So I went back and did some significant testing and revised my opinions about my problem a little.
First, here's a link to a thorough and quickly graspable diagram of the SSH Handshake (to get on the same page): SSH Keys Explained.
So I cleaned out the .ssh folders for the user and the root on each of the two Centos7 machine's I'm using - the controller is a VM and the server is metal.
Here are the SSHD_Config values of interest:
#Port22, Protocol 2, PermitRootLogin yes, #StrictModes yes, PubKeyAuthentication yes, AuthorizedKeysFile .ssh/authorized_keys, AllowUsers root me_meaning_me, PasswordAuthentication yes (only to allow ssh-copy-id operations to start), #PasswordAuthentication no, #ChallengeResponseAuthentication yes, ChallengeResponseAuthentication no, ClientAliveTime 120, ClientAliveCountMax 720 for tripleo openstack timeout UsePAM yes, GSSAPI yes
Begin: no files or folders in any ~/.ssh/ locations, me-user, root-user, local or server.
- ssh me@server - password accepted - final state: new server fingerprint in new local known_hosts.
- ssh-keygen me@server - no visible result - final state; id_rsa private, id_rsa.pub files in local ~/ssh/.
- ssh-copy-id me@server - no visible result - final state: rsa-shaw in server me's ~/.ssh/authorized_keys file named with 'me@server'.
- me@server can SSH into server but must provide the server-side password.
- ssh-keygen -f root-key root@server - no visible result - final state: root-key rsa private key and root-key.pub public key in local me's ~/.ssh/.
- ssh-copy-id -i ~/.ssh/root-key.pub root@server - some response about the key and root@server must provide the server-side password.
- edit server-side /etc/ssh/sshd_config - change to #PasswordAuthentication yes and PasswordAuthentication no.
- ssh me@server succeeds and no password is requested.
- ssh root@server fails with PublicKey, GSSAPI error.
- try many variations of values in sshd_config - but revert them all.
- use the k-v-m switch to log into server and inspect root's ~/.ssh/authorized_keys file - the single key in the file is identical to the key generated for me@server.
- the ssh-keygen -f root-key root@sever produced an identical key and added the 'me@server' identity.
- the ssh-copy-id -i root-key.pub root@server moved the key identical to me@server's key to the root's ~/.ssh/authorized_keys file.
Now, my original name for this issue was based on having gone through those steps several times over some hours, always with the same results.
so now what do we think?