0

I need to automate a script that logs into a server. I made an RSA key and upload it to the server's authorized_keys file:

desktop$ ssh-keygen -f ~/.ssh/id_rsa_marge -P '' -t rsa
desktop$ chmod 600 ~/.ssh/id_*
desktop$ scp ~/.ssh/id_rsa_marge.pub me@2.4.6.8:~/
password:
desktop$ ssh me@2.4.6.8
password:

marge$ cat ~/id_rsa_marge.pub >> ~/.ssh/authorized_keys
marge$ whoami
me
marge$ ls -la | grep ssh
drw-------   2 me me     4096 May 29 16:02 .ssh
marge$ ls -la .ssh
total 16
drwx------  2 me me 4096 May 29 16:02 .
drwx--x--x. 9 me me 4096 Aug 11 05:32 ..
-rw-------  1 me me  398 Aug 11 04:14 authorized_keys
-rw-r--r--  1 me me  414 May 29 16:02 known_hosts
marge$ cat .ssh/authorized_keys 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzUvV0SMF+H7kwmEkJzXY1RqionS6DTtJiON3+9L6neKMaFb/FXc3UtK7oN/lsxNcHwv9s9GG4xp2UiUNk8NeT+/aFCjl7sMpDsW1+bn7sjhRFFw095qxvK52somSUKXlm9DP1pr0wj9r9Kxdph3HynxRsMkdPnWK2LVGhHzr3nh39mJ/3Fwaejl+sYnO8wgPfZbqZTA1xubhIQilv0XI8YAWUOM+Mn2QmyI12geTVKdD393wL0cDrkit/MXjMY6pimSFafrFJkaWV1BI4YOnkPRPo8oyoM4ywXhcCeb14JkOmKdSacUwSDsnCy/IDP51rcwItZrXxBiOHFZJW1Nlp dotancohen@desktop
marge$ exit

desktop$ cat .ssh/id_rsa_marge.pub 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzUvV0SMF+H7kwmEkJzXY1RqionS6DTtJiON3+9L6neKMaFb/FXc3UtK7oN/lsxNcHwv9s9GG4xp2UiUNk8NeT+/aFCjl7sMpDsW1+bn7sjhRFFw095qxvK52somSUKXlm9DP1pr0wj9r9Kxdph3HynxRsMkdPnWK2LVGhHzr3nh39mJ/3Fwaejl+sYnO8wgPfZbqZTA1xubhIQilv0XI8YAWUOM+Mn2QmyI12geTVKdD393wL0cDrkit/MXjMY6pimSFafrFJkaWV1BI4YOnkPRPo8oyoM4ywXhcCeb14JkOmKdSacUwSDsnCy/IDP51rcwItZrXxBiOHFZJW1Nlp dotancohen@desktop
desktop$ ls -la | grep .ssh
-rw-------  1 dotancohen dotancohen     689 Aug 12 11:03 .lesshst
drwx------  3 dotancohen dotancohen    4096 Aug 12 11:05 .ssh
desktop$ ls -la .ssh | grep canary
-rw-------  1 dotancohen dotancohen  1675 Aug 11 12:13 id_rsa_marge
-rw-------  1 dotancohen dotancohen   398 Aug 11 12:13 id_rsa_marge.pub
desktop$ grep -A 5 marge .ssh/config
Host marge
    User me
    HostName 2.4.6.8
    IdentityFile ~/.ssh/id_rsa_marge.pub
    IdentitiesOnly yes

However, when I try to log into the server it asks for a passphrase:

desktop$ ssh -v marge
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /home/desktop/.ssh/config
debug1: Applying options for marge
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 2.4.6.8 [2.4.6.8] port 22.
debug1: Connection established.
debug1: identity file /home/desktop/.ssh/id_rsa_marge.pub type 1
debug1: identity file /home/desktop/.ssh/id_rsa_marge.pub-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1.3
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '2.4.6.8' is known and matches the RSA host key.
debug1: Found key in /home/desktop/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/desktop/.ssh/id_rsa_marge.pub
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug1: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Enter passphrase for key '/home/desktop/.ssh/id_rsa_marge.pub': 
debug1: No more authentication methods to try.
Permission denied (publickey).

As can be seen, there is no passphrase for this key. Furthermore, from a different desktop I can use this key without entering a passphrase! Why does this one server demand that I enter a passphrase, when there is none?

  • 3
    Client IdentityFile should be the private key file (without .pub). – dave_thompson_085 Aug 12 '14 at 10:24
  • @dave_thompson_085: That was it! Please write that as an answer so that I could accept it. Thanks! – dotancohen Aug 12 '14 at 10:49
1
Enter passphrase for key '/home/desktop/.ssh/id_rsa_marge.pub': 

A passphrase for a public key file (.pub)?

IdentityFile ~/.ssh/id_rsa_marge.pub

The identity file is a file on the client that lets you prove to the server that you're allowed to log in. That's a file containing a secret value. It's the private key file, not the public key file.

Change this line to

IdentityFile ~/.ssh/id_rsa_marge

Make sure that what you've added to ~/.ssh/authorized_keys on the server (preferably by passing it to ssh-copy-id) is the public key file (.pub).

0

you are not using the default key position for your file. The ssh client does not know where to load your private key from (it only looks for .ssh/id_dsa and .ssh/id_rsa), so it is not using the generated key at all. Maybe you have another key valid for the same host, but with a passphrase?

Try running ssh -i .ssh/id_rsa_marge -v me@2.4.6.8.

  • Read the comment of dave_thomson_085. The -i parameter expects the private key and not the .pub – Valentin Bajrami Aug 12 '14 at 10:45
  • @val0x00ff yes, sorry I wrote it wrong. Correcting – pqnet Aug 12 '14 at 11:00
  • I didn't read that you configured the identity file inside .ssh/config because code block was too big and I didn't realize I had to scroll it. – pqnet Aug 12 '14 at 11:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.