0

I know this is a basic question for many, but how would I set up a password-less login to an SSH server? According to the Ubuntu server guide, I would just import a key into my host machine, the one from which I am connecting, to the server where the key pair was generated. The opposite happened. I can SSH from the server (Ubuntu) I would like to connect to originally, to my host computer (macOS). Even then, I'm asked for a passphrase instead of a password. What's the point of that? I followed the instructions here:

https://help.ubuntu.com/community/SSH/OpenSSH/Keys

Didn't work. I'd appreciate any insight you could give as to why this isn't working.

Thanks

closed as too broad by Scott, Stephen Rauch, sebasth, Romeo Ninov, Archemar Oct 18 '17 at 10:33

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

You need to generate the key on your local machine and send the public key to the server. Instead, you set up your private key on your Ubuntu server and added your public key to your Mac.

First off, you're going to want to delete your server's SSH key from ~/.ssh/authorized_keys, because your server shouldn't be able to SSH into your own computer.

To generate a key, simply run ssh-keygen on your local computer. Unless you know what you're doing, you can simply keep all options as default. Be sure to enter a key passphrase - this will protect your SSH key from being stolen by encrypting it.

Sysadmin Tip: Use ssh-keygen -b 4096 to build a longer (and more secure!) key.

Once you have your keypair generated, you'll need to upload your public key to the server you want to connect to. If you accepted the default options, your public key will be at ~/.ssh/id_rsa.pub. Take the contents of this file and append it to ~/.ssh/authorized_keys on the server.

Sysadmin Tip: Do not, under any circumstances, give anyone or anything your private half of the key. It's called the private key for a reason.

If your server is properly configured, this will be enough to allow you to sign in using your SSH key. However, your server may not be configured properly. Ensure you have the following three lines in your server's /etc/ssh/sshd_config, and the lines are exactly as they appear here:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys

If these lines are not there, or they are not as they appear above, edit the file using nano or similar. Note that you will need admin (sudo) privileges to edit this file. If you did have to edit your config, you will need to restart your SSH service using sudo systemctl restart ssh.service.

Sysadmin Tip: To increase security, you can disable password authentication on your server by changing PasswordAuthentication line to no in /etc/ssh/sshd_config.

Depending on your server configuration, these steps may not be the most accurate. Contact your administrator if you have one. Instructions may be different depending on your platform or configuration -- also be sure to check any relevant documentation for your platform's alternatives to commands (e.g. PuttyGen instead of ssh-keygen on Windows).

If this still doesn't work, you'll have to start delving into logs. Connect to your server using ssh -vvv user@host, and look at the server SSH logs at /var/log/auth.log.

  • Hi. This is great advice. I went through all of the steps and it still asked me for a password when I opened an SSH session from the terminal. I'm the admin for this machine. It is meant to be a simple little home server to share files, nothing more. I can look at the logs, but I have really no idea what I am looking at or for. There are no failures that I can see, though the terminal is a poor log file viewer. – jrw Oct 18 '17 at 23:50
  • @jrw You are connecting from your Mac to your server, correct? ssh -vvv should reveal the authentication log on your end and show your system attempting to use your private key. This can give you a few hints. You can always post the log here and we can help. Of course, remove anything sensitive like IP addresses or usernames/passwords. – Kaz Wolfe Oct 18 '17 at 23:53
  • ssh -vvv just produces a usage prompt on either end of the connection (Mac or Ubuntu). I'd post the log but the answer dialog here indicates it is too long. – jrw Oct 19 '17 at 23:47
  • Well, more accurately, it reveals a debug log that says what the system is trying. e.g. what key it's trying to read and the server responses. – Kaz Wolfe Oct 19 '17 at 23:48
  • This is what it produces 1drv.ms/i/s!AlaL7g1deExIguUUfilAdLyQgroYpA – jrw Oct 20 '17 at 0:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.