I'm completely at a loss as to what is preventing my local machine from authenticating the connection that is being forwarded from the remote server.

I've read a ton of the posts on here regarding this and man, I swear I've tried damn near everything.

The guide I've been following can be found here: http://www.zeespencer.com/articles/building-a-remote-pairing-setup/

Basically where I'm stuck at is in forcing passwordless authentication. If I allow passwords in sshd_config, when I connect to pair@pair-server I am prompted for my local user password and am able to login remotely, so I am being forwarded. But, as soon as I turn it off, I get the following

   λ   ssh pair@pair-server 
Permission denied (publickey).
Connection to pair-server closed.

Verbose output here: https://gist.github.com/anonymous/0c2b3892596d5ded6abb

I currently have my local user key.pub in pair@pair-server's .ssh/authorized_keys which are command directed to ssh back to localhost. pair@pair-server has it's own key, on my computer I've added pair@pair-server's key.pub to .ssh/authorized_keys.

Seemingly relevant lines in sshd_config:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys
PermitEmptyPasswords no
PasswordAuthentication no
UseLogin no

account and session settings in /etc/pam.d/sshd on pair-server:

account    required     pam_nologin.so
account    include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

password-auth configuration:

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

.ssh permissions:

   λ   ls -lhd .ssh
drwx------ 2 dan dan 4.0K Jul 10 19:49 .ssh


   λ   lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 13.04
Release:    13.04
Codename:   raring

OpenSSH Client Version:

   λ   ssh -V
OpenSSH_6.1p1 Debian-4, OpenSSL 1.0.1c 10 May 2012

2 Answers 2


Are your permissions OK? .ssh must be 700.

  • Yep, added .ssh's permissions to my question. All files inside of .ssh are 600 as well. Jul 12, 2013 at 15:39

Thanks for trying to help everyone, really appreciate it. Anyways, it seems ssh-agent was the culprit. I forgot I have to check if there is previously spawned instances of it already running before spawning my own. I had something like 9 of them running. I don't know much bash, but here where the 3 lines I added to my .bashrc on the remote server that got it working:

pkill ssh-agent
exec "$(ssh-agent)"
ssh-add $HOME/.ssh/pair_key

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.