8

I set up automatically ssh login without typing password to a server by:

cd ~/.ssh

ssh-keygen

ssh-copy-id -i ~/.ssh/id_rsa.pub tim@server1

It works on the server.

Later I did the same on a different server.

ssh-copy-id -i ~/.ssh/id_rsa.pub tim@server2

Immediately I ssh tim@server2, but it still requires my password. Did I do something incorrectly? What are some possible reasons that I didn't set up successfully on the second server? (note that the second server runs kerberos and Andrew file system)

$ ssh -v tim@server2
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to server2 [...] port 22.
debug1: Connection established.
debug1: identity file /home/tim/.ssh/id_rsa type 1
debug1: identity file /home/tim/.ssh/id_rsa-cert type -1
debug1: identity file /home/tim/.ssh/id_dsa type -1
debug1: identity file /home/tim/.ssh/id_dsa-cert type -1
debug1: identity file /home/tim/.ssh/id_ecdsa type -1
debug1: identity file /home/tim/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/tim/.ssh/id_ed25519 type -1
debug1: identity file /home/tim/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA xxx
debug1: Host 'server2' is known and matches the RSA host key.
debug1: Found key in /home/tim/.ssh/known_hosts:70
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/tim/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Trying private key: /home/tim/.ssh/id_dsa
debug1: Trying private key: /home/tim/.ssh/id_ecdsa
debug1: Trying private key: /home/tim/.ssh/id_ed25519
debug1: Next authentication method: keyboard-interactive
Password:

I tried Anthon's method of using Diffie-Hellman keys, but it still asks me for my password.

$ cd ~/.ssh
$ ssh-keygen -t dsa
$ ssh-copy-id -i ~/.ssh/id_dsa.pub tim@server2
$ ssh -v tim@server2
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to server2 [...] port 22.
debug1: Connection established.
debug1: identity file /home/tim/.ssh/id_rsa type 1
debug1: identity file /home/tim/.ssh/id_rsa-cert type -1
debug1: identity file /home/tim/.ssh/id_dsa type 2
debug1: identity file /home/tim/.ssh/id_dsa-cert type -1
debug1: identity file /home/tim/.ssh/id_ecdsa type -1
debug1: identity file /home/tim/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/tim/.ssh/id_ed25519 type -1
debug1: identity file /home/tim/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA ...
debug1: Host 'server2' is known and matches the RSA host key.
debug1: Found key in /home/tim/.ssh/known_hosts:70
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Next authentication method: publickey
debug1: Offering DSA public key: /home/tim/.ssh/id_dsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Offering RSA public key: /home/tim/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Trying private key: /home/tim/.ssh/id_ecdsa
debug1: Trying private key: /home/tim/.ssh/id_ed25519
debug1: Next authentication method: keyboard-interactive
Password:
  • Is your home directory mounted after you login? – muru Jun 30 '15 at 12:48
  • After each login in the past, my home was always mounted. – Tim Jun 30 '15 at 12:50
  • Yes, once you login, you get your home directory - but what about before the login is complete? (Consider encrypted home directories, or a network home directory, etc.) – muru Jun 30 '15 at 12:51
  • I heard server2 uses Andrew file system. Does that mean my home is not mounted before login is complete? How can I find it out for your question? – Tim Jun 30 '15 at 12:54
  • I'm not sure how the Andrew filesystem works, but if you have another login at the same server, use it and see if you can see the contents of tim's home directory. – muru Jun 30 '15 at 12:57
10

You mention that the second server is using the Andrew File System (AFS).

I haven't worked with that, but from what I understand it, AFS is a Kerberos-secured filesystem which requires a kerberos ticket in order to work. That means you need to be logged to your site's Kerberos realm in order to be able to access your home directory.

If you log on with password, server2 is likely set up so that it logs you on to your Kerberos realm through PAM. If you're using SSH keys, however, then server2 won't get the information it requires to do that, and you won't be able to access your home directory.

Luckily, from the ssh -v output in your question, we can infer that your server has GSSAPI authentication enabled. This should allow you to perform a passwordless logon, provided you have a valid kerberos ticket for your realm. Do the following:

  • Log on to server2, and run the klist program. This will return something along the following lines:

    Ticket cache: FILE:/tmp/krb5cc_2000
    Default principal: wouter@EXAMPLE.ORG
    
    Valid starting     Expires            Service principal
    28-05-15 15:01:31  29-05-15 01:01:31  krbtgt/EXAMPLE.ORG@EXAMPLE.ORG
        renew until 29-05-15 15:01:28
    28-05-15 15:02:04  29-05-15 01:01:31  IMAP/example.org@EXAMPLE.ORG
        renew until 29-05-15 15:01:28
    

    look for the line which starts with Default principal:. It tells you what your kerberos principal is (in the above example, it's wouter@EXAMPLE.ORG). Write this down. Note that it's not an email address, and that it is case-sensitive; i.e., the principal ends with EXAMPLE.ORG, not example.org.

  • On your client machine, run kinit with the name of your principal (i.e., in the above example, that would be kinit wouter@EXAMPLE.ORG). If all goes well, when you run klist again now, you will see that you have a ticket cache on your local machine.
  • If you now run ssh -K server2, you should be able to log on, and the system should not ask for a password.

Please note that due to how Kerberos works, a ticket cache has a limited validity. It is not possible to ask for a ticket cache with validity longer than what the realm administrator configured (which is usually something like 10 hours or so). Once your ticket has expired, you will need to run kinit again, and enter your password once more.

  • thanks. "On your client machine, run kinit", do you mean I have to install Kerberos on my local Ubuntu? – Tim Jun 30 '15 at 14:22
  • Part of the kerberos tools, yes. You'll find the required tools in the krb5-user package. – Wouter Verhelst Jun 30 '15 at 14:23
  • Should I use rsa or dsa when creating the public keys and copying them to the server? (I followed Anthon's suggestion to use dsa right now) – Tim Jun 30 '15 at 14:25
  • Due to AFS on the server, you can't use SSH public keys, you need to use kerberos instead. So it doesn't matter ;-) – Wouter Verhelst Jun 30 '15 at 14:26
  • Are GSSAPI, dsa, and rsa all authentication methods? – Tim Jun 30 '15 at 14:30
5

You should try to connect to server2 with:

ssh -v tim@server2

and compare that with the same, connecting to server1 this will tell you exactly where the two servers differ.

Most likely there is a difference in /etc/ssh/sshd_config on both machines. where server2 or your ~/.ssh has accessibility problems (not restricted enough).

From the -v output you can see that you offer an RSA private key to verify against (in /home/tim/.ssh/id_rsa), but it looks like server2 only supports Diffie-Hellman (and tries /home/tim/.ssh/id_dsa which is probably not even there).

  • thanks, I updated with the output of running your command. Not sure what it means – Tim Jun 30 '15 at 12:45
  • @Tim updated my answer, you should check with the server2 administrator why it doesn't seem to support RSA private/public keys. – Anthon Jun 30 '15 at 13:35
  • Besides asking the admin (which I think is impossible to make any change based on my experiences), Is there some way to work with what the server expects? – Tim Jun 30 '15 at 13:44
  • @Tim, first make sure that ~/.ssh on the server indeed has your authorized keys installed ( ~/.ssh/authorized_keys). Then what you could try to do is have ssh-keygen generate a diffie-hellman key pair using ssh-keygen -t dsa and copy that over. – Anthon Jun 30 '15 at 13:48
  • (1) There is a file ~/.ssh/authorized_keys on the server. Does that mean that it has the authorized keys installed? (2) how shall I copy the generated diffie-hellman key pair to the server? by scp ~/.ssh/id_dsa.pub tim@server2:~/.ssh/authorized_keys? will that overwrite ~/.ssh/authorized_keys on the server? – Tim Jun 30 '15 at 13:57
4

Add the following entry in the client machine from which you are trying to ssh.

config file: /etc/ssh/ssh_config

GSSAPIAuthentication no

After that you will able to ssh to the machine.

If you don't have edit permissions for that file, you can also add

Host *
  GSSAPIAuthentication no

to ~/.ssh/config (create this file if it does not exist)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.