3

There is a issue confusing me for couple of days.

I have 3 Servers. A, B and C.

I want access B and C from A via ssh. I have set public key/ authorized_keys ... on A,B,C.

Scenario #1: Access B(.133) from A via ssh -- Success! Scenario #2: Access C(.148) from A via ssh -- Failed, it ask inputing password!

Compare their debug info:

1 success case; It is OpenSSH 5.1, it prefer ssh-rsa key:

debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-
[email protected],[email protected],ssh-rsa.

2 fail case; It is OpenSSH6.2, it does not prefer ssh-rsa key:

debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256
[email protected],[email protected],ecdsa-   
[email protected],ecdsa-sha2-nistp256,ecdsa-
sha2-nistp384,ecdsa-sha2-nistp521

My key is genrated by command ' ssh-keygen -t rsa', so ,I think, it is rsa key. Not sure if it is the key reason.

How can I configure the 'prefer hostkeyalgs' in OpenSSH(sshd) ?

Or maybe the issue is caused by other things?

===debug for Scenario #1 and #2 :===
See it at: diffchecker.com/tj5v3iog 

(This area don't allow to post too much debug info :( )

3
  • 2
    Server B rejects your key. The reason will be visible in the server error log. The most common reasons are wrong permissions. Check ls -lad ~ ~/.ssh ~/.ssh/authorized_keys on the server and post the results.
    – Jakuje
    Jun 12, 2016 at 7:35
  • 1
    Did you try with an ecdsa key? ` ssh-keygen -t ecdsa -b 256 -N '' -f ~/.ssh/id_ecdsa` . Note after -N it's two single quotes (2x') and NOT a single double-quotes. Then do an ssh-copy-id -i ~/.ssh/id_ecdsa <C> ; check after the new pubkey is installed if it works
    – Dani_l
    Jun 12, 2016 at 8:12
  • @Dani_l would you like to convert your comment into an actual Answer?
    – Jeff Schaller
    Jun 29, 2016 at 16:02

1 Answer 1

0

Looks like your sshd is configured to accept ecdsa key.
You can either track down on the server-side why it's only looking for ecdsa keys instead of rsa, or you can resolve this from client side by providing an ecdsa key.

The steps to create and use an ecdsa key from the client are as follows:

  1. ssh-keygen -t ecdsa -b 256 -N '' -f ~/.ssh/id_ecdsa
  2. ssh-copy-id -i ~/.ssh/id_ecdsa C

Note in ssh-keygen after -N it's two single quotes (2x') and NOT a single double-quotes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .