Can't connect to another user than root through SSH

Question

I'm trying to connect to a server on my local network using SSH and would like to be able to login as storm but not as root (for obvious security purposes). I copied my .pub key to the .ssh/authorized_keys

With this /etc/ssh/sshd_config :

PermitRootLogin no
[...]
Match Address 192.168.1.*,127.0.0.1
   PermitRootLogin yes

I get :

$ ssh root@ip
Enter passphrase for key 'PATH_OF_THE_KEY'
$ ssh storm@ip
Permission denied (publickey).

---

With this new line at the end :

AllowUsers storm or AllowUsers storm root

I get :

$ ssh root@ip
Permission denied (publickey).
$ ssh storm@ip
Permission denied (publickey).

Even with the Match Address block commented, it blocks me both root & user. Can someone help me ?

---

EDIT : Log for each failed connection with storm user

localhost sshd[698]: Invalid user storm from 192.168.1.11
localhost sshd[443]: input_userauth_request: invalid user storm [preauth]
localhost sshd[698]: Connection closed by 192.168.1.11 [preauth]

No passwords allowed :

PasswordAuthentication no

ssh -v root@ip and ssh -v storm@ip give the same output with AllowUsers storm:

OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.1.33 [192.168.1.33] port XXXX.
debug1: Connection established.
debug1: identity file /home/storm/.ssh/id_rsa type -1
debug1: identity file /home/storm/.ssh/id_rsa-cert type -1
debug1: identity file /home/storm/.ssh/id_dsa type -1
debug1: identity file /home/storm/.ssh/id_dsa-cert type -1
debug1: identity file /home/storm/.ssh/id_ecdsa type 3
debug1: identity file /home/storm/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/storm/.ssh/id_ed25519 type -1
debug1: identity file /home/storm/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.1
debug1: match: OpenSSH_7.1 pat OpenSSH* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-sha1-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA XX:XX:XX:XX:XX:XX:XX:XX
debug1: Host '[192.168.1.33]:XXXX' is known and matches the ECDSA host key.
debug1: Found key in /home/storm/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/storm/.ssh/id_rsa
debug1: Trying private key: /home/storm/.ssh/id_dsa
debug1: Offering ECDSA public key: /home/storm/.ssh/id_ecdsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/storm/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).

EDIT2 :

drwx------  2 root root 4096 19 sept. 15:47 .ssh
-r-------- 1 root root  236 19 sept. 15:47 authorized_keys

EDIT3 :

Now working ! Thanks to Brandon Xavier. I didn't understood that each user (server side) needs to have his own .ssh directory, which is undoubtedly logic after-thought.

---

But now i'm able to login as storm (which is what I wanted) but not anymore as direct root.

Both root & storm have their .ssh directory, authorized_keys files, with correct owners/permissions and the same public key for each authorized_keys file. SSHD config file is always with the Match block. What could block root access ?

Answer 1

.ssh and everything under it should be owned by the user (in this case 'storm') and only the user should have permission. chown -R storm ~storm/.ssh; chmod 700 ~storm/.ssh;chmod 600 ~storm/.ssh/authorized_keys should do the trick.

If you have control over who's able to log into the console, you can get away without the Match block and the AllowUsers directive by simply disabling passwords and allowing root login only with a key:

PasswordAuthentication no
PermitRootLogin without-password

Be sure to test this while you have access to the console . . . just in case.

Answer 2

What about "PaswordAuthentication" in your config file? if you have modified your config remember restart the service

some links: https://wiki.centos.org/HowTos/Network/SecuringSSH https://raymii.org/s/tutorials/Limit_access_to_openssh_features_with_the_Match_keyword.html

Answer 3

I have the same problem. After check /etc/passwd I see myuser shell config set to /bin:false

$ cat /etc/passwd
myuser:x:112:116::/media/sys:/bin/false

I have to correct this with usermod myuser -s /bin/bash and after that I have :

$ cat /etc/passwd
myuser:x:112:116::/media/sys:/bin/bash

Voila, it's working well now :)