1

I've tried to set up public keys so I didnt need to enter a password anymore and now I can't get into my pi any more…

What I did:

  1. run ssh-keygen -t dsa on my Mac to create id_dsa in ~/.ssh on my mac
  2. Made dir .ssh in home directory on my pi, and inside created a file authorized_keys
  3. Copied the contents from id_dsa to authorized_keys
  4. Changed permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys
  5. Edited etc/ssh/sshd_config by changing #PasswordAuthentication yes to PasswordAuthentication no
  6. sudo rebootto reboot the pi

Now each time I try to login from my mac I get: Permssion Denied (public key)

Any way to fix it?

  • I'd pop the SD card out and into my windows machine to re-edit etc/ssh/sshd_config. No need to remove the key because with it set to yes I believe you get a choice If no key is presented then you get a password prompt. – Tyson Aug 21 '14 at 17:28
  • @thibmaek the link is broken – Matt Jul 16 '18 at 20:52
  • @Matt haha yeah, i'm not going to repost my private SSH key I published by accident a few years ago :D – thibmaek Jul 18 '18 at 19:01
3

You just published your private key on the Internet. This is not something you should do. (At least it was encrypted with your password. But still, a needless risk.)

You should have copied the contents of id_dsa.pub to authorized_keys, not the contents of id_dsa. The .pub extension indicates a public key that you're free to distribute wherever you want. The file id_dsa on the other hand, is your private key, and it shouldn't leave your computer.

Once you put your public key in the Pi's authorized_keys file, it will allow anyone who has the corresponding private key to log in.

Delete your existing id_dsa.pub and id_dsa files and start over. Do not use this key pair, since the private key is now compromised.

  • I altered the key before I posted it here, just in case. And the raspi doesn't have access to the outside internet – thibmaek Aug 22 '14 at 7:20
1

Theres really a couple of questions here

  1. how to get back in?
    I don't think you can do this over the network. There are several possibilities for getting back in including booting the pi with keyboard/monitor/mouse attatched. Booting the pi with a serial console cable atached. Putting the SD card in a machine that can access the linux filesystems and editing the ssh config and so-on.

  2. what went wrong?
    You copied the contents of id_dsa which is the private key. You needed to copy the public key (id_dsa.pub). You also disabled password auth before checking if key auth worked which is generally a bad idea.

BTW dsa is considered deprecated due to the 1024 bit key length limit and due to it's extreme sensitivity to bad random number generators. It is generally recommended to use rsa with a keylength of at least 2048 bit.

  • This issue is already long resolved but thanks for the info! – thibmaek Oct 24 '15 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.