2

We run a small handful of Debian servers on Google Cloud Platform. New servers we setup, we're able to add SSH keys at the point of creation and access the machines via SSH without a problem. Older machines (read created in the last 1-3 months) we're having issues accessing them via SSH.

As a test case, I've created a brand new id_rsa keypair on my local Mac using ssh-keygen and added the public key to GCP. My IP is allowed to access the box and my user is in the AllowUsers in ssh_config.

Here is the output when I run ssh -i ~/.ssh/*KEY* *USER*@*IP* -p *PORT* -v

OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /Users/me/.ssh/config
debug1: /Users/me/.ssh/config line ****: Applying options for ****IP****
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line ****: Applying options for *
debug1: /etc/ssh/ssh_config line ****: Applying options for *
debug1: Connecting to ****IP**** [****IP****] port ****PORT****.
debug1: Connection established.
debug1: identity file /Users/me/.ssh/gcp type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/me/.ssh/gcp-cert type -1
debug1: identity file /Users/me/.ssh/gcp type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/me/.ssh/gcp-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1
debug1: match: OpenSSH_6.7p1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to ****IP****:****PORT**** as '****USERNAME****'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: xxx
debug1: Host '[****IP****]:****PORT****' is known and matches the ECDSA host key.
debug1: Found key in /Users/me/.ssh/known_hosts:1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
********************************************************************
*                                                                  *
* This system is for the use of authorized users only.  Usage of   *
* this system may be monitored and recorded by system personnel.   *
*                                                                  *
* Anyone using this system expressly consents to such monitoring   *
* and is advised that if such monitoring reveals possible          *
* evidence of criminal activity, system personnel may provide the  *
* evidence from such monitoring to law enforcement officials.      *
*                                                                  *
********************************************************************
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/me/.ssh/gcp
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: /Users/me/.ssh/gcp
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).  

Despite my key being found, it appears my local client isn't trying to authenticate after connecting. I'm unsure as to whether or not this is a problem with GCP not adding my public key to the server properly, or whether or not my local machine is doing something wrong.

Google appear to have changed the way they handle keys in the last few months (https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#metadatavalues) but I seem to be doing everything correctly yet am unable to connect.

2

After some digging, it appears that Google Cloud Platform is buggy when it comes to applying SSH keys to our Debian boxes. Adding the keys globally at a project level, or adding users manually to the Debian box, adding keys manually to authorized_keys for each user, it works. Adding them at an instance level does not work. I will be reporting the bug to Google.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.