So I went back and did some significant testing and revised my opinions about my problem a little.
First, here's a link to a thorough and quickly graspable diagram of the SSH Handshake (to get on the same page): SSH Keys Explained.
So I cleaned out the .ssh folders for the user and the root on each of the two Centos7 machine's I'm using - the controller is a VM and the server is metal.
Here are the SSHD_Config values of interest:
#Port22, Protocol 2, PermitRootLogin yes, #StrictModes yes, PubKeyAuthentication yes, AuthorizedKeysFile .ssh/authorized_keys, AllowUsers root me_meaning_me, PasswordAuthentication yes (only to allow ssh-copy-id operations to start), #PasswordAuthentication no, #ChallengeResponseAuthentication yes, ChallengeResponseAuthentication no, ClientAliveTime 120, ClientAliveCountMax 720 for tripleo openstack timeout UsePAM yes, GSSAPI yes
Begin: no files or folders in any ~/.ssh/ locations, me-user, root-user, local or server.
ssh me@server- password accepted - final state: new server fingerprint in new local known_hosts.
ssh-keygen me@server- no visible result - final state; id_rsa private, id_rsa.pub files in local
ssh-copy-id me@server- no visible result - final state:
rsa-shawin server me's
~/.ssh/authorized_keysfile named with
me@servercan SSH into server but must provide the server-side password.
ssh-keygen -f root-key root@server- no visible result - final state: root-key rsa private key and root-key.pub public key in local me's
ssh-copy-id -i ~/.ssh/root-key.pub root@server- some response about the key and root@server must provide the server-side password.
- edit server-side
/etc/ssh/sshd_config- change to
ssh me@serversucceeds and no password is requested.
ssh root@serverfails with PublicKey, GSSAPI error.
- Tried many variations of values in
sshd_config- but revert them all.
- Used the k-v-m switch to log into server and inspected root's
~/.ssh/authorized_keysfile - the single key in the file is identical to the key generated for me@server.
ssh-keygen -f root-key root@severproduced an identical key and added the
ssh-copy-id -i root-key.pub root@servermoved the key identical to me@server's key to the root's
Now, my original name for this issue was based on having gone through those steps several times over some hours, always with the same results.
So now what do we think?