0

I was able to SSH into this remote server using password authentication before. I wanted to change that to make it use private/public key pairs instead. I followed the necessary steps by generating a key pair, editing the /etc/ssh/sshd_config file to enable RSA and Pubkey authentication, and disable password authentication:

RSAAuthentication yes PubkeyAuthentication yes PasswordAuthentication no

The problem is that I (mistakenly) moved the authorized_keys file out of the ~/.ssh/ folder in the remote host. Therefore, after exiting the remote host I can't SSH back in as it doesn't recognize my private key, giving me the following message: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Am I permanently locked out of the remote server now? Is there a way to specify the location of the authorized_keys file in the SSH command itself?

Improve this question
2
  • As a side note, there is (probably) no point in enabling RSAAuthentication yes. That only applies to ssh v1, which is long deprecated. If your sshd_config includes Protocol 2 rather than Protocol 2,1 or Protocol 1.2, you are not allowing ssh v1 anyway.
    – user4556274
    Commented Apr 22, 2019 at 16:32
  • I see, that explains why RSAAuthentication wasn't in sshd_config in the first place.
    – EH Khiari
    Commented Apr 23, 2019 at 16:06

1 Answer 1

Reset to default
3

No, you cannot specify an alternate location from your end of the connection. This is intentional and part of the security of ssh. The ssh server will not use certain files even when in the correct location if they have the wrong file permissions (i.e. ~/.ssh and many of the files that are stored therein.)

If you removed password authentication and restarted the ssh daemon/service, you will need to fix the problem with the authorized_keys file on the server locally, or change the configuration options back to allow password authentication and restart sshd.

Improve this answer
6
  • But how do I allow back password authentication, or fix the problem with authorized_keys, if I cannot ssh into the server in the first place?
    – EH Khiari
    Commented Apr 22, 2019 at 15:35
  • 1
    You will need to access the the server on the local console, or use another remote access method if available. This is a common pitfall for users learning to manage SSH; it's considered a 'right of passage' by some.
    – 0xSheepdog
    Commented Apr 22, 2019 at 15:38
  • What I suggest is you allow password authentication and test with ssh-keys until you are satisfied they work without problem; then turn off password authentication.
    – 0xSheepdog
    Commented Apr 22, 2019 at 15:48
  • That's what's on my mind, but I can't figure out how to get in the remote server without the keys working and with the password authentication disabled.
    – EH Khiari
    Commented Apr 22, 2019 at 16:01
  • Your first problem is accessing the physical server and changing the ssd_config changing it back to PasswordAuthentication yes and restarting the service. Once that is done and you can remotely ssh again, then you can fix the authorized_keys location and any other issues, verify the key works, etc. Once you know the ssh key works, THEN you can attempt to turn off password auth again.
    – 0xSheepdog
    Commented Apr 22, 2019 at 16:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .