2

After running successfully, my build script attempts to copy the final binary onto my FTP server using the scp command. Since the build takes a while, I don't want to be prompted for my password every time, so I tried to set up an SSH-keypair.

[wbarlow@build-machine]$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/wbarlow/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/wbarlow/.ssh/id_rsa.
Your public key has been saved in /home/wbarlow/.ssh/id_rsa.pub.
The key fingerprint is:
7f:b9:c7:a8:1b:77:ce:f8:b6:2a:e3:da:30:68:72:b7 wbarlow@build-machine

[wbarlow@build-machine]$ ssh-copy-id wbarlow@ftp-server
wbarlow@ftp-server's password: 
Now try logging into the machine, with "ssh 'wbarlow@ftp-server'", and check in:

  ~/.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

Then I tried to sign into my ftp-server, but I was still prompted for a password. I confirmed that the freshly created key was present.

[wbarlow@build-machine]$ ssh wbarlow@ftp-server
wbarlow@ftp-server's password: 

[wbarlow@ftp-server]$ cat ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGUbr4vUeiY7D6sSrsHm469QAqCClchL
7h/HZ7TAc+1F2KsTTF078OSINqzz8NpKJqhlEusLn644PzYn9LmGTIc7IsMG9s+B2n4bZX
9Ypb0VqLSqTgfE2I0j84+SfAQ6MvGJQ0NupIXxXbaMLDlNq1cetnR8NeN+9JeBq4sI8p/a
ijFVARQ7/XSKwQQN30Nl6flTEM1CTDECJs5YsPOu3P54mF6PG2mBdFra6+VQfAZ6fboq9O
d24VNHLYVtUdK5RpWgx8agUalov0xq/3m2VeC5arrYpCVH1rGx6EMxoQS25kk7t9mzBUCj
ulXGWQX2DPR/Em0OIfvVfe/l4xtFfH wbarlow@build-machine

I am able to use the public key to authenticate with other machines (namely, my Git repository host), so I don't think that the problem is on the client-side.

So -- how can I check that the FTP server is configured to accept authorized keys, and what sort of keys is it configured to accept? How can I check that the keys are being stored in the expected place (my home directory on ftp-server is /var/ftp/wbarlow/, but I've also tried copying the .ssh folder from there to /home/wbarlow/.)?


My .ssh directory is mode 700, and my authorized_keys file is mode 600. I've also tried using 755 for the .ssh directory.


I found my /etc/ssh/sshd_config file on the ftp-server. I won't post the whole thing, but it does have the following lines:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

As far as I can tell from the documentation, I think these lines are set correctly for what I want to do (s/key is something unrelated to ssh keypairs, right?).


Below is the verbose output while connecting.

[wbarlow@build-machine]:~$ ssh -v wbarlow@ftp-server
OpenSSH_6.1p1 Debian-4, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to ftp-server [(ip hidden)] port 22.
debug1: Connection established.
debug1: identity file /home/wbarlow/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/wbarlow/.ssh/id_rsa-cert type -1
debug1: identity file /home/wbarlow/.ssh/id_dsa type -1
debug1: identity file /home/wbarlow/.ssh/id_dsa-cert type -1
debug1: identity file /home/wbarlow/.ssh/id_ecdsa type -1
debug1: identity file /home/wbarlow/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1
debug1: match: OpenSSH_5.1 pat OpenSSH_5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.1p1 Debian-4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA [SNIP]
debug1: Host 'ftp-server' is known and matches the RSA host key.
debug1: Found key in /home/wbarlow/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
Cannot determine realm for numeric host address

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/wbarlow/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Trying private key: /home/wbarlow/.ssh/id_dsa
debug1: Trying private key: /home/wbarlow/.ssh/id_ecdsa
debug1: Next authentication method: password
wbarlow@ftp-server's password: 
  • 3
    Use ssh -v and/or ssh -vv to get more debugging output about what it's trying and what the server is telling it (and edit that in). – Michael Homer Dec 11 '15 at 22:23
  • 2
    check the access mode on ~/.ssh @ftp-server. It must not be readable by group or others otherwise ssh would reject to use keys from authorized_keys – Serge Dec 11 '15 at 22:49
  • @MichaelHomer thanks, I will try that when I return to work on monday if checking the permissions doesn't work. – Woodrow Barlow Dec 12 '15 at 23:10
  • @Serge thank you for the suggestion. i did a little experiment to rule out permissions issues -- see my edit. – Woodrow Barlow Dec 15 '15 at 14:15
  • @MichaelHomer i've added my ssh version info. – Woodrow Barlow Dec 15 '15 at 14:15
3

Config settings for the SSH server are often in /etc/ssh/sshd_config but the first thing I would check is the location and the permissions of the public key and its parent directory that you copied to the server.
Noting that correct permissions of authorized_keys on the remote are critical for ssh to work - and hence why we use ssh-copy-id and not simply copying the public key to the remote.
To understand this it may be useful to breakdown what the ssh-copy-id does.

First thing it does is secure copy id_rsa.pub over to the target server i.e.

scp -P port $HOME/.ssh/id_rsa.pub username@ipaddress:destination_path

and place in ~/.ssh/ of the remote machine.

it will also rename id_rsa.pub to authorized_keys so you end up with

$ ~/.ssh/authorized_keys

on remote machine.
It also sets the permissions which is critical i.e. authorized_keys file must be no less secure than

-rw------- 1 wbarlow wbarlow  802 Nov 25 13:54 authorized_keys

and .ssh directory cannot be less secure than 755 e.g.

drwx------ 2 wbarlow wbarlow  4096 Jul 29 00:30 .ssh

I tend to use the command

ssh-copy-id -i ~/.ssh/id_rsa.pub remote_user@remoteIP

that way the specific key I want gets onto the remote, but I don't think that would be your problem,as I suspect ssh will check all available private keys on your local machine when trying to establish a connection.

Also, as always, make sure to check the basic permissions of the containing folders ($HOME) so that other users/programs have appropriate file privileges .

  • hello! thank you for your answer. my permissions matched what you show here, but to be sure it isn't a permissions problem, I set both the file and folder to 777 (temporarily, of course!) and it still prompted me for my password when connecting. – Woodrow Barlow Dec 15 '15 at 14:11
  • 1
    oops. i misread "no less secure". Anyway, my .ssh folder is now 700 and my authorized_keys is 600, as shown in your example. i've also tried setting the folder to 755. – Woodrow Barlow Dec 15 '15 at 14:55
  • as it turns out, it was a permissions issue -- but on my home directory. my home directory was mode 700 and changing it to 744 made it work just fine. if you edit this into your answer i'll mark it as accepted; otherwise i'll post my own answer. – Woodrow Barlow Dec 18 '15 at 21:21
  • glad you got it working. do you mean the permissions of the home directory on your client machine or on the server? – the_velour_fog Dec 18 '15 at 21:23
  • i mean on the server. – Woodrow Barlow Dec 18 '15 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.