I seem to be unable to set up a passwordless ssh connection to localhost, and I'm not sure why.

In ~/.ssh I have id_rsa, authorized_keys, id_rsa.pub and known_hosts

diff authorized_keys id_rsa

returns nothing

ls -al

gives

-rw------- 1 long long 1675 Jun 3 02:24 authorized_keys

-rw------- 1 long long 1675 Jun 3 02:23 id_rsa

-rw-r--r-- 1 long long 438 Jun 3 02:23 id_rsa.pub

-rw-r--r-- 1 long long 444 Jun 3 02:57 known_hosts

The permissions of the .ssh folder are

drwx------ 2 long long 4096 Jun 3 03:29 .ssh

The permissions of my home folder are

drwxr-xr-x 23 long long 4096 Jun 3 02:23 long

In /etc/ssh/sshd_config I changed PermitEmptyPasswords to "yes"

And finally, the verbose output of

ssh -v localhost

is

OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g 1 Mar 2016

debug1: Reading configuration data /home/long/.ssh/config

debug1: Reading configuration data /etc/ssh/ssh_config

debug1: /etc/ssh/ssh_config line 19: Applying options for *

debug1: Connecting to localhost [127.0.0.1] port 22.

debug1: Connection established.

debug1: identity file /home/long/.ssh/id_rsa type 1

debug1: key_load_public: No such file or directory

debug1: identity file /home/long/.ssh/id_rsa-cert type -1

debug1: Enabling compatibility mode for protocol 2.0

debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4

debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4

debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000

debug1: Authenticating to localhost:22 as 'long'

debug1: SSH2_MSG_KEXINIT sent

debug1: SSH2_MSG_KEXINIT received

debug1: kex: algorithm: curve25519-sha256@libssh.org

debug1: kex: host key algorithm: ecdsa-sha2-nistp256

debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: compression: none

debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: compression: none

debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

debug1: Server host key: ecdsa-sha2-nistp256 SHA256:XK9dVu0tdSA4YSbcifizhFhigKZU2LZl+W91Eesdimw

debug1: Host 'localhost' is known and matches the ECDSA host key.

debug1: Found key in /home/long/.ssh/known_hosts:2

debug1: rekey after 134217728 blocks

debug1: SSH2_MSG_NEWKEYS sent

debug1: expecting SSH2_MSG_NEWKEYS

debug1: rekey after 134217728 blocks

debug1: SSH2_MSG_NEWKEYS received

debug1: SSH2_MSG_EXT_INFO received

debug1: kex_input_ext_info: server-sig-algs=

debug1: SSH2_MSG_SERVICE_ACCEPT received

debug1: Authentications that can continue: publickey,password

debug1: Next authentication method: publickey

debug1: Offering RSA public key: /home/long/.ssh/id_rsa

debug1: Authentications that can continue: publickey,password

debug1: Offering RSA public key: long@long-MS-7885-Invalid-entry-length-16- Fixed-up-to-11

debug1: Authentications that can continue: publickey,password

debug1: Next authentication method: password

long@localhost's password:

Help would be greatly appreciated.

  • 4
    The authorized keys are public, not private. So diff authorized_keys id_rsa should not return nothing, though diff authorized_keys id_rsa.pub could reasonably be empty – Fox Jun 3 at 2:55

The PermitEmptyPasswords setting allows SSH to accept passwords which are blank, but that does not mean SSH won't prompt for a password:

PermitEmptyPasswords - When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings. The default is no. - man sshd_config

To allow logging in without a password you need to set up public key authentication. As mentioned by Fox, your output of the command diff authorized_keys id_rsa suggests you only have your private SSH key in your authorized_keys file; That file should not have any private keys. You can run cat ~/.ssh/id_rsa.pub > ~/.ssh/authorized_keys to replace that with your public key instead.

Then you can get rid of that blank password :)

  • This solved my problem. Thank you for your help! – Adu Zob Jun 3 at 20:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.