2

I have several clients connecting to an SSH server all using public key authentication.

I am trying to connect from an Ubuntu 14.04 VM to the same server. Can't get public key authentication working. Here is the connection log. Pointers to possible issues in bold. Seems to be some problems with protocol and software versions on client and server. Also, seems that publickey authentication is not attempted at all. Just password.

I have checked all permissions on relevant files. Also private key does not have any passphrase.

    OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ........ [........] port 22.
debug1: Connection established.
debug1: identity file ....../.ssh/id_rsa_perf type 1
debug1: identity file ....../.ssh/id_rsa_perf-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
****debug1: Remote protocol version 2.0, remote software version xxxxxxx
debug1: no match: xxxxxxx****
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],ssh-rsa,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: setup hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: bits set: 1022/2048
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA fb:e2:06:14:e6:5f:94:91:a4:2f:8d:50:aa:ca:d1:0d
debug1: Host '........' is known and matches the RSA host key.
debug1: Found key in ......../.ssh/known_hosts:1
debug2: bits set: 1036/2048
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: ........../.ssh/id_rsa_perf (0xb7878c10), explicit
****debug1: Authentications that can continue: password****
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: we sent a password packet, wait for reply
debug1: Authentications that can continue: password
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (password).

Below is the connection log of a client that connects to the same server using the same settings, same openssh version on both clients. The only difference I see is that there is no error related to protocol/software version detection. The client that connects is a physical box which the one that does not is a VMWare virtual instance. Both Ubuntu 14.04

OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ..............[.....] port 22.
debug1: Connection established.
debug1: identity file /home/...../.ssh/id_rsa_perf type 1
debug1: identity file /home/..../.ssh/id_rsa_perf-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
**debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1-hpn14v5**
**debug1: match: OpenSSH_6.7p1-hpn14v5 pat OpenSSH* compat 0x04000000**
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup [email protected]
debug1: kex: server->client aes128-ctr [email protected] none
debug2: mac_setup: setup [email protected]
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 8c:84:b3:25:e5:6c:35:53:24:d0:d2:db:66:8f:ce:3d
debug1: Host '......' is known and matches the ECDSA host key.
debug1: Found key in /home/...../.ssh/known_hosts:3
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/...../.ssh/id_rsa_perf (0xb7afa098), explicit
**debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey**
debug1: Offering RSA public key: /home/...../.ssh/id_rsa_perf
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 4e:af:a4:b5:23:da:0d:98:ee:c5:b2:f9:80:94:77:40
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to main.scan-dent.com ([....]:22).
Improve this question
8
  • 1
    Are there any relevant entries in the /var/log/auth.log?
    – Eric Renouf
    Commented Aug 21, 2015 at 18:08
  • Nothing related. Posted an update showing another client successfully connecting.
    – asa
    Commented Aug 21, 2015 at 18:21
  • 1
    Could you please provide info about how you're creating the public key? Also share the output of ls -l ~/.ssh
    – tachomi
    Commented Aug 21, 2015 at 18:24
  • public key created on client with ssh-keygen -P "" -f ...-perf
    – asa
    Commented Aug 21, 2015 at 18:27
  • can you post the output with -vvv? There might be some more hidden information
    – Jakuje
    Commented Aug 21, 2015 at 18:31

2 Answers 2

Reset to default
2

Doing a diff in both output I see this:

They look kind of the same but one is doing different authentification, you should check the settings of your ssh server.

One is doing md5 and the other one sha1, so check it out.

Also, I don't know if you already know this but the clients are different. So to make an assumption of why one works and the other doesn't you should at least try to make them similar to track down about what the error is:

40,53c40,49
< debug2: mac_setup: setup hmac-md5
< debug1: kex: server->client aes128-ctr hmac-md5 none
< debug2: mac_setup: setup hmac-md5
< debug1: kex: client->server aes128-ctr hmac-md5 none
< debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
< debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
< debug2: bits set: 1022/2048
< debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
< debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
< **debug1: Server host key: RSA fb:e2:06:14:e6:5f:94:91:a4:2f:8d:50:aa:ca:d1:0d**
< debug1: Host '........' is known and matches the RSA host key.
< debug1: Found key in ......../.ssh/known_hosts:1
< debug2: bits set: 1036/2048
< debug1: ssh_rsa_verify: signature correct
---
> debug2: mac_setup: setup [email protected]
> debug1: kex: server->client aes128-ctr [email protected] none
> debug2: mac_setup: setup [email protected]
> debug1: kex: client->server aes128-ctr [email protected] none
> debug1: sending SSH2_MSG_KEX_ECDH_INIT
> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
**> debug1: Server host key: ECDSA 8c:84:b3:25:e5:6c:35:53:24:d0:d2:db:66:8f:ce:3d**
> debug1: Host '......' is known and matches the ECDSA host key.
> debug1: Found key in /home/...../.ssh/known_hosts:3
> debug1: ssh_ecdsa_verify: signature correct
64,80c60,70
Improve this answer
0

The issue is solved. Turns out there were some issues with the firewall behind which the non-connecting client was sitting. After clearing these up, the client connects properly using pub key authentication

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .