0

After I create a new user (newuser) in a EC2 machine (ubuntu), add the authorized_key and try to ssh into it, it doesn't work. Now thats all fine and dandy if it fails, but it actually succeed into login with the old user even if -l or user@ is set in the command.

How is it possible that the sshd is ignoring the user and falling back for a previous login? No mather what I try, short of removing the key from the other user and restarting the ssh server its not possible to login as the new user.

➜  ~ ssh -l newuser thehost
Last login: Thu Nov  2 10:09:08 2017 from 5.x.x.x
ubuntu@ip-172-x-x-x:~$ whoami
ubuntu
➜  ~ ssh newuser@thehost
Last login: Thu Nov  2 10:11:17 2017 from 5.x.x.x
ubuntu@ip-172-x-x-x:~$ whoami
ubuntu

I speculate that it has something to do with ssh agent or using the keys, but this is terribly confusing to understand and i've never crossed with this before this last two weeks, so I don't know if its a new feature or what.

edit: It seems that it might have something to do with PAM authentication and some caching of the key, since it fully ignores the username. You can type invalid users or anything and it will still login successfully.

1

SSH will try all the keys in the ~/.ssh/authorized_keys file until it either finds one that matches or fails to authenticate. Once public key auth fails, it will try the next authentication method if there is one.

So, if you have the old public key placed first in the remote host's ~/.ssh/authorized_keys file, the old key will be the first key found.

On the local host side, the ssh agent comes into play. Private keys will be added to the cached ssh agent and those keys will be tried until one matches the remote host's public key.

  • the ~ part of that path is important, two different users with two different authorized_keys files containing the same key, you can ssh with any string as username, but ssh will log you into one of the users with the key, disregarding what you type. So you basically cannot login with different users using the same key, basically. – guax Nov 2 '17 at 13:26
  • @guax: My experience may be a bit different because I add my private keys to the ssh-agent via ssh-add and/or via GPG's ~/.gnupg/sshcontrol/ file and associated agent. I have had no trouble using the same set of keys in many locations and even with different users on the same remote host. – RubberStamp Nov 2 '17 at 13:46
  • @RubberStamp you're correct. It would not make sense for sshd to scan all users' authorized key files. – Michael - sqlbot Nov 2 '17 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.