I've locked myself out of SSH and my pi while trying to set up public keys

Question

I've tried to set up public keys so I didnt need to enter a password anymore and now I can't get into my pi any more…

What I did:

1. run ssh-keygen -t dsa on my Mac to create id_dsa in ~/.ssh on my mac
2. Made dir .ssh in home directory on my pi, and inside created a file authorized_keys
3. Copied the contents from id_dsa to authorized_keys
4. Changed permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys
5. Edited etc/ssh/sshd_config by changing #PasswordAuthentication yes to PasswordAuthentication no
6. sudo rebootto reboot the pi

Now each time I try to login from my mac I get: Permssion Denied (public key)

Any way to fix it?

Answer 1

You just published your private key on the Internet. This is not something you should do. (At least it was encrypted with your password. But still, a needless risk.)

You should have copied the contents of id_dsa.pub to authorized_keys, not the contents of id_dsa. The .pub extension indicates a public key that you're free to distribute wherever you want. The file id_dsa on the other hand, is your private key, and it shouldn't leave your computer.

Once you put your public key in the Pi's authorized_keys file, it will allow anyone who has the corresponding private key to log in.

Delete your existing id_dsa.pub and id_dsa files and start over. Do not use this key pair, since the private key is now compromised.

Answer 2

Theres really a couple of questions here

1. how to get back in?
   I don't think you can do this over the network. There are several possibilities for getting back in including booting the pi with keyboard/monitor/mouse attatched. Booting the pi with a serial console cable atached. Putting the SD card in a machine that can access the linux filesystems and editing the ssh config and so-on.

2. what went wrong?
   You copied the contents of id_dsa which is the private key. You needed to copy the public key (id_dsa.pub). You also disabled password auth before checking if key auth worked which is generally a bad idea.

BTW dsa is considered deprecated due to the 1024 bit key length limit and due to it's extreme sensitivity to bad random number generators. It is generally recommended to use rsa with a keylength of at least 2048 bit.