1

I have two systems

  1. Personal MacOS Laptop to be referred as system-Laptop having user laptopuser. It does not have "NAT"

  2. Server Linux to be referred as system-Server having user serveruser having static IP anyone can connect to.

system-Server needs to send ssh commands to system-Laptop using a reverse SSH tunnel as the system-Laptop get dynamic IP and does not have "NAT"

Below is how I setup ssh-keys and reverse SSH

Step 1: Generated key pair for laptopuser on system-Laptop and copied the public key id_rsa.pub to self ~/.ssh/authorized_keys as well as on system-Server at <serveruserhomedir>/.ssh/authorized_keys

Step 2:

Generated key pair for serveruser on system-Server and copied the public key id_rsa.pub to self ~/.ssh/authorized_keys as well as on system-Laptop at <laptopuserhomedir>/.ssh/authorized_keys

Note: Was able to successfully test this command on system-Laptop -> ssh serveruser@system-Server

Step 3:

Ran the below command on system-Laptop for reserve ssh tunnelling:

ssh -N -R 3322:localhost:22 serveruser@system-Server

Step 4:

Ran the below command to connect to my Laptop from Linux server:

ssh -p 3322 laptopuser@localhost

The issue is the above command prompts for the password and once I provide laptopuser password it works.

How can I get the above to work passwordless using ssh keys? Did I miss something? Doing this[reverse-ssh] for the very first time so unaware.

Below is the debug output of step 4 ssh command:

ssh -p 3322 laptopuser@localhost
.......
.......
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /home/serveruser/.ssh/id_rsa (0x56539b783370)
debug2: key: /home/serveruser/.ssh/id_dsa ((nil))
debug2: key: /home/serveruser/.ssh/id_ecdsa ((nil))
debug2: key: /home/serveruser/.ssh/id_ed25519 ((nil))
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/serveruser/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Trying private key: /home/serveruser/.ssh/id_dsa
debug3: no such identity: /home/serveruser/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /home/serveruser/.ssh/id_ecdsa
debug3: no such identity: /home/serveruser/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/serveruser/.ssh/id_ed25519
debug3: no such identity: /home/serveruser/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 60
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:


[serveruser@system-Server ~]$ ls -ltr /home/serveruser/.ssh/id_rsa
-rw------- 1 serveruser serveruser 3243 Jan 15 21:01 /home/serveruser/.ssh/id_rsa
1
  • If after providing password the connection worked, you set up the tunnel correctly. There must be however some problem with the keys. From your log it looks that the server and laptop did not agree on the first key sent by server (RSA one) and the server tried following keys (DSA and ECDSA), but they didn't exist, so it fell back to password authentication. Maybe your sshd configuration on laptop does not allow key-only login or does not allow RSA keys? You must check it.
    – raj
    Feb 10, 2021 at 16:47

1 Answer 1

1

Firstly, the easiest way to copy SSH keys is by using ssh-copy-id command. Do this for both users.

Secondly, to create a reverse tunnel, use the following command (executed on laptop):

ssh -fnN -R 3322:localhost:22 serveruser@system-server

Then lastly, connect to the tunneled service. No password will be asked if ssh-copy-id was completed earlier. Execute the following command on your system-server, to start a new SSH session from remote linux server to laptop.

ssh -p 3322 laptopuser@localhost
5
  • I don't think laptopuser needs to exist on system-Server. Why? If you are connecting via ssh to tunneled port the authentication should be done by the remote ssh daemon, not the local one.
    – raj
    Feb 10, 2021 at 16:34
  • ssh -fnN -L 3322:localhost:22 serveruser@system-server - where this command should be run? If it is run on the laptop, it tunnels the local port 3322 on laptop to port 22 on system-server. If it is run on server, it tunnels the local port 3322 on server to port 22 on the same server. The OP wanted to tunnel the port 3322 on server to port 22 on laptop.
    – raj
    Feb 10, 2021 at 16:37
  • I disagree with your comment Feb 10, 2021 at 16:39
  • And why exactly? Try running these commands and you'll see that they do exactly what I wrote. The OP set the tunnel correctly using -R, the issue is he must have messed up something with the keys...
    – raj
    Feb 10, 2021 at 16:42
  • Thanks for the correction. I have edited the answer. I mis-understood the question earlier. Feb 10, 2021 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.