1

I was trying to set up publickey ssh connection to localhost with no password login on my WSL(Ubuntu 16).

But everytime I am keeping being asked to enter password. When I using port22, my password even not work, but when I using other port like 2222, at least my password would allow me to pass though, except the public key still not working.

Here is what I got when using: sudo ssh -v -p 22 localhost

    OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to localhost [127.0.0.1] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /home/hadoop/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/hadoop/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/hadoop/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/hadoop/.ssh/id_ecdsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.4        IBM11.1.4040.491
debug1: match: OpenSSH_5.4 IBM11.1.4040.491 pat OpenSSH_5* compat 0x0c000000
debug1: Authenticating to localhost:22 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: diffie-hellman-group-exchange-sha256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(2048<3072<8192) sent
debug1: got SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: got SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: ssh-rsa SHA256:jt2fTN1xeFtdB7ntfeQ5V8NnRxdDceejwwChS5hs3xw
debug1: Host 'localhost' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: password
debug1: Next authentication method: password
root@localhost's password:
debug1: Authentications that can continue: password
Permission denied, please try again.
root@localhost's password:
debug1: Authentications that can continue: password
Permission denied, please try again.
root@localhost's password:
debug1: Authentications that can continue: password
debug1: No more authentication methods to try.
root@localhost: Permission denied (password).

Here is the permission of all the files in ~/.ssh dir:

 -rw------- 1 hadoop hadoop  404 Feb  7 23:00 authorized_keys
-rw-r--r-- 1 hadoop hadoop 1675 Feb  7 22:58 id_rsa
-rw-r--r-- 1 hadoop hadoop  404 Feb  7 22:58 id_rsa.pub
-rw-r--r-- 1 hadoop hadoop 1552 Feb  8 12:38 known_hosts

Here is the permissions of the files in the /etc/ssh dir

    -rw------- 1 root root    404 Feb  8 01:42 authorized_keys
-rw-r--r-- 1 root root    404 Feb  8 01:55 id_rsa.pub
-rw-r--r-- 1 root root 553122 Mar  4  2019 moduli
-rw-r--r-- 1 root root   1617 Feb  8 13:27 ssh_config
-rw------- 1 root root    227 Feb  7 21:46 ssh_host_ecdsa_key
-rw-r--r-- 1 root root    182 Feb  7 21:46 ssh_host_ecdsa_key.pub
-rw------- 1 root root    411 Feb  7 21:46 ssh_host_ed25519_key
-rw-r--r-- 1 root root    102 Feb  7 21:46 ssh_host_ed25519_key.pub
-rw------- 1 root root   1679 Feb  7 21:46 ssh_host_rsa_key
-rw-r--r-- 1 root root    402 Feb  7 21:46 ssh_host_rsa_key.pub
-rw-r--r-- 1 root root    338 May 21  2019 ssh_import_id
-rw-r--r-- 1 root root   3282 Feb  8 13:33 sshd_config

Here is the content of sshd_config file

#       $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port 22
Protocol 2
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::1

HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key

#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
RekeyLimit default none

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:

LoginGraceTime 2m
PermitRootLogin without-password
AllowUsers hadoop isaac root
StrictModes yes
MaxAuthTries 6
MaxSessions 10

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
AuthorizedKeysFile      .ssh/authorized_keys .ssh/authorized_keys2

AuthorizedPrincipalsFile none

AuthorizedKeysCommand none
AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem       sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

Here is the content of ssh_config file

 # This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *

    #   ForwardAgent no
    #   ForwardX11 no
    #   ForwardX11Trusted yes
    #   PasswordAuthentication yes
    #   HostbasedAuthentication no
    #   GSSAPIAuthentication no
    #   GSSAPIDelegateCredentials no
    #   GSSAPIKeyExchange no
    #   GSSAPITrustDNS no
    #   BatchMode no
       CheckHostIP yes
       AddressFamily any
    #   ConnectTimeout 0
       StrictHostKeyChecking ask
       IdentityFile /home/hadoop/.ssh/id_rsa
    #   IdentityFile /home/hadoop/.ssh/id_dsa
       IdentityFile /home/hadoop/.ssh/id_ecdsa
    #   IdentityFile /home/hadoop/.ssh/id_ed25519
       Port 22
       Protocol 2
    #   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
    #   MACs hmac-md5,hmac-sha1,umac-64@openssh.com
    #   EscapeChar ~
    #   Tunnel no
    #   TunnelDevice any:any
    #   PermitLocalCommand no
    #   VisualHostKey no
    #   ProxyCommand ssh -q -W %h:%p gateway.example.com
    #   RekeyLimit 1G 1h
        SendEnv LANG LC_*
        HashKnownHosts yes
        GSSAPIAuthentication yes

Please give some suugestions.

1
debug1: Authentications that can continue: password

The immediate issue is that the SSH server that you connected to only accepts password authentication. It won't perform public key authentication, so your client doesn't try to authenticate with a key.

Public key authentication is normally controlled by the PubkeyAuthentication option in sshd_config. The sshd_config that that you posted has this set to "yes", which should cause it to accept public keys.

Your real problem might be this: Your ssh client identifies itself as version 7.6, and the date at the top of your sshd_config corresponds to OpenSSH version 7.5 or so. But the debug trace has this:

debug1: Remote protocol version 2.0, remote software version OpenSSH_5.4        IBM11.1.4040.491

The ssh server that you actually connected to identified itself as an copy of OpenSSH 5.4 with an IBM vendor tag. OpenSSH 5.4 is from 2010, and it doesn't normally identify itself with "IBM".

My guess is that the ssh server that you're connecting to isn't the normal sshd provided by Ubuntu, and it isn't configured using the sshd_config file that you posted. You're connecting to some vendor-specific version of OpenSSH which is configured in some other way. And it's currently configured not to permit pubkey authentication.

1
  • 1
    Great catch Kenster ! It turns out to be due to my previous installation of DB2 database server. After removing this, the ubuntu sshd server can work properly Feb 9 '20 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.