3

There is a issue confusing me for couple of days.

I have 3 Servers. A, B and C.

I want access B and C from A via ssh. I have set public key/ authorized_keys ... on A,B,C.

Scenario #1: Access B(.133) from A via ssh -- Success! Scenario #2: Access C(.148) from A via ssh -- Failed, it ask inputing password!

Compare their debug info:

1 success case; It is OpenSSH 5.1, it prefer ssh-rsa key:

debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-
cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa.

2 fail case; It is OpenSSH6.2, it does not prefer ssh-rsa key:

debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256
cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-   
sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-
sha2-nistp384,ecdsa-sha2-nistp521

My key is genrated by command ' ssh-keygen -t rsa', so ,I think, it is rsa key. Not sure if it is the key reason.

How can I configure the 'prefer hostkeyalgs' in OpenSSH(sshd) ?

Or maybe the issue is caused by other things?

===debug for Scenario #1 and #2 :===
See it at: diffchecker.com/tj5v3iog 

(This area don't allow to post too much debug info :( )

  • 2
    Server B rejects your key. The reason will be visible in the server error log. The most common reasons are wrong permissions. Check ls -lad ~ ~/.ssh ~/.ssh/authorized_keys on the server and post the results. – Jakuje Jun 12 '16 at 7:35
  • 1
    Did you try with an ecdsa key? ` ssh-keygen -t ecdsa -b 256 -N '' -f ~/.ssh/id_ecdsa` . Note after -N it's two single quotes (2x') and NOT a single double-quotes. Then do an ssh-copy-id -i ~/.ssh/id_ecdsa <C> ; check after the new pubkey is installed if it works – Dani_l Jun 12 '16 at 8:12
  • @Dani_l would you like to convert your comment into an actual Answer? – Jeff Schaller Jun 29 '16 at 16:02
0

Looks like your sshd is configured to accept ecdsa key.
You can either track down on the server-side why it's only looking for ecdsa keys instead of rsa, or you can resolve this from client side by providing an ecdsa key.

The steps to create and use an ecdsa key from the client are as follows:

  1. ssh-keygen -t ecdsa -b 256 -N '' -f ~/.ssh/id_ecdsa
  2. ssh-copy-id -i ~/.ssh/id_ecdsa C

Note in ssh-keygen after -N it's two single quotes (2x') and NOT a single double-quotes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.