5

I have a Macbook pro, and I successfully set up authorization keys so that I didn't have to enter a password each time I log in to a remote machine.

Years later I have a new computer that I have put Ubuntu onto. I am now trying to do the same, but I'm having problems.

So far I have run ssh-keygen -t dsa and changed the permissions of my ~/.ssh folder to 700 and the id_dsa* files to 600

I've updated the authorised_keys file on the remote machine so that it now looks something like:

ssh-rsa KEYFORTHEOLDMACHINEWHICHISTILLUSE
ssh-dss KEYFORTHENEWMACHINE

I have a space between the two. I don't know if this matters, but I have tried no space and also a line break between them.

I have made sure that the permissions on my server are also as above.

But when I ssh in, I am still prompted for the password. Anything obvious that I'm doing wrong?


Update:

When I run ls -ld ~/ ~/.ssh ~/.ssh/authorized_keys, I get the following:

drwxr-xr-x 5 myusername domain users       4096 Jun  8 20:58 /home/myusername/
drwx------ 2 myusername domain users       4096 Jun  8 18:06 /home/myusername/.ssh
-rw------- 1 myusername subdept-phys-sags 1044 Jun  8 18:06 /home/myusername/.ssh/authorized_keys

Update:

When I run ssh -vv remote_server, I get the following:

OpenSSH_7.2p2 Ubuntu-4, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /home/jg/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "ssh-gateway.physics.ac.uk" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to ssh-gateway.physics.ac.uk [163.1.240.41] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_rsa-cert type -1
debug1: identity file /home/jg/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to ssh-gateway.physics.ac.uk:22 as 'brook'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:Ay2gqDucgtHyDl2rDdBifYSewyrqz1Tu9PZYU4FTeLU
debug1: Host 'ssh-gateway.physics.ac.uk' is known and matches the ECDSA host key.
debug1: Found key in /home/jg/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: Skipping ssh-dss key /home/jg/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
debug2: key: /home/jg/.ssh/id_rsa ((nil))
debug2: key: /home/jg/.ssh/id_ecdsa ((nil))
debug2: key: /home/jg/.ssh/id_ed25519 ((nil))
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information No Kerberos credentials available
debug1: Unspecified GSS failure.  Minor code may provide more information No Kerberos credentials available
debug1: Unspecified GSS failure.  Minor code may provide more information
debug1: Unspecified GSS failure.  Minor code may provide more information No Kerberos credentials available
debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Trying private key: /home/jg/.ssh/id_rsa
debug1: Trying private key: /home/jg/.ssh/id_ecdsa
debug1: Trying private key: /home/jg/.ssh/id_ed25519
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
7
  • Did you check the config file on the 'local' server?
    – Marco
    Commented Jun 8, 2016 at 15:48
  • 3
    The entries in .ssh/authorized_keys need to be on separate lines. Please show the exact message you get - are you being prompted for a password or passphrase?
    – JigglyNaga
    Commented Jun 8, 2016 at 15:51
  • Marco - did I check it for what? JigglyNaga - Even when I have them on separate lines I am prompted for "me@remote_machines's password:". I left the passphrase empty. Commented Jun 8, 2016 at 17:07
  • 1
    post the results of ls -ld ~/ ~./.ssh ~/.ssh/authorized_keys on the remote host. What can you find in the error log on server?
    – Jakuje
    Commented Jun 8, 2016 at 19:48
  • 1
    Make sure that authorized_keys has the keys on separate lines and post the output of ssh -vv nameoftheserver Commented Jun 8, 2016 at 22:29

1 Answer 1

9

Notice an important line:

debug1: Skipping ssh-dss key /home/jg/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes

From http://www.openssh.com/txt/release-7.0

  • ssh(1), sshd(8): extend Ciphers, MACs, KexAlgorithms, HostKeyAlgorithms, PubkeyAcceptedKeyTypes and HostbasedKeyTypes options to allow appending to the default set of algorithms instead of replacing it. Options may now be prefixed with a '+' to append to the default, e.g. "HostKeyAlgorithms=+ssh-dss".

Try adding the following to /etc/ssh/ssh_config or ~/.ssh/config

PubkeyAcceptedKeyTypes +ssh-dss

Note: in addition to generating new keys with RSA and skipping this issue all-together (a simple ssh-keygen should suffice), I would also suggest using ssh-copy-id instead of doing key-copying by hand.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .