Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I am trying to SSH to a new EC2 server from AWS by using Xshell, but got below error. Does it mean Public key in Client is not added into authorized_keys in Server side? How to verify which RCA for the error then give fixing?
[bastion-ro@ip-10-1-X-XX ~]$ ssh webuser@10.1.X.XX
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
[bastion-ro@ip-10-1-X-XX .ssh]$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.5 (Maipo)
Thanks for any advice.
You can't be sure about problem without checking server-side log. While running ssh -v you can only guess. If it would explicitly show what's wrong, it would make potentional attack easier, it would reveal important info for the attacker. An example below:
debug1: Host '192.168.1.1' is known and matches the ECDSA host key.
debug1: Found key in /home/jiri/.ssh/known_hosts:30
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /tmp/test RSA SHA256:vOJarZ7K6aLtlnPvQnzx1MxA/36iV4xkubPY4PhlEKA explicit
Client is trying to use ssh key in /tmp/test.
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /tmp/test RSA SHA256:vOJarZ7K6aLtlnPvQnzx1MxA/36iV4xkubPY4PhlEKA explicit
debug1: Authentications that can continue: publickey,keyboard-interactive
Server was not happy, it does not show debug1: Authentication succeeded (publickey).
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: No more authentication methods to try.
nonexistent@192.168.1.1: Permission denied (publickey,keyboard-interactive).
You cannot know if the user is wrong or the key is missing or a restriction on the key is applied which causes authentication failure. In above example, the user was not existent at all.
ssh -v (on client) you can't make appropriate root cause analysis.
ssh -vvv.