Login Raspberry Pi using SSH key pair does not work from Mac OSX Sierra

Question

I followed the instruction on Raspberry Pi website to generate SSH key pairs, towards the end of tutorial, it says once I have copied the id_rsa.pub key to the Pi's authorized_keys, it should use my public key next time I SSH into the Pi. However, on my Mac, it still asks for password when SSH to my Raspberry Pi. I have been looking for tutorial online, could not find any proper one that make it work using Mac's terminal. Could anyone please help me the set it up? Thank you.

Due to many people reported this question is unclear, let me clarify it by providing more details.

1. I did follow the tutorial on the Raspberry Pi for setting up passwordless SSH step by step. According to it, once the pub key has been copied over to RPi as authorized_keys, the RPi should automatically use it when I SSH to the RPi next time. However, it does not do it. How do I know? I have edited the sshd_config file to disable password login, enable the authorized_keys file location and tried SSH again, I got permission denied. By the way, I restarted the sshd service before trying SSH again.

2. After the first attempt, then I started searching on google, found another tutorial saying that I need to do the following: Open the sshd configuration file for editing with:

   sudo vi /etc/ssh/sshd_config

…and add to the end of the file:

UsePAM no
PermitRootLogin no
AllowUsers pi
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes

Tried, not working from Mac, however, it works on Windows PC using PuTTY, since PuTTY GUI allow you to specify where the private key is.

3. I have not tried generate the key without passphrase yet. I will do it tonight and find out.

Additional question, if I have known_hosts on the Mac before generating SSH key pairs, would it be a problem? Do I have to delete it before generating the keys? Thank you.

Answer 1

You are not alone in finding ssh keys less than entirely straightforward. Keep trying!

I met the exact same challenge a few days ago: coaxing a Mac into logging directly into an RPi without requiring password authentication. I followed the steps in the tutorial too, but not entirely cleanly, so some problems arose. In the end, the following worked (MacOX Sierra; latest Jessie Raspbian). On the Mac:

ssh-keygen -t rsa -C <my_email_address>
cat ~/.ssh/id_rsa.pub | ssh pi@<rpi_address> "mkdir -p ~/.ssh && cat >>  ~/.ssh/authorized_keys"

Leave the passphrase blank here.

On the RPi, edit /etc/ssh/sshd_config as root to uncomment out:

AuthorizedKeysFile      %h/.ssh/authorized_keys

I'm not entirely sure is this is necessary, but it seems it should be.

Then, finally, on the RPi:

restart sshd service /etc/init.d/ssh restart

or reboot (but what are we, Windows users?)

Answer 2

From what we know

• sshd is working (able to login with password)
• sshd is accepting public keys (able to login via putty)

Tried, not working from Mac, however, it works on Windows PC using PuTTY, since PuTTY GUI allow you to specify where the private key is.

There are two distinct possibilities I see here

• ssh on OSX generated incompatible keys, sometimes public keys need to be converted
  1. execute ssh -v pi@raspberry to see the key exchange details in verbose mode
  2. ssh -v -v gives you even more information
  3. TBD (wait for you to post log)
• ssh on OSX looks somewhere else for default keys.
  1. You may specify the key with ssh -i ~/.ssh/id_rsa pi@raspberry

I have not tried generate the key without passphrase yet. I will do it tonight and find out.

It should not matter

Additional question, if I have known_hosts on the Mac before generating SSH key pairs, would it be a problem? Do I have to delete it before generating the keys? Thank you.

No, there is no reason to. known_hosts is used by ssh to track all computers you have ever logged in to, that way if the key of the remote server changes, ssh will complain that someone is trying to intercept your communication.

There is at least one circumstance where it may be necessary, often on LAN you get a dynamic IP that changes day to day, if you have two pis 192.168.1.100 and 192.168.1.101 and then tomorrow they switch places, your laptop will complain that the key for 192.168.1.100 has changed, even though it has simply moved. In this case you may simply delete the offending line in known_hosts.

It would also be necessary after a clean reinstall of the raspberry pi/remote server (sshd generates new keys during system install)

Answer 3

With High Sierra and (I think) Sierra there is a simpler way:

    ssh-copy-id [email protected]

I use this all the time with newly flashed Raspberry Pi devices, and never had any problem. Apart from enabling SSH there is nothing to do on the Raspberry Pi for this to work. The command essentially copies the public key to the Raspberry Pi. You have to enter the password for the "pi" user before the key is accepted. Afterwards, "ssh [email protected]" will log in without asking for a password.

Of course this also works for other users, not only "pi". Usually I ssh first using the default password. Then I add a new user on the Pi with a safe password. Last, I disable the "pi" user. Ctrl-D brings me back to the Mac. Then I do the above "ssh-copy-id" with the new user (not "pi"), and then I am done.

By the way: I quite often do delete the known_hosts file on the Mac, because I can't be bothered editing the file if I re-use a Raspberry Pi with a new SD card.