Ubuntu core ask for password when using ssh keys

Question

Can someone tell my what is wrong when I try to login into my raspberry with SSH:

Debug info:

I have followed this guide ubuntu guide for ubuntu core and for ubuntu ssh keys. Can see on google that a lot of users have this issue.

Thanks, Nenad

nedad@Dragic-Home-I:~/.ssh$ ssh -vvv [email protected]
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "192.168.1.136" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 192.168.1.136 [192.168.1.136] port 22.
debug1: Connection established.
debug1: identity file /home/nedad/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/nedad/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/nedad/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/nedad/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/nedad/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/nedad/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/nedad/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/nedad/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.1.136:22 as 'nedad'
debug3: hostkeys_foreach: reading file "/home/nedad/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/nedad/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from 192.168.1.136
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0

Answer 1

You should be able to set the PreferredAuthentications key in your servers (Pi) /etc/sshd/ssh_config by adding the line

PreferredAuthentications publickey

and then restarting the ssh-daemon (sudo systemctl restart sshd) or just rebooting.

You could also try to log in with this option added to the ssh command and explicitly specifying the private keyfile (normally located at ~/.ssh/)

ssh -o PreferredAuthentications=publickey -i [path/to/your/key] [email protected]

Answer 2

As seen from the debug log there is an identity file /home/nedad/.ssh/id_ed25519-cert used for authentication. The log doesn't show that it is denied or accepted and have not finished messages. You should paste the complete log output to the question.

B.t.w., using a private keyfile for authentication like you do, it is normal that it is protected with a password to use it. This is not a password to authenticate against the ssh server. It is only a password to enable the key file to be used to authenticate against the ssh server. If you do not want to enter a password you can clear it on the keyfile with a security risk. Then everyone getting this keyfile is able to get into your ssh server.

You can clear the password on the keyfile with:

rpi ~$ ssh-keygen -p

This will then prompt you to enter the keyfile location, the old passphrase, and the new passphrase, which can be left blank to have no passphrase.

reference:
How do I remove the passphrase for the SSH key

Answer 3

It works fine when I create a key with PuTTYgen. So it works fine now.

Thans for yours help, Nenad

Answer 4

I'm updating this for others running into this issue that are not using Putty. In Putty you have to specify or load the key that you want to use. If you are connecting via the terminal then it will assume that you want to use id_rsa as the key since this is the default key. If you specified a name when you created the ssh key then you will need to specify this on connection. e.g:

ssh -i ubuntu-one_rsa user@ip-address