Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I'm completely at a loss as to what is preventing my local machine from authenticating the connection that is being forwarded from the remote server.

I've read a ton of the posts on here regarding this and man, I swear I've tried damn near everything.

The guide I've been following can be found here:

Basically where I'm stuck at is in forcing passwordless authentication. If I allow passwords in sshd_config, when I connect to pair@pair-server I am prompted for my local user password and am able to login remotely, so I am being forwarded. But, as soon as I turn it off, I get the following

   λ   ssh pair@pair-server 
Permission denied (publickey).
Connection to pair-server closed.

Verbose output here:

I currently have my local user in pair@pair-server's .ssh/authorized_keys which are command directed to ssh back to localhost. pair@pair-server has it's own key, on my computer I've added pair@pair-server's to .ssh/authorized_keys.

Seemingly relevant lines in sshd_config:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys
PermitEmptyPasswords no
PasswordAuthentication no
UseLogin no

account and session settings in /etc/pam.d/sshd on pair-server:

account    required
account    include      password-auth
# close should be the first session rule
session    required close
session    required
# open should only be followed by sessions to be executed in the user context
session    required open env_params
session    optional force revoke
session    include      password-auth

password-auth configuration:

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required
auth        sufficient nullok try_first_pass
auth        requisite uid >= 500 quiet
auth        required

account     required
account     sufficient
account     sufficient uid < 500 quiet
account     required

password    requisite try_first_pass retry=3 type=
password    sufficient sha512 shadow nullok try_first_pass use_authtok
password    required

session     optional revoke
session     required
session     [success=1 default=ignore] service in crond quiet use_uid
session     required

.ssh permissions:

   λ   ls -lhd .ssh
drwx------ 2 dan dan 4.0K Jul 10 19:49 .ssh


   λ   lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 13.04
Release:    13.04
Codename:   raring

OpenSSH Client Version:

   λ   ssh -V
OpenSSH_6.1p1 Debian-4, OpenSSL 1.0.1c 10 May 2012
share|improve this question
could you post: * the output of '$ ls -lhd .ssh/' ? * OS and version of client and server? thanks! – Mario Jul 12 '13 at 8:08
@Mario sure thing, added the output to my question – Dan Schmidt Jul 12 '13 at 15:37
Are all three permissions (~, ~/.ssh, ~/.ssh/authorized_keys) correct on the server side? What messages appear in /var/log/auth.log on the server? – Gilles Jul 12 '13 at 23:25

2 Answers 2

Are your permissions OK? .ssh must be 700.

share|improve this answer
Yep, added .ssh's permissions to my question. All files inside of .ssh are 600 as well. – Dan Schmidt Jul 12 '13 at 15:39
up vote 0 down vote accepted

Thanks for trying to help everyone, really appreciate it. Anyways, it seems ssh-agent was the culprit. I forgot I have to check if there is previously spawned instances of it already running before spawning my own. I had something like 9 of them running. I don't know much bash, but here where the 3 lines I added to my .bashrc on the remote server that got it working:

pkill ssh-agent
exec "$(ssh-agent)"
ssh-add $HOME/.ssh/pair_key
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.