I've been using linux for a number of years, yet I'm at a loss to as why this won't work correctly. All permissions to me appear correctly but I must be missing something obvious somewhere.
I can login via password normally, and falling back to password also works.
Log from the server:
pi@raspberrypi ~ $ tail -f /var/log/auth.log Aug 17 14:39:47 raspberrypi sshd[3725]: debug1: trying public key file /home/pi/.ssh/authorized_keys Aug 17 14:39:47 raspberrypi sshd[3725]: debug1: fd 4 clearing O_NONBLOCK Aug 17 14:39:47 raspberrypi sshd[3725]: debug1: restore_uid: 0/0 Aug 17 14:39:47 raspberrypi sshd[3725]: Failed publickey for pi from 192.168.1.12 port 42069 ssh2 Aug 17 14:40:44 raspberrypi sshd[3725]: Connection closed by 192.168.1.12 [preauth] Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: do_cleanup [preauth] Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: monitor_read_log: child log fd closed Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: do_cleanup Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: PAM: cleanup Aug 17 14:40:44 raspberrypi sshd[3725]: debug1: Killing privsep child 3728 Aug 17 14:42:22 raspberrypi sudo: pi : TTY=tty1 ; PWD=/home/pi ; USER=root ; COMMAND=/etc/init.d/ssh restart Aug 17 14:42:22 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0) Aug 17 14:42:23 raspberrypi sshd[3670]: Received signal 15; terminating. Aug 17 14:42:23 raspberrypi sshd[3758]: Set /proc/self/oom_score_adj from 0 to -1000 Aug 17 14:42:23 raspberrypi sshd[3758]: debug1: Bind to port 22 on 0.0.0.0. Aug 17 14:42:23 raspberrypi sshd[3758]: Server listening on 0.0.0.0 port 22. Aug 17 14:42:23 raspberrypi sshd[3758]: socket: Address family not supported by protocol Aug 17 14:42:23 raspberrypi sudo: pam_unix(sudo:session): session closed for user root Aug 17 14:44:46 raspberrypi sshd[3758]: debug1: Forked child 3783. Aug 17 14:44:46 raspberrypi sshd[3783]: Set /proc/self/oom_score_adj to 0 Aug 17 14:44:46 raspberrypi sshd[3783]: debug1: rexec start in 4 out 4 newsock 4 pipe 6 sock 7 Aug 17 14:44:46 raspberrypi sshd[3783]: debug1: inetd sockets after dupping: 3, 3 Aug 17 14:44:46 raspberrypi sshd[3783]: Connection from 192.168.1.12 port 42126 Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6p1-hpn14v4 Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: match: OpenSSH_6.6p1-hpn14v4 pat OpenSSH* Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Enabling compatibility mode for protocol 2.0 Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2 Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: permanently_set_uid: 101/65534 [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: list_hostkey_types: ssh-dss,ecdsa-sha2-nistp256 [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_KEXINIT sent [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_KEXINIT received [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: kex: client->server aes128-ctr hmac-md5 none [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: kex: server->client aes128-ctr hmac-md5 none [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_NEWKEYS sent [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: expecting SSH2_MSG_NEWKEYS [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: SSH2_MSG_NEWKEYS received [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: KEX done [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: userauth-request for user pi service ssh-connection method none [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: attempt 0 failures 0 [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: PAM: initializing for "pi" Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: PAM: setting PAM_RHOST to "192.168.1.12" Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: PAM: setting PAM_TTY to "ssh" Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: userauth-request for user pi service ssh-connection method publickey [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: attempt 1 failures 0 [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: test whether pkalg/pkblob are acceptable [preauth] Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: temporarily_use_uid: 1000/1000 (e=0/0) Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: trying public key file /home/pi/.ssh/authorized_keys Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: fd 4 clearing O_NONBLOCK Aug 17 14:44:47 raspberrypi sshd[3783]: debug1: restore_uid: 0/0 Aug 17 14:44:47 raspberrypi sshd[3783]: Failed publickey for pi from 192.168.1.12 port 42126 ssh2
Log from the client:
tim@MushaV3 ~ $ ssh raspi -v OpenSSH_6.6, OpenSSL 1.0.1i 6 Aug 2014 debug1: Reading configuration data /home/tim/.ssh/config debug1: /home/tim/.ssh/config line 29: Applying options for raspi debug1: Reading configuration data /etc/ssh/ssh_config debug1: Hostname has changed; re-reading configuration debug1: Reading configuration data /home/tim/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: Connecting to 192.168.1.47 [192.168.1.47] port 22. debug1: Connection established. debug1: identity file /home/tim/.ssh/id_rsa type 1 debug1: identity file /home/tim/.ssh/id_rsa-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6p1-hpn14v4 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4+deb7u2 debug1: Remote is NON-HPN aware debug1: match: OpenSSH_6.0p1 Debian-4+deb7u2 pat OpenSSH* compat 0x14000000 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: AUTH STATE IS 0 debug1: REQUESTED ENC.NAME is 'aes128-ctr' debug1: kex: server->client aes128-ctr hmac-md5 none debug1: REQUESTED ENC.NAME is 'aes128-ctr' debug1: kex: client->server aes128-ctr hmac-md5 none debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA 62:72:a3:8f:fb:c7:58:45:5b:b9:67:5a:ac:81:4f:be debug1: Host '192.168.1.47' is known and matches the ECDSA host key. debug1: Found key in /home/tim/.ssh/known_hosts:31 debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/tim/.ssh/id_rsa debug1: Authentications that can continue: publickey,password debug1: Next authentication method: password [email protected]'s password:
Client file permissions:
tim@MushaV3 ~ $ ls -lah ./.ssh/ total 48K drwx------ 2 tim tim 4.0K Aug 17 15:35 . drwxr-xr-x 77 tim tim 4.0K Aug 16 11:41 .. -rw------- 1 tim tim 1.7K Mar 23 2013 amazonkey.pem -rw------- 1 tim tim 1.6K Oct 20 2013 authorized_keys -rw-r--r-- 1 tim tim 415 Aug 17 15:31 config -rw------- 1 tim tim 1.7K Jun 26 00:30 id_OVH -rw-r--r-- 1 tim tim 393 Jun 26 00:30 id_OVH.pub -rw------- 1 tim tim 1.7K Aug 27 2011 id_rsa -rw-r--r-- 1 tim tim 393 Aug 27 2011 id_rsa.pub -rw-r--r-- 1 tim tim 8.6K Aug 17 15:00 known_hosts
Server file permissions:
pi@raspberrypi ~ $ ls -lah ./.ssh/ total 16K drwxr-xr-x 2 pi pi 4.0K Aug 17 14:13 . drwxr-xr-x 5 pi pi 4.0K Aug 17 14:00 .. -rw-r--r-- 1 pi pi 393 Aug 17 14:00 authorized_keys -rw-r--r-- 1 pi pi 444 Aug 17 14:27 known_hosts
pi@raspberrypi ~ $ ls -lah /etc/ssh/ total 180K drwxr-xr-x 2 root root 4.0K Aug 17 14:22 . drwxr-xr-x 99 root root 4.0K Aug 17 13:59 .. -rw------- 1 root root 133K Feb 19 2013 moduli -rw-r--r-- 1 root root 1.7K Feb 19 2013 ssh_config -rw-r--r-- 1 root root 2.5K Aug 17 14:38 sshd_config -rw-r--r-- 1 root root 2.5K Aug 17 14:11 sshd_config.save -rw------- 1 root root 668 Aug 17 14:19 ssh_host_dsa_key -rw-r--r-- 1 root root 606 Aug 17 14:19 ssh_host_dsa_key.pub -rw------- 1 root root 227 Jan 7 2014 ssh_host_ecdsa_key -rw-r--r-- 1 root root 178 Jan 7 2014 ssh_host_ecdsa_key.pub -rw------- 1 root root 981 Aug 17 14:18 ssh_host_rsa_key -rw-r--r-- 1 root root 646 Aug 17 14:18 ssh_host_rsa_key.pub
Server config file
pi@raspberrypi ~ $ cat /etc/ssh/sshd_config # Package generated configuration file # See the sshd_config(5) manpage for details # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768 # Logging SyslogFacility AUTH LogLevel DEBUG # Authentication: LoginGraceTime 120 PermitRootLogin no # StrictModes yes RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Change to no to disable tunnelled clear text passwords PasswordAuthentication yes # Kerberos options KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 #Banner /etc/issue.net # Allow client to pass locale environment variables AcceptEnv LANG LC_* # Subsystem sftp /usr/lib/openssh/sftp-server # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM yes
