1

I have a problem when ssh to another server. I created ssh-key and copied it to other server.

-bash-4.2$ whoami
postgres
-bash-4.2$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/pgsql/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /var/lib/pgsql/.ssh/id_rsa.
Your public key has been saved in /var/lib/pgsql/.ssh/id_rsa.pub.
The key fingerprint is:
96:fd:e7:5b:d2:b0:ac:b3:3e:7b:55:fd:ad:4f:9f:c5 postgres@master.mydomain.com
The key's randomart image is:
+--[ RSA 2048]----+
|                 |
|                 |
|                .|
|         o      o|
|        S .   . +|
|       .   . . =+|
|            . =oE|
|            o+o++|
|           .=*o+o|
+-----------------+
-bash-4.2$ ssh-copy-id 192.168.2.75
The authenticity of host '192.168.2.75 (192.168.2.75)' can't be established.
ECDSA key fingerprint is 20:00:96:92:ff:a7:00:cb:a1:3a:30:fe:db:dd:55:c6.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
postgres@192.168.2.75's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '192.168.2.75'"
and check to make sure that only the key(s) you wanted were added.

But still asking password

-bash-4.2$ ssh 192.168.2.75
postgres@192.168.2.75's password:
Last login: Thu Mar 31 10:09:45 2016 from 192.168.2.138
-bash-4.2$ whoami
postgres
-bash-4.2$

Hostname for connected:

-bash-4.2$ hostname
slave.localdomain.tld

Hostname for connector:

-bash-4.2$ hostname
master.localdomain.tld

But I can access to root user without password.

-bash-4.2$ ssh-copy-id root@192.168.2.75
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.2.75's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.2.75'"
and check to make sure that only the key(s) you wanted were added.

-bash-4.2$ ssh root@192.168.2.75
Last login: Thu Mar 31 10:10:20 2016 from 192.168.2.138
[root@slave ~]#

Also I can access to remote server's postgres user without password

-bash-4.2$ ssh-copy-id 108.61.199.64 -p 2222
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
postgres@108.61.199.64's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p '2222' '108.61.199.64'"
and check to make sure that only the key(s) you wanted were added.

-bash-4.2$ ssh 108.61.199.64 -p 2222
Last login: Thu Mar 31 11:08:54 2016 from 78.189.14.197
-bash-4.2$ whoami
postgres
-bash-4.2$ hostname
postgresql.MYDOMAIN.COM

Here are the last lines of ssh -vvv output:

debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /var/lib/pgsql/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /var/lib/pgsql/.ssh/id_dsa
debug3: no such identity: /var/lib/pgsql/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /var/lib/pgsql/.ssh/id_ecdsa
debug3: no such identity: /var/lib/pgsql/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /var/lib/pgsql/.ssh/id_ed25519
debug3: no such identity: /var/lib/pgsql/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

Can anyone help me what did I wrong?

Edit:

Here are the permissions of root&postgres users.

[root@localhost pgsql]# ll /var/lib/pgsql/
total 12
dr-xr-x---.  4 postgres postgres   67 Mar 31 09:57 .
drwxr-xr-x. 27 root     root     4096 Mar 31 13:15 ..
-rw-------.  1 postgres postgres 1350 Mar 31 13:02 .bash_history
-rwx------.  1 postgres postgres  268 Mar 30 14:15 .bash_profile
drwx------.  2 postgres postgres   76 Mar 31 10:46 .ssh
drwx------.  4 postgres postgres   48 Mar 31 09:30 9.5
[root@localhost pgsql]# ll /root/
total 32
dr-xr-x---.  4 root root 4096 Mar 31 09:31 .
dr-xr-xr-x. 17 root root 4096 Mar 31 09:37 ..
-rw-------.  1 root root 3389 Mar 31 10:59 .bash_history
-rw-r--r--.  1 root root   18 Dec 29  2013 .bash_logout
-rw-r--r--.  1 root root  176 Dec 29  2013 .bash_profile
-rw-r--r--.  1 root root  176 Dec 29  2013 .bashrc
-rw-r--r--.  1 root root  100 Dec 29  2013 .cshrc
drwxr-----.  3 root root   18 Mar 30 14:14 .pki
drwx------.  2 root root   76 Mar 31 12:51 .ssh
-rw-r--r--.  1 root root  129 Dec 29  2013 .tcshrc

Here is the /var/log/audit/audit.log when I want to ssh.

[root@localhost pgsql]# cat /var/log/audit/audit.log
type=CRYPTO_KEY_USER msg=audit(1459431065.262:1195): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=2b:3f:aa:b8:46:1d:b8:f9:d7:c2:16:96:67:68:f1:0d direction=? spid=3585 suid=74  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431065.262:1196): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3585 suid=74 rport=56439 laddr=192.168.2.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=USER_ERR msg=audit(1459431065.263:1197): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident grantors=? acct="?" exe="/usr/sbin/sshd" hostname=192.168.2.138 addr=192.168.2.138 terminal=ssh res=failed'
type=CRYPTO_KEY_USER msg=audit(1459431065.264:1198): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ef:0b:31:91:b7:38:45:42:88:6d:d5:d7:c2:f7:ee:6a direction=? spid=3584 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431065.265:1199): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=20:00:96:92:ff:a7:00:cb:a1:3a:30:fe:db:dd:55:c6 direction=? spid=3584 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431065.265:1200): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=2b:3f:aa:b8:46:1d:b8:f9:d7:c2:16:96:67:68:f1:0d direction=? spid=3584 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=USER_LOGIN msg=audit(1459431065.265:1201): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="postgres" exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=ssh res=failed'
type=CRYPTO_KEY_USER msg=audit(1459431066.776:1202): pid=3589 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ef:0b:31:91:b7:38:45:42:88:6d:d5:d7:c2:f7:ee:6a direction=? spid=3589 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431066.776:1203): pid=3589 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=20:00:96:92:ff:a7:00:cb:a1:3a:30:fe:db:dd:55:c6 direction=? spid=3589 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431066.776:1204): pid=3589 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=2b:3f:aa:b8:46:1d:b8:f9:d7:c2:16:96:67:68:f1:0d direction=? spid=3589 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_SESSION msg=audit(1459431066.777:1205): pid=3588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com pfs=curve25519-sha256@libssh.org spid=3589 suid=74 rport=56440 laddr=192.168.2.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_SESSION msg=audit(1459431066.777:1206): pid=3588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com pfs=curve25519-sha256@libssh.org spid=3589 suid=74 rport=56440 laddr=192.168.2.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=AVC msg=audit(1459431066.945:1207): avc:  denied  { read } for  pid=3588 comm="sshd" name="authorized_keys" dev="dm-0" ino=47671 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postgresql_db_t:s0 tclass=file
type=SYSCALL msg=audit(1459431066.945:1207): arch=c000003e syscall=2 success=no exit=-13 a0=7f1e85e81ac0 a1=800 a2=1 a3=7f1e7fa5e2e0 items=0 ppid=3551 pid=3588 auid=4294967295 uid=0 gid=0 euid=26 suid=0 fsuid=26 egid=26 sgid=0 fsgid=26 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
type=USER_AUTH msg=audit(1459431066.945:1208): pid=3588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="postgres" exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=ssh res=failed'

Note: All three servers are running Centos 7

Local Server: CentOS Linux release 7.1.1503 (Core)

Remote Server: CentOS Linux release 7.2.1511 (Core)

  • probably permission problem on server side. What you can see in server log? The postgress user home /var/lib/pgsql/ will probably not satisfy the requirements needed by ssh. – Jakuje Mar 31 '16 at 10:10
0

I found solution at https://serverfault.com/questions/321534/public-key-authentication-fails-only-when-sshd-is-daemon

restorecon -r -vv /var/lib/pgsql/.ssh

command was enough. I think problem occured because of SELinux. Here is the restorecon command manual. http://linux.die.net/man/8/restorecon

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.