2

I have a server with Ubuntu 14.04 x64 operation system.

Part of my sshd_config file (entire file):

Port 2202
Protocol 2
PermitRootLogin without-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      /etc/ssh/keys/%u/authorized_keys
RhostsRSAAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
#PasswordAuthentication yes
UsePAM yes

In folder /etc/ssh/keys each system user has its own folder with authorized_keys file:

ls -l /etc/ssh/keys
drw------- 2 test.com  test.com   4096 Nov 20 06:53 test.com
drw------- 2 root      root       4096 Nov 20 02:29 root

The permissions of these authorized_keys files are correct:

ls -l /etc/ssh/keys/*
/etc/ssh/keys/test.com:
total 4
-r-------- 1 test.com test.com 960 Nov 20 07:17 authorized_keys

/etc/ssh/keys/root:
total 4
-r-------- 1 root root 395 Nov 20 02:29 authorized_keys

I have the same public id_rsa in root's and test.com's authorized_keys file.
I can login with root through ssh, but with test.com I am prompted for password.

Here is the debug info when trying to connect with test.com user:

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/Ivan/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/Ivan/.ssh/id_dsa
debug1: Next authentication method: password

When I try to login with root I succeed:

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/Ivan/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Authentication succeeded (publickey).

I have Googled a lot of things. Couldn't find anything that solves my problem.

I have a script which creates system users using useradd command and these users are without passwords by default. I've found that system users without password may not login through ssh so I added password to test.com user. Didn't work.

I saw that UsePAM yes may be a problem. I set it to UsePAM no. Didn't work.

And yes, I did service ssh restart after each change to the sshd_config file.

I think I've tried everything and now I am clueless.

Any help will be appreciated!

  • You probably want to use PAM. Most everyone does. I am a little bit curious about sshd_config where you have your authorized keys. The default is AuthorizedKeysFile .ssh/authorized_keys. Have you made any changes to ssh_config (not sshd_config)? – SailorCire Nov 20 '14 at 15:09
  • No. I have changed only sshd_keys. There I changed the location of the keys at AuthorizedKeysFile directive – Ivan Dokov Nov 20 '14 at 15:12
  • What kind of access does Ivan have to /Users/Ivan/.ssh/id_rsa? Could it be that root can read that file but not Ivan? – YoMismo Nov 20 '14 at 15:19
  • Try more debugging msgs. ssh -vvv .... – slm Nov 20 '14 at 15:31
  • 1
    Check the server logs (I think the right log file is /var/log/auth.log, but check any log file that gets modified by the login attempt). Edit your question and copy-paste the entries that are generated by the login attempt. – Gilles Nov 20 '14 at 23:36
0

I had the same issue, and found that SELinux was preventing read access to /usr/bin/sshd when trying to remote in for some users. Typically for users that don't have a home folder under /home/. You can run

cat /var/log/messages | grep -i ssh

on the target server, and you should see a similar line indicating the error:

<Date/Time> <hostname> python: SELinux is preventing /usr/sbin/sshd from read access on the file authorized_keys.#012#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012
If you believe that sshd should be allowed read access on the authorized_keys file by default.#012Then you should report this as a bug.#012
You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# 
ausearch -c 'sshd' --raw | audit2allow -M my-sshd#012# semodule -i my-sshd.pp#012`

You can edit the SELinux permissions to allow ssh connections or simply turn it off (less secure) to get around this.

  • System in question is Ubuntu, which by default doesn't use SELinux. – sebasth Aug 21 '17 at 16:00
  • I had been happy to reformat your post, but I couldn't decide in the middle, where is a new line starting... if you want to show a fixed font, prefix the line with four spaces. Could you please make it good? – peterh Aug 21 '17 at 16:04
  • That is because the error in the log is a single line. Not multiple lines. – Max Aug 21 '17 at 16:21
0

sshd is very picky when it comes to permissions!

It seems that the directory permissions of /etc/ssh/keys/test.com/ are wrong! Currently the directory is read/write but may not be entered. chmod u+x /etc/ssh/keys/test.com/ && chmod o+rx /etc/ssh/keys should solve your issue. While root may enter the directory, I assume that sshd checks the octal permissions to be 0700 or 0755 + 0600 for the authorized_keys file itself. Especially, when StrictMode yes.

Without access permission to the directory, and proper permissions the authorized_keys file cannot be read or is being ignored by sshd out of security concerns.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.