SSH is not authenticating by SSH key

Question

I cannot login to my server by SSH keys.

I copied public key name.pub to my server using ssh-copy-id. If I then run ssh -i name.key root@server, I have to insert the server's password instead of being authenticated by key.

The output of running debug mode sshd on a custom port is here.

I have checked several questions (removed because this is marked as spam) where the accepted answer was about rights issues, but I don't think I have such issue. My desktop does not complain about keys being too open, and the .ssh folder and authorized_keys on the server have rights 700 and 600 respectively.

One final remark is that the keys are generated with ssh-keygen -m pem, and the public key is changed to PEM format using ssh-keygen -f name.key -e -m pem > name.pub

Why is it not possible for SSH to authorize me by SSH key, and how can I resolve this?

Answer 1

It seems that me using ssh-keygen -f name.key -e -m pem > name.pub to convert the public key to PEM format caused the issue. Leaving the public key in the default format of ssh-keygen does allow me to authenticate by key successfully.

Answer 2

If I then run ssh -i name.key root@server, I have to insert the server's password

My guess at what is happening here is that the key authentication for some reason does not work, and that the password prompt you see is simply a fallback.

You can force ssh to use your key by running something like:

ssh -vv -o "IdentitiesOnly=yes" -i <private key filename> <hostname>

In this case -vv will also give you debug output, which should hopefully tell you why the key authentication fails.

It's possible that you want to try PasswordAuthentication=no instead of the IdentitiesOnly attribute above as well to disable password authentication as an option client-side.

When you have confirmed that key authentication works, you probably want to disable the possibility to authenticate with a password completely. This can be done globally by setting PasswordAuthentication no in /etc/ssh/sshd_config. Note that you should not do this before you've confirmed key-based authentication works, since that might lock you out of the server, if you have no other means of accessing it (like a virtual console, for example).

One common reason for the issue you're seeing is that you're attempting to authenticate against the wrong user. For example, Ubuntu systems will normally add any SSH keys added as a part of a cloud provision to the ubuntu user but not root, so make sure that it's actually root that has your public key in their authorized_keys file.