After running successfully, my build script attempts to copy the final binary onto my FTP server using the
scp command. Since the build takes a while, I don't want to be prompted for my password every time, so I tried to set up an SSH-keypair.
[wbarlow@build-machine]$ ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/home/wbarlow/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/wbarlow/.ssh/id_rsa. Your public key has been saved in /home/wbarlow/.ssh/id_rsa.pub. The key fingerprint is: 7f:b9:c7:a8:1b:77:ce:f8:b6:2a:e3:da:30:68:72:b7 wbarlow@build-machine [wbarlow@build-machine]$ ssh-copy-id wbarlow@ftp-server wbarlow@ftp-server's password: Now try logging into the machine, with "ssh 'wbarlow@ftp-server'", and check in: ~/.ssh/authorized_keys to make sure we haven't added extra keys that you weren't expecting.
Then I tried to sign into my ftp-server, but I was still prompted for a password. I confirmed that the freshly created key was present.
[wbarlow@build-machine]$ ssh wbarlow@ftp-server wbarlow@ftp-server's password: [wbarlow@ftp-server]$ cat ~/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGUbr4vUeiY7D6sSrsHm469QAqCClchL 7h/HZ7TAc+1F2KsTTF078OSINqzz8NpKJqhlEusLn644PzYn9LmGTIc7IsMG9s+B2n4bZX 9Ypb0VqLSqTgfE2I0j84+SfAQ6MvGJQ0NupIXxXbaMLDlNq1cetnR8NeN+9JeBq4sI8p/a ijFVARQ7/XSKwQQN30Nl6flTEM1CTDECJs5YsPOu3P54mF6PG2mBdFra6+VQfAZ6fboq9O d24VNHLYVtUdK5RpWgx8agUalov0xq/3m2VeC5arrYpCVH1rGx6EMxoQS25kk7t9mzBUCj ulXGWQX2DPR/Em0OIfvVfe/l4xtFfH wbarlow@build-machine
I am able to use the public key to authenticate with other machines (namely, my Git repository host), so I don't think that the problem is on the client-side.
So -- how can I check that the FTP server is configured to accept authorized keys, and what sort of keys is it configured to accept? How can I check that the keys are being stored in the expected place (my home directory on ftp-server is
/var/ftp/wbarlow/, but I've also tried copying the
.ssh folder from there to
.ssh directory is mode 700, and my
authorized_keys file is mode 600. I've also tried using 755 for the
I found my
/etc/ssh/sshd_config file on the ftp-server. I won't post the whole thing, but it does have the following lines:
RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys # To disable tunneled clear text passwords, change to no here! #PasswordAuthentication yes #PermitEmptyPasswords no PasswordAuthentication yes # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes ChallengeResponseAuthentication no
As far as I can tell from the documentation, I think these lines are set correctly for what I want to do (s/key is something unrelated to ssh keypairs, right?).
Below is the verbose output while connecting.
[wbarlow@build-machine]:~$ ssh -v wbarlow@ftp-server OpenSSH_6.1p1 Debian-4, OpenSSL 1.0.1c 10 May 2012 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to ftp-server [(ip hidden)] port 22. debug1: Connection established. debug1: identity file /home/wbarlow/.ssh/id_rsa type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file /home/wbarlow/.ssh/id_rsa-cert type -1 debug1: identity file /home/wbarlow/.ssh/id_dsa type -1 debug1: identity file /home/wbarlow/.ssh/id_dsa-cert type -1 debug1: identity file /home/wbarlow/.ssh/id_ecdsa type -1 debug1: identity file /home/wbarlow/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1 debug1: match: OpenSSH_5.1 pat OpenSSH_5* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.1p1 Debian-4 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: RSA [SNIP] debug1: Host 'ftp-server' is known and matches the RSA host key. debug1: Found key in /home/wbarlow/.ssh/known_hosts:1 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/wbarlow/.ssh/id_rsa debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug1: Trying private key: /home/wbarlow/.ssh/id_dsa debug1: Trying private key: /home/wbarlow/.ssh/id_ecdsa debug1: Next authentication method: password wbarlow@ftp-server's password:
ssh -vvto get more debugging output about what it's trying and what the server is telling it (and edit that in).