12

I generated a key and copied it to my target:

ssh-keygen
ssh-copy-id username@hostname

I left the the location of the key as default and did not set any passphrase.

For a small while after that, I was able to ssh username@hostname without being prompted for a password, and then it stopped working for some reason.

Improve this question
1

4 Answers 4

Reset to default
9

If public key authentication doesn't work: make sure that on the server side, your home directory (~), the ~/.ssh directory, and the ~/.ssh/authorized_keys file, are all writable only by their owner. In particular, none of them must be writable by the group (even if the user is alone in the group). chmod 755 or chmod 700 is ok, chmod 770 is not.

What to check when something is wrong:

  • Run ssh -vvv to see a lot of debugging output. If you post a question asking why you can't connect with ssh, include this output (you may want to anonymize host and user names).
  • If you can, check the server logs, typically in /var/log/daemon.log or /var/log/auth.log or similar.
  • If public key authentication isn't working, check the permissions again, especially the group bit (see above).
Improve this answer
2
  • 1
    Hi, why should authorized_keys not be writable by the group ? Does SSH reject this because of security concerns ?
    – Hey
    Commented Apr 15, 2016 at 16:10
  • 1
    @YdobEmos Anyone who can write to authorized_keys can add their own key there and thus log into the account. So only the user must be allowed. (Having the file group-writable is actually safe if no other user is in that group, but that's difficult to detect reliably when group memberships can come from network databases.)
    – Gilles 'SO- stop being evil'
    Commented Apr 15, 2016 at 16:30
1

The home directory of the target was 755 drwxr-xr-x. Changing it to be group-writable 775 drwxrwxr-x broke the password-less setup.

Improve this answer
3
  • Same problem did not solved it yet.
    – user11085
    Commented Jun 8, 2015 at 9:58
  • You mean you can't get password-less login work, even after making the directory group-writable?
    – tshepang
    Commented Jun 8, 2015 at 19:39
  • YES - please see unix.stackexchange.com/q/208152/11085 , CentOS 7 64-bit where i am trying to login with my id_rsa keys but its always failing.
    – user11085
    Commented Jun 9, 2015 at 3:10
0

After making sure permissions were correct, resent keys, it was still not working.

Then I stumbled on this which I had not done previously and had not seen anyone mention.

Unable to use -o allow_other with sshfs (option enabled in fuse.conf)

After enabling I ran my sshfs commands without sudo and it all worked perfectly.

Improve this answer
0

Assuming RHEL/CentOS, and assuming you have admin access to the remote server where user newuser wants to ssh to.

Obtain newuser's existing id_rsa.pub and have ready.

Follow the steps:

useradd newuser
mkdir /home/newuser/.ssh
vi /home/newuser/.ssh/authorized_keys
# copy newuser's id_rsa.pub into authorized_keys and save
chmod 640 /home/newuser/.ssh/authorized_keys
chmod 700 /home/newuser/.ssh/
chmod 700 /home/newuser/
chown newuser:newuser -R /home/newuser/

Have newuser attempt to log in.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .