0

Trying to establish ssh connection between two ec2 instances. Copied Host A id_rsa.pub key to Host B's authorized_keys file

[root@ip-172-31-9-173 .ssh]# cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTTRSTwBClsq7/punxLQvq00Ba7iMZRbQKAQhC+GVuQFB2LfWk9Hsetu4CqHoGo4R4BJ/SW/4v+AfKlmQ/kA8WrQ12R0dR9cuhEbbnltMXSauwrsndIf4egJVzJs3BM12jXEx+E6wSlK8nUu3xpmY12WUkJOAWfWJ6rnE4XArIcmtNzfpJyZgFhNv2fKYRBTCgU0l4HLo2uIiQj8/aLT2gQeRUdARNn3QLBrITMN6rojo1vmWYnXhjWxeUoYVDj5+bsrqfbAtyzPm43WS+2RZ0T1Rr50+REl+jin0y108v04me7BluidN013oj+gLI73A86/qBgo08l5RwG2p+oOzf root@ip-172-31-9-173


[root@ip-172-31-11-205 .ssh]# cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTTRSTwBClsq7/punxLQvq00Ba7iMZRbQKAQhC+GVuQFB2LfWk9Hsetu4CqHoGo4R4BJ/SW/4v+AfKlmQ/kA8WrQ12R0dR9cuhEbbnltMXSauwrsndIf4egJVzJs3BM12jXEx+E6wSlK8nUu3xpmY12WUkJOAWfWJ6rnE4XArIcmtNzfpJyZgFhNv2fKYRBTCgU0l4HLo2uIiQj8/aLT2gQeRUdARNn3QLBrITMN6rojo1vmWYnXhjWxeUoYVDj5+bsrqfbAtyzPm43WS+2RZ0T1Rr50+REl+jin0y108v04me7BluidN013oj+gLI73A86/qBgo08l5RwG2p+oOzf root@ip-172-31-9-173

Error:

[root@ip-172-31-9-173 ~]# ssh root@172.31.11.205
Permission denied (publickey).

Not sure what is missing here.

1
  • Can you actually ssh by providing the username and password? If not, then if you can access the file ensure you have an AllowUsers entry in /etc/ssh/sshd_config and also that you are allowing SSH access to the subnet at the top of that file. if you do amend the sshd_config remember to restart the SSH service.
    – l0ckm4
    Aug 13 '18 at 12:32
0

You are missing the private key id_rsa in the machine initiating the connection to the 2nd machine.

Place it on /root/.ssh/id_rsa if doing it as root. Also do not forget that SSH is picky about rights, so you have to do:

chmod 700 /root/.ssh
chmod 600 /root/.ssh/id_rsa

On the long term, consider not working as root, and using a regular user.

1
  • It's not working with those permissions too. Aug 17 '18 at 7:54
0

Comment from @l0ckm4

Can you actually ssh by providing the username and password? If not, then if you can access the file ensure you have an AllowUsers entry in /etc/ssh/sshd_config and also that you are allowing SSH access to the subnet at the top of that file. if you do amend the sshd_config remember to restart the SSH service.


  1. Check in sshd_config if you have:

AllowUsers

DenyGroups

DenyUsers

set and if you are allowed to access the remote.


  1. Also it sometimes helps to reset this file known_hosts in then $HOME/.ssh directory:

cat /dev/null > $HOME/.ssh/known_hosts

  1. Check if denyhosts is installed and if it's blocked your IP address in the hosts file.

If you mange to blacklist your own IP address by attempting to log in via SSH with the wrong credentials multiple times, then you can connect to your service using the console (Connecting to your VPS using the console / VNC) and remove the block with following:

  • Stop denyhosts service (systemctl stop denyhosts or /etc/init.d/denyhosts stop)
  • Remove the line with the IP from /etc/hosts.deny
  • Remove the lines with the IP from /var/lib/denyhosts/hosts* files (note: not all files will contain the IP)
  • Remove the line with the IP from /var/lib/denyhosts/user-hosts
  • Remove the lines on the IPTABLES’ table
  • Start denyhosts service

  1. Check if you got the right port

If that's not the problem here are the step's to create key's and copy them to the remote:

Create the key on the local system:

ssh-keygen -o -b 4096 -t rsa -C somethingSomething@mail.com

OR:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/vps-cloud.web-server.key -C "My web-server key"

You will be prompted to supply a passphrase (password) for your private key. I suggest that you setup a passphrase when prompted.


  • -t rsa : Specifies the type of key to create. The possible values are “rsa1” for protocol version 1 and “dsa”, “ecdsa”, “ed25519”, or “rsa” for protocol version 2.
  • -b 4096 : Specifies the number of bits in the key to create
  • -f ~/.ssh/vps-cloud.web-server.key : Specifies the filename of the key file.
  • -C "somethingSomething@mail.com" : Set a new comment.

If you want to be able to access the server from your root account, do su and repeat the above command.

  1. $HOME/.ssh/id_rsa– contains your private key.
  2. $HOME/.ssh/id_rsa.pub – contains your public key.

Copy the key to remote:

ssh-copy-id USER@192.168.0.100

OR:

sh-copy-id -i $HOME/.ssh/id_rsa.pub user@SERVER.com

OR:

First create .ssh directory on the remote server

ssh USER@SERVER.com "umask 077; test -d .ssh || mkdir .ssh"

cat local id.rsa.pub file and pipe over ssh to append the public key in remote server

cat $HOME/.ssh/id_rsa.pub | ssh USER@SERVER.COM "cat >> .ssh/authorized_keys"

OR:

cat ~/.ssh/id_rsa.pub | ssh -p 22000 USER@192.168.1.215 "cat >> ~/.ssh/authorized_keys"

If you want to be able to only enter your key passphrase once each session then add this to your .bashrc file:

eval `ssh-agent`
ssh-add

then you will be asked for the passphrase on terminal/shell start and not again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.