3

I've been struggling for days with this now and can't find what I'm doing wrong.

I've got a website on a VPS server. Every night I make a backup of the database. It gets stored on my VPS server. I also want to send a copy to my NAS (Synology DS214play) at home. Both servers operate on Linux.

So I've logged into my VPS server (as root) and generated a ssh-keygen.

On my VPS it looks like this:

[root@vps /]# cd ~
[root@vps ~]# ls -alh
dr-xr-x---.  7 root root 4.0K Jun 25 18:58 .
dr-xr-xr-x. 24 root root 4.0K Jun 25 19:33 ..
drwx------   3 root root 4.0K Jun 25 20:29 .ssh
[root@vps ~]# cd .ssh
[root@vps .ssh]# ls -alh
drwx------  3 root root 4.0K Jun 25 20:29 .
dr-xr-x---. 7 root root 4.0K Jun 25 18:58 ..
-rw-------  1 root root 1.7K Jun 26 07:27 id_rsa
-rw-r--r--  1 root root  403 Jun 26 07:27 id_rsa.pub
-rw-------  1 root root  394 Jun 25 20:29 known_hosts

Then I copied the file to the NAS by using ssh-copy-id

admin@NAS:/$ cd ~
admin@NAS:~$ ls -alh
drwxrwxrwx  6 admin users 4.0K Jun 26 07:28 .
drwxrwxrwx 13 root  root  4.0K Jun 21 20:57 ..
drwx------  2 admin users 4.0K Jun 26 07:28 .ssh
admin@NAS:~$ cd .ssh
admin@NAS:~/.ssh$ ls -alh
drwx------ 2 admin users 4.0K Jun 26 07:28 .
drwxrwxrwx 6 admin users 4.0K Jun 26 07:28 ..
-rw------- 1 admin users  403 Jun 26 07:27 authorized_keys

When looking into VPS/id_rsa.pub and NAS/authorized_keys I see that both keys are identical.

Now I'm trying to copy a test file from the VPS to the NAS by using:

[root@vps /]# scp -i ~/.ssh/id_rsa /test.txt admin@___.___.___.___:/volume1/SQL_backup

That however results in shell asking me for the password (every time).

How come that I have to keep giving my pass?

1
  • What is the exact message/prompt you see when you are asked for a password? Do you get the same problem if you ssh to the NAS?
    – JigglyNaga
    Jun 26 '16 at 6:36
7

When troubleshooting problems with daemons, you should always check the system logs.
In this particular case, if you check your system logs on the NAS host, you'll see something similar to:

Authentication refused: bad ownership or modes for directory /home/admin

The problem is shown in this output:

admin@NAS:~$ ls -alh
drwxrwxrwx  6 admin users 4.0K Jun 26 07:28 .

For security, SSH will refuse to use the authorized_keys file if any ancestor of the ~/.ssh directory is writable by someone other than the user or root (ancestor meaning /home/user/.ssh, /home/user, /home, /). This is because another user could replace the ~/.ssh directory (or ~/.ssh/authorized_keys file) with their own, and then ssh into your user.

To fix, change the permissions on the directory with something like:

chmod 755 ~
4
  • 1
    well spotted! I see the permission there in the listing.
    – Jasen
    Jun 26 '16 at 6:49
  • parent of ~ should probably also be not-writable,
    – Jasen
    Jun 26 '16 at 6:49
  • correct. Updated answer to be more technically accurate.
    – phemmer
    Jun 26 '16 at 6:52
  • Awesome! It was both AnilV's answer and yours that helped me. I changed the permissions and got away of the -i identifier and got it working. Thanks for the afford guys!
    – LinkinTED
    Jun 26 '16 at 9:44
3

Any chance you created a password for your private key while creating it using ssh-keygen.

Following is the workflow I use:

  1. ssh-keygen
  2. ssh-copy-id root@remote_host
  3. scp /test.text root@remote_host:/opt/application/
4
  • By password you mean passphrase? Then no. You don't use the -i option? I'll give it a try when I'm home
    – LinkinTED
    Jun 26 '16 at 5:58
  • You are right, passphrase.
    – AnilV
    Jun 26 '16 at 6:00
  • Awesome! It was both Patricks answer and yours that helped me. I changed the permissions and got away of the -i identifier and got it working. Thanks for the afford guys!
    – LinkinTED
    Jun 26 '16 at 9:44
  • @LinkinTED -i is optional. Having it won't cause ssh to not work.
    – phemmer
    Jun 26 '16 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.