Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm completely at a loss as to what is preventing my local machine from authenticating the connection that is being forwarded from the remote server.

I've read a ton of the posts on here regarding this and man, I swear I've tried damn near everything.

The guide I've been following can be found here: http://www.zeespencer.com/articles/building-a-remote-pairing-setup/

Basically where I'm stuck at is in forcing passwordless authentication. If I allow passwords in sshd_config, when I connect to pair@pair-server I am prompted for my local user password and am able to login remotely, so I am being forwarded. But, as soon as I turn it off, I get the following

   λ   ssh pair@pair-server 
Permission denied (publickey).
Connection to pair-server closed.

Verbose output here: https://gist.github.com/anonymous/0c2b3892596d5ded6abb

I currently have my local user key.pub in pair@pair-server's .ssh/authorized_keys which are command directed to ssh back to localhost. pair@pair-server has it's own key, on my computer I've added pair@pair-server's key.pub to .ssh/authorized_keys.

Seemingly relevant lines in sshd_config:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys
PermitEmptyPasswords no
PasswordAuthentication no
UseLogin no

account and session settings in /etc/pam.d/sshd on pair-server:

account    required     pam_nologin.so
account    include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

password-auth configuration:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

.ssh permissions:

node-v0.8.25|ruby-1.9.3-p392|~|
   λ   ls -lhd .ssh
drwx------ 2 dan dan 4.0K Jul 10 19:49 .ssh

OS:

   λ   lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 13.04
Release:    13.04
Codename:   raring

OpenSSH Client Version:

   λ   ssh -V
OpenSSH_6.1p1 Debian-4, OpenSSL 1.0.1c 10 May 2012
share|improve this question
    
could you post: * the output of '$ ls -lhd .ssh/' ? * OS and version of client and server? thanks! –  Mario Jul 12 '13 at 8:08
    
@Mario sure thing, added the output to my question –  Dan Schmidt Jul 12 '13 at 15:37
    
Are all three permissions (~, ~/.ssh, ~/.ssh/authorized_keys) correct on the server side? What messages appear in /var/log/auth.log on the server? –  Gilles Jul 12 '13 at 23:25
add comment

2 Answers

Are your permissions OK? .ssh must be 700.

share|improve this answer
    
Yep, added .ssh's permissions to my question. All files inside of .ssh are 600 as well. –  Dan Schmidt Jul 12 '13 at 15:39
add comment
up vote 0 down vote accepted

Thanks for trying to help everyone, really appreciate it. Anyways, it seems ssh-agent was the culprit. I forgot I have to check if there is previously spawned instances of it already running before spawning my own. I had something like 9 of them running. I don't know much bash, but here where the 3 lines I added to my .bashrc on the remote server that got it working:

pkill ssh-agent
exec "$(ssh-agent)"
ssh-add $HOME/.ssh/pair_key
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.