:16
2  
Please ensure that also the .ssh folder has 600 access mode on both client and server side. –  ztank1013 Oct 15 '11 at 8:53
add comment

4 Answers

You may have just copied the key incorrectly. Try this:

  1. On Server B(as mike): rm ~/.ssh/authorized_keys
  2. On Server A(as john): ssh-copy-id -i /path/to/id_dsa.pub mike@serverb

The ssh-copy-id command basically connects to the remote host (using password auth) and then edits authorized_keys appropriately. I believe it is distributed with OpenSSH, if you are using something else, it may not be available.

share|improve this answer
    
I was typing this and then had to go do something and posted it when I returned. In the meantime you updated your post with the log. This answer doesn't take the log into account and may not apply. –  Steven D Oct 8 '10 at 18:49
    
I'm running Solaris, it doesn't have ssh-copy-id command... –  jyzuz Oct 8 '10 at 18:50
    
+1, I didn't know this command existed. –  greyfade Oct 8 '10 at 19:52
    
@jyzuz: So did you check that you had copied the keys correctly? Compare md5sum id_dsa.pub client-side and md5sum authorized_keys server-side (use cksum if you don't have md5sum on both sides). –  Gilles Oct 8 '10 at 21:54
add comment

Do you have access to the SSH logs on ServerB? If not, can the admin send the relevant lines to you?

On ServerB, the permissions for make sure that you have the correct permissions as described in the SSH manpage:

 ~/.ssh/
         This directory is the default location for all user-specific con‐
         figuration and authentication information.  There is no general
         requirement to keep the entire contents of this directory secret,
         but the recommended permissions are read/write/execute for the
         user, and not accessible by others.

 ~/.ssh/authorized_keys
         Lists the public keys (RSA/DSA) that can be used for logging in
         as this user.  The format of this file is described in the
         sshd(8) manual page.  This file is not highly sensitive, but the
         recommended permissions are read/write for the user, and not
         accessible by others.
share|improve this answer
    
I temporarily have access to both servers (until both servers are correctly set-up). What do I have to try? I've already checked the permissions and they are correct... –  jyzuz Oct 8 '10 at 18:59
2  
The unsuccessful SSH attempts should be in the system logs. It should give you an error which explains why it denied the SSH session. The error messages are a little cryptic, but very Googleable. If you post the errors in your question above, we might be able to help you. –  Stefan Lasiewski Oct 8 '10 at 20:55
2  
I suggest two widows. One, doing a 'tail -f' of the SSH logs in real time (/var/adm/auth I think on Solaris systems). In your other window, try to ssh -l mike serverb. Try some variations, like ssh serverb (as yourself), etc. to help troubleshoot. –  Stefan Lasiewski Oct 8 '10 at 20:58
    
Should I use authorized_keys or authorized_keys2? About the logs, I don't have root access to the server, I will check if I'll be able to read this log. Will come back later. Thanks. –  jyzuz Oct 9 '10 at 12:39
    
@jyzuz : By default, either authorized_keys or authorized_keys2 should work. –  Stefan Lasiewski Oct 9 '10 at 20:37
add comment

There are at least two different formats for SSH public keys, which I know as the OpenSSH format and the PuTTY format. Since I see complaints about "-----BEGIN" in your log, I suspect your server expects the OpenSSH-style, but you've given it a PuTTY-style key.

The OpenSSH format puts the entire key plus comment on a single text line, and looks like (for a DSA key):

ssh-dss <ASCII-ENCODED-KEY-MATERIAL> my-comment-for-human-convenience

(Replace "ssh-dss" with "ssh-rsa" for an RSA key.)

The PuTTY style is more verbose but contains the same information. It looks like:

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "my-comment-for-human-convenience"
<ASCII-ENCODED-KEY-MATERIAL, split into...>
<...multiple lines of 64 characters each>
---- END SSH2 PUBLIC KEY ----

You can use PuTTYgen to convert between the two formats (stackoverflow question). Or if you're careful and you know whether your PuTTY-style key is RSA or DSA, you can manually convert one into the other by removing the line breaks in the key material and adding the "ssh-dss" or "ssh-rsa" tag.

share|improve this answer
add comment

On the client, type:

ssh-keygen -t rsa -b 4096

enter ENTER when prompted for a password.

go to ~/.ssh and copy id_rsa.pub to the server. cat id_rsa.pub >> /home/username/.ssh/authorized_keys

Also on the server edit the /etc/ssh/sshd_config file to allow key-based authentication

and run /etc/init.d/sshd restart

then on the client-machine enter: ssh usernameOfTheUserOnTheServerWhereYouCopiedTheKeyToAuthorizedKeys@192.168.1.x

share|improve this answer
    
I have id_rsa.pub and id_dsa.pub. Isn't DSA stronger than RSA? In fact to the other servers we always sent DSA pub key and it always worked. I cannot regenerate the keys (since a lot of other servers connect to us) but I'll try to follow (again) the steps. Thanks. –  jyzuz Oct 9 '10 at 12:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.