2

I've been using linux for a number of years, yet I'm at a loss to as why this won't work correctly. All permissions to me appear correctly but I must be missing something obvious somewhere.

I can login via password normally, and falling back to password also works.

Log from the server:

pi@raspberrypi ~ $ tail -f /var/log/auth.log
Aug 17 14:39:47 raspberrypi sshd[3725]: debug1: trying public key file /home/pi/.ssh/authorized_keys
Aug 17 14:39:47 raspberrypi sshd[3725]: debug1: fd 4 clearing O_NONBLOCK
Aug 17 14:39:47 raspberrypi sshd[3725]: debug1: restore_uid: 0/0
Aug 17 14:39:47 raspberrypi sshd[3725]: Failed publickey for pi from 192.168.1.12 port 42069 ssh2
Aug 17 14:40:44 raspberrypi sshd[3725]: Connection closed by 192.168.1.12 [preauth]
Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: do_cleanup [preauth]
Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: monitor_read_log: child log fd closed
Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: do_cleanup
Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: PAM: cleanup
Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: Killing privsep child 3728






Aug 17 14:42:22 raspberrypi sudo:       pi : TTY=tty1 ; PWD=/home/pi ; USER=root ; COMMAND=/etc/init.d/ssh restart
Aug 17 14:42:22 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Aug 17 14:42:23 raspberrypi sshd[3670]: Received signal 15; terminating.
Aug 17 14:42:23 raspberrypi sshd[3758]: Set /proc/self/oom_score_adj from 0 to -1000
Aug 17 14:42:23 raspberrypi sshd[3758]: debug1: Bind to port 22 on 0.0.0.0.
Aug 17 14:42:23 raspberrypi sshd[3758]: Server listening on 0.0.0.0 port 22.
Aug 17 14:42:23 raspberrypi sshd[3758]: socket: Address family not supported by protocol
Aug 17 14:42:23 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Aug 17 14:44:46 raspberrypi sshd[3758]: debug1: Forked child 3783.
Aug 17 14:44:46 raspberrypi sshd[3783]: Set /proc/self/oom_score_adj to 0
Aug 17 14:44:46 raspberrypi sshd[3783]: debug1: rexec start in 4 out 4 newsock 4 pipe 6 sock 7
Aug 17 14:44:46 raspberrypi sshd[3783]: debug1: inetd sockets after dupping: 3, 3
Aug 17 14:44:46 raspberrypi sshd[3783]: Connection from 192.168.1.12 port 42126
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6p1-hpn14v4
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: match: OpenSSH_6.6p1-hpn14v4 pat OpenSSH*
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Enabling compatibility mode for protocol 2.0
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: permanently_set_uid: 101/65534 [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: list_hostkey_types: ssh-dss,ecdsa-sha2-nistp256 [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_KEXINIT sent [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_KEXINIT received [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: kex: client->server aes128-ctr hmac-md5 none [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: kex: server->client aes128-ctr hmac-md5 none [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_NEWKEYS received [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: KEX done [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: userauth-request for user pi service ssh-connection method none [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: attempt 0 failures 0 [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: PAM: initializing for "pi"
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: PAM: setting PAM_RHOST to "192.168.1.12"
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: PAM: setting PAM_TTY to "ssh"
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: userauth-request for user pi service ssh-connection method publickey [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: attempt 1 failures 0 [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: test whether pkalg/pkblob are acceptable [preauth]
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: trying public key file /home/pi/.ssh/authorized_keys
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: fd 4 clearing O_NONBLOCK
Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: restore_uid: 0/0
Aug 17 14:44:47 raspberrypi sshd[3783]: Failed publickey for pi from 192.168.1.12 port 42126 ssh2

Log from the client:

tim@MushaV3 ~ $ ssh raspi -v
OpenSSH_6.6, OpenSSL 1.0.1i 6 Aug 2014
debug1: Reading configuration data /home/tim/.ssh/config
debug1: /home/tim/.ssh/config line 29: Applying options for raspi
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Hostname has changed; re-reading configuration
debug1: Reading configuration data /home/tim/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to 192.168.1.47 [192.168.1.47] port 22.
debug1: Connection established.
debug1: identity file /home/tim/.ssh/id_rsa type 1
debug1: identity file /home/tim/.ssh/id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6p1-hpn14v4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4+deb7u2
debug1: Remote is NON-HPN aware
debug1: match: OpenSSH_6.0p1 Debian-4+deb7u2 pat OpenSSH* compat 0x14000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 62:72:a3:8f:fb:c7:58:45:5b:b9:67:5a:ac:81:4f:be
debug1: Host '192.168.1.47' is known and matches the ECDSA host key.
debug1: Found key in /home/tim/.ssh/known_hosts:31
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/tim/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: password
pi@192.168.1.47's password: 

Client file permissions:

tim@MushaV3 ~ $ ls -lah ./.ssh/
total 48K
drwx------  2 tim tim 4.0K Aug 17 15:35 .
drwxr-xr-x 77 tim tim 4.0K Aug 16 11:41 ..
-rw-------  1 tim tim 1.7K Mar 23  2013 amazonkey.pem
-rw-------  1 tim tim 1.6K Oct 20  2013 authorized_keys
-rw-r--r--  1 tim tim  415 Aug 17 15:31 config
-rw-------  1 tim tim 1.7K Jun 26 00:30 id_OVH
-rw-r--r--  1 tim tim  393 Jun 26 00:30 id_OVH.pub
-rw-------  1 tim tim 1.7K Aug 27  2011 id_rsa
-rw-r--r--  1 tim tim  393 Aug 27  2011 id_rsa.pub
-rw-r--r--  1 tim tim 8.6K Aug 17 15:00 known_hosts

Server file permissions:

pi@raspberrypi ~ $ ls -lah ./.ssh/
total 16K
drwxr-xr-x 2 pi pi 4.0K Aug 17 14:13 .
drwxr-xr-x 5 pi pi 4.0K Aug 17 14:00 ..
-rw-r--r-- 1 pi pi  393 Aug 17 14:00 authorized_keys
-rw-r--r-- 1 pi pi  444 Aug 17 14:27 known_hosts
pi@raspberrypi ~ $ ls -lah /etc/ssh/
total 180K
drwxr-xr-x  2 root root 4.0K Aug 17 14:22 .
drwxr-xr-x 99 root root 4.0K Aug 17 13:59 ..
-rw-------  1 root root 133K Feb 19  2013 moduli
-rw-r--r--  1 root root 1.7K Feb 19  2013 ssh_config
-rw-r--r--  1 root root 2.5K Aug 17 14:38 sshd_config
-rw-r--r--  1 root root 2.5K Aug 17 14:11 sshd_config.save
-rw-------  1 root root  668 Aug 17 14:19 ssh_host_dsa_key
-rw-r--r--  1 root root  606 Aug 17 14:19 ssh_host_dsa_key.pub
-rw-------  1 root root  227 Jan  7  2014 ssh_host_ecdsa_key
-rw-r--r--  1 root root  178 Jan  7  2014 ssh_host_ecdsa_key.pub
-rw-------  1 root root  981 Aug 17 14:18 ssh_host_rsa_key
-rw-r--r--  1 root root  646 Aug 17 14:18 ssh_host_rsa_key.pub

Server config file

pi@raspberrypi ~ $ cat /etc/ssh/sshd_config
# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel DEBUG

# Authentication:
LoginGraceTime 120
PermitRootLogin no
# StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  .ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

# Kerberos options
KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
2

Whoops...

So ssh-copy-id didn't copy the correct key, and then told me it had copied all keys to the host.

Upon adding the correct key manually to authorized_keys it worked!.

BUG NOTICE If ssh-copy-id can't access the server, it'll report it's not copied any keys as they were already on the server.

  • ssh -v <other stuff> will give you verbose mode, and tell you where ssh fails... Before you go ransacking your logs next time. – j0h Aug 18 '14 at 11:23
  • ssh -v wasn't helping in the slightest, it told me it send the key and it was rejected. I rather stupidly presumed all the keys were copied to the server (because ssh-copy-id told me it had) and this is where the failure occured. – djsmiley2k Aug 21 '14 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.