0

I'm trying to access my RPi 3 Model A+ from my mac (Mojave) through ssh. They're both connected to a 5GHz wifi.

From the mac terminal, I type the RPi ip address, then the default password raspberry , but cannot move forward because:

[email protected]'s password: Permission denied, please try again.

The troubleshoots I tried so far:

  • Connecting both of them to the 2.4GHz instead = still having the same problem.
  • From the RPi terminal, I accessed the /etc/ssh/sshd_config file and uncommented PasswordAuthentication Yes but again no luck.

Any idea of what's going wrong? Thanks in advance!

Here's the output of the ssh -v:

Last login: Thu Apr  2 16:05:14 on ttys000
CBs-MacBook-Pro:~ ceciliabianchini$ ssh -v [email protected]
OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Connecting to 192.168.0.11 [192.168.0.11] port 22.
debug1: Connection established.
debug1: identity file /Users/ceciliabianchini/.ssh/id_rsa type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_rsa-cert type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_dsa type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_dsa-cert type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_ecdsa type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_ecdsa-cert type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_ed25519 type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_ed25519-cert type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_xmss type -1
debug1: identity file /Users/ceciliabianchini/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.9p1 Raspbian-10+deb10u2
debug1: match: OpenSSH_7.9p1 Raspbian-10+deb10u2 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.0.11:22 as 'pi'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:3e5XiZCdd5PUNQIHcdvteGrEsEnq19VqV2rH4hgPf9A
debug1: Host '192.168.0.11' is known and matches the ECDSA host key.
debug1: Found key in /Users/ceciliabianchini/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: Will attempt key: /Users/ceciliabianchini/.ssh/id_rsa 
debug1: Will attempt key: /Users/ceciliabianchini/.ssh/id_dsa 
debug1: Will attempt key: /Users/ceciliabianchini/.ssh/id_ecdsa 
debug1: Will attempt key: /Users/ceciliabianchini/.ssh/id_ed25519 
debug1: Will attempt key: /Users/ceciliabianchini/.ssh/id_xmss 
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/ceciliabianchini/.ssh/id_rsa
debug1: Trying private key: /Users/ceciliabianchini/.ssh/id_dsa
debug1: Trying private key: /Users/ceciliabianchini/.ssh/id_ecdsa
debug1: Trying private key: /Users/ceciliabianchini/.ssh/id_ed25519
debug1: Trying private key: /Users/ceciliabianchini/.ssh/id_xmss
debug1: Next authentication method: password
[email protected]'s password:
Improve this question
3
  • Have you had another Pi or This Pi with an older image at this IP address before? The log is stating that it knows this pi Host '192.168.0.11' is known and matches the ECDSA host key. simplest way may be to edit the Macs known_hosts file with nano and remove line 1 - you will find this at /Users/ceciliabianchini/.ssh/known_hosts DO NOT use text edit in anything but text mode (nano is a lot simpler) and make a backup first :)
    – user115418
    Commented Apr 6, 2020 at 16:38
  • Hey, thanks so much for your help! :) Just tried this, but didn't work. It brings me back to the initial message where it says "The authenticity of host '192.168.0.8 (192.168.0.8)' can't be established." I have to type yes to continue. I do yes, then type the pwd, and again permission denied. You can see from above that the IP address changed with ".8" meanwhile. I also tried to remove this last one from the known_hosts but same output. I had another Pi which I burnt two weeks ago :S Maybe useful info? Thanks
    – cecilia
    Commented Apr 6, 2020 at 18:23
  • Changing the file would have had zero effect on the remotes IP address - are you sure you are getting the correct IP address? You may do better to use ssh [email protected] assuming you have not changed its name.
    – user115418
    Commented Apr 6, 2020 at 20:29

1 Answer 1

Reset to default
1

I ssh from my iMac to the Pi on a daily basis (although I long ago set private keys - so never use password).

macOS is quite properly objecting to a potential security breach.

This is fundamentally a macOS problem, but you can do a few things on the Pi to make it easier - and you should always do these anyway :-

  1. Set a new password on the Pi - it should object if you don't anyway.
  2. Give each Pi a unique hostname - this can be done in raspi-config

To explain the Mac stores the identity of the remote host (hostname and/or IP address) plus the public key of the host and checks this on each attempt. If you are using the same hostname on multiple Pi this triggers a security warning.

You can force the Mac to ignore with the following:-

ssh -o StrictHostKeyChecking=no [email protected]

This is OK for a test, but you should avoid overriding the security.

A couple of extra notes (which you probably don't want to know) - normally hosts have a unique key, but if you (like many Pi users) swap SD Cards between Pi this will also trigger a warning, because each Pi will have unique host keys.

I avoid all this malarky by setting public key pairs for the Pi and creating a ~/.ssh/config on the Mac like:-

Host 10.1.*.*
   StrictHostKeyChecking no
   UseKeychain yes
   BatchMode yes

Some consider this a security violation, but if you limit to private IP on your home network this is OK (unless you have a family of hackers)

Improve this answer
1
  • Amazing! I followed your steps (changed pwd and hostname) and it worked perfectly. Thanks also for all the explanation, very interesting indeed :)
    – cecilia
    Commented Apr 7, 2020 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.