3

I'm currently trying to get ssh-agent to work. No matter what I'm doing, I just can't get the around the password prompt.

For testing I even tried connecting to localhost:

  • ssh-keygen to generate the id_rsa
  • ssh-add id_rsa in the .ssh folder
  • ssh-add -l shows the correct fingerprint
  • ssh user@localhost still asks me for a password
  • eval $(ssh-agent -s) shows the process running

Is there something else I need to configure before using the ssh-agent? I tried it with several machines and users, as well as RSA and DSA keys.

I'm using Debian 7 btw.

I would appreciate if someone could give me a hint, where my problem might be.

|improve this question
  • 2
    Did you add the public key to ~user/.ssh/authorized_keys? – Barmar Feb 2 '17 at 21:23
  • On the host or remote machine? – KevKosDev Feb 2 '17 at 21:40
  • 1
    On the remote machine, of course. Do you understand how these files work? authorized_keys is the list of client keys that are allowed to login to the account, so it has to be on the server. – Barmar Feb 2 '17 at 21:45
  • But this makes the ssh-agent unnecessary right? – KevKosDev Feb 2 '17 at 22:00
  • 1
    They have nothing to do with each other. ssh-agent is how you save the password for the private key file on the local machine. authorized_keys tells the remote machine which private keys to allow to login. – Barmar Feb 2 '17 at 22:03
6

You generated a ssh key. That alone doesn't enable public key authentication, you also need to add the public key to the file ~/.ssh/authorized_keys on the remote machine, to the account you want to log to. The easy way to do that is with ssh-copy-id:

ssh-copy-id hostname

or 

ssh-copy-id username@hostname

if the username on the remote host is different from the one on the current machine. This will ask for your password on the remote machine.

|improve this answer
  • If i add my ssh key to the remote machines authorized_keys, what does the ssh-agent do? My understanding was, that the ssh-agent stores the remote machines password and fills the password prompt when needed. So no manipulation on the remote machine is necessary. – KevKosDev Feb 2 '17 at 21:38
  • 1
    ssh-agent holds in memory the key on the local machine. This makes a difference if you generated your key with a password: without ssh-agent you'll be asked for the key's password every time you run ssh, with ssh-agent you'll only be asked for said password on the first run in the current session. – Satō Katsura Feb 2 '17 at 21:44
  • What should happen if i use ssh-keygen without a password? I did this and yet i still have to type the ssh password on every connection attempt. Is this correct ? – KevKosDev Feb 2 '17 at 21:57
  • Nope. If your key doesn't have a password and you're still asked for one when you run ssh you haven't succeeded to enable public key authentication, and you're asked for your password on the remote machine (not the key's password). You can add option -v to ssh to find out if public key is used or not. Please note that you can't login without passwords with no manipulation on the remote machine (it would be a security problem if you could). – Satō Katsura Feb 2 '17 at 22:00
  • I will look into the -v option later, this could give me a hint whats going wrong. – KevKosDev Feb 2 '17 at 22:31
2

Do you have the correct permissions on the .ssh and .ssh/authorized_keys folder/file? Strict permissions may be required depending on your SSH server config. Also be sure ownership is correct.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.