1

I created a public/private key pair using the ssh-keygen -t rsa in my ~/.ssh folder.

I then copied the key over using the ssh-copy-id username@remoteserver.com command and received this notification.

Number of key(s) added:        2

I tried logging in but was still prompted for a password. I ran a find / -name id_rsa.pub command and searched my remote server's .ssh folder but couldn't find the master key anywhere. I tried chmod with both go-rwx and 777 permissions on the pub key but to no avail. Why is the file not getting copied, yet I receive no error messages?

EDIT: I added the -v tag to the ssh command and got this output

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to [servername] [ipaddress] port 22.
debug1: Connection established.
debug1: identity file /Users/william.roberts/.ssh/id_rsa type 1
debug1: identity file /Users/william.roberts/.ssh/id_rsa-cert type -1
debug1: identity file /Users/william.roberts/.ssh/id_dsa type -1
debug1: identity file /Users/william.roberts/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 7c:3a:61:86:ec:53:40:c3:b0:5e:c2:9f:f4:bf:35:64
debug1: Host '[servername]' is known and matches the RSA host key.
debug1: Found key in /Users/william.roberts/.ssh/known_hosts:7
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/william.roberts/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Offering RSA public key: /Users/william.roberts/.ssh/other_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Offering RSA public key: /Users/william.roberts/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /Users/william.roberts/.ssh/id_dsa
debug1: Next authentication method: password

Edit 2:

output of ls -la .ssh

drwxrwxrwx  2 root root 4096 Dec 10 19:15 .
dr-xr-x---. 5 root root 4096 Nov 19 22:44 ..
-rw-------  1 root root 3019 Dec 10 19:51 authorized_keys
-rw-r--r--  1 root root  427 Nov 24 19:40 known_hosts
  • I think there should be a --verbose flag. Mind running it again with that? – Wilhelm Erasmus Dec 10 '15 at 19:55
  • You won't find the private key on the remote server - it's private. Your public key should be found in .ssh/authorized_keys on the remote host, however. Can you confirm that this is the case? – DopeGhoti Dec 10 '15 at 19:57
  • Yes, I searched for the id_rsa.pub file, not the id_rsa file. I looked at the authorized keys file and noticed that there are two identical entiries for id_rsa within the authorized_keys file. – William Roberts Dec 10 '15 at 20:02
  • @DopeGhoti damn I didn't even notice that wording :O – Wilhelm Erasmus Dec 10 '15 at 20:06
  • What is the output of ls -la ~/.ssh? – michas Dec 10 '15 at 20:34
0

Your .ssh directory can't be world accessible:

chmod 700 ~/.ssh

should fix it

2

ssh-copy-id will look for some public key locally, log into the remote server and put that key into ~/.ssh/authorized_keys.

I'm pretty sure it added the key into exactly this file.

There might be various reasons, why that key is not considered. For example the ~/.ssh/ directory might have not the correct permissions or the server is not configured to use keys.

Use ssh -v $server to get some hints about the problem.


Thanks for the updates to your question.

From the verbose output you see that the server offers public key authentication but does not accept any of your keys.

From the output of ls -la ~/.ssh you see that anyone would be able to replace your authorized_keys file and afterward log in as you. - The server did notice this and therefore ignored the keys in that file.

Setting chmod go-wx ~/.ssh should fix that.


I would suggest the following procedure:

  • Use ssh-add $keyfile to add the private key in the given file to your agent
  • Use ssh-add -L to verify key is known to the agent and show the public key
  • Use ssh-copy-id to transfer the key from the agent to the remote server (the remote ~/.ssh/authorized_keys file should now contain exactly the public key listed above)
  • Use ssh to use the key from the agent to authenticate to the server.
  • What permissions should the .ssh folder have? – William Roberts Dec 10 '15 at 20:10
  • If no important data is in the remote ~/.ssh/. Simply delete that directory and let ssh-copy-id recreate it. It will set up permissions correctly. – michas Dec 10 '15 at 20:12
  • I added the output to my original comment. I noticed it sometimes says "id_dsa" instead of "id_rsa". Navigating to my local ssh folder and saying ls -a only shows rsa. And reading the authorized keys on my remote server only shows id_rsa as well. – William Roberts Dec 10 '15 at 20:27
  • I also don't think I can delete the remote server's ssh folder because other keys use it. – William Roberts Dec 10 '15 at 20:34
  • It is probably your personal account on the server, i.e. no one else but you alone will use that account. Keys do not "use" folders. Most probably the folder will only contain a single file containing your key. – michas Dec 10 '15 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.