1

I followed the instruction on Raspberry Pi website to generate SSH key pairs, towards the end of tutorial, it says once I have copied the id_rsa.pub key to the Pi's authorized_keys, it should use my public key next time I SSH into the Pi. However, on my Mac, it still asks for password when SSH to my Raspberry Pi. I have been looking for tutorial online, could not find any proper one that make it work using Mac's terminal. Could anyone please help me the set it up? Thank you.

Due to many people reported this question is unclear, let me clarify it by providing more details.

  1. I did follow the tutorial on the Raspberry Pi for setting up passwordless SSH step by step. According to it, once the pub key has been copied over to RPi as authorized_keys, the RPi should automatically use it when I SSH to the RPi next time. However, it does not do it. How do I know? I have edited the sshd_config file to disable password login, enable the authorized_keys file location and tried SSH again, I got permission denied. By the way, I restarted the sshd service before trying SSH again.

  2. After the first attempt, then I started searching on google, found another tutorial saying that I need to do the following: Open the sshd configuration file for editing with:

    sudo vi /etc/ssh/sshd_config

…and add to the end of the file:

UsePAM no
PermitRootLogin no
AllowUsers pi
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes

Tried, not working from Mac, however, it works on Windows PC using PuTTY, since PuTTY GUI allow you to specify where the private key is.

  1. I have not tried generate the key without passphrase yet. I will do it tonight and find out.

Additional question, if I have known_hosts on the Mac before generating SSH key pairs, would it be a problem? Do I have to delete it before generating the keys? Thank you.

  • 2
    Post the output of ssh -v pi@raspberry_ip, check if public key authentication is enabled on the raspberry, the configuration is inside /etc/ssh/sshd_config. PublicKeyAuthentication shouldn't be commented and set to yes. – Matteo Aug 1 '17 at 10:14
  • 2
    Did you enter a passphrase when generating the key? NOTE when asking questions it is better to list what YOU actually did rather than link to a tutorial. – Milliways Aug 2 '17 at 0:56
  • Is it requesting password for User (login) - user@example.com's password: or is it requesting password for Key - Enter password for key '/home/user/.ssh/id_rsa . Your question is unclear about which you are trying to eliminate – crasic Aug 3 '17 at 2:56
  • Hi @crasic, it is actually requesting user@example.com's password:, this is why I know it is not working. I would like to use the key pair to access the Pi, not username@PI.LOCAL.IP.ADDRESS. Hopefully, this clears my question. It is ok if the Pi asks for passphrase, at least I know no one else could login without the private key on their PC. – Gengjun Wu Aug 4 '17 at 2:16
  • 1
    If it doesn't help, please execute ssh in verbose mode and post the output. ssh -v -i ~/.ssh/id_rsa pi@raspberry it will indicate if there is a key match error or something else. – crasic Aug 4 '17 at 15:54
1

You are not alone in finding ssh keys less than entirely straightforward. Keep trying!

I met the exact same challenge a few days ago: coaxing a Mac into logging directly into an RPi without requiring password authentication. I followed the steps in the tutorial too, but not entirely cleanly, so some problems arose. In the end, the following worked (MacOX Sierra; latest Jessie Raspbian). On the Mac:

ssh-keygen -t rsa -C <my_email_address>
cat ~/.ssh/id_rsa.pub | ssh pi@<rpi_address> "mkdir -p ~/.ssh && cat >>  ~/.ssh/authorized_keys"

Leave the passphrase blank here.

On the RPi, edit /etc/ssh/sshd_config as root to uncomment out:

AuthorizedKeysFile      %h/.ssh/authorized_keys

I'm not entirely sure is this is necessary, but it seems it should be.

Then, finally, on the RPi:

restart sshd service /etc/init.d/ssh restart

or reboot (but what are we, Windows users?)

  • 1
    sshd can be very picky about permissions, and requires ~/.ssh/ be rwx------ aka 700 unless StrictModes no is set in `/etc/ssh/sshd_config – crasic Aug 3 '17 at 3:03
  • Hi Colin, thank you for your instruction, I will try your steps later and find out if it works or not. I was expecting even if you set the passphrase, it should ask "enter the passphrase" rather than "enter the password", as I mentioned in my question ( I have edited it), after I disable password login, RPi does not allow me to connect anymore, this is how I know the keys don't work. – Gengjun Wu Aug 3 '17 at 21:36
0

From what we know

  • sshd is working (able to login with password)
  • sshd is accepting public keys (able to login via putty)

Tried, not working from Mac, however, it works on Windows PC using PuTTY, since PuTTY GUI allow you to specify where the private key is.

There are two distinct possibilities I see here

  • ssh on OSX generated incompatible keys, sometimes public keys need to be converted
    1. execute ssh -v pi@raspberry to see the key exchange details in verbose mode
    2. ssh -v -v gives you even more information
    3. TBD (wait for you to post log)
  • ssh on OSX looks somewhere else for default keys.
    1. You may specify the key with ssh -i ~/.ssh/id_rsa pi@raspberry

I have not tried generate the key without passphrase yet. I will do it tonight and find out.

It should not matter

Additional question, if I have known_hosts on the Mac before generating SSH key pairs, would it be a problem? Do I have to delete it before generating the keys? Thank you.

No, there is no reason to. known_hosts is used by ssh to track all computers you have ever logged in to, that way if the key of the remote server changes, ssh will complain that someone is trying to intercept your communication.

There is at least one circumstance where it may be necessary, often on LAN you get a dynamic IP that changes day to day, if you have two pis 192.168.1.100 and 192.168.1.101 and then tomorrow they switch places, your laptop will complain that the key for 192.168.1.100 has changed, even though it has simply moved. In this case you may simply delete the offending line in known_hosts.

It would also be necessary after a clean reinstall of the raspberry pi/remote server (sshd generates new keys during system install)

0

With High Sierra and (I think) Sierra there is a simpler way:

    ssh-copy-id pi@raspberrypi.local

I use this all the time with newly flashed Raspberry Pi devices, and never had any problem. Apart from enabling SSH there is nothing to do on the Raspberry Pi for this to work. The command essentially copies the public key to the Raspberry Pi. You have to enter the password for the "pi" user before the key is accepted. Afterwards, "ssh pi@raspberrypi.local" will log in without asking for a password.

Of course this also works for other users, not only "pi". Usually I ssh first using the default password. Then I add a new user on the Pi with a safe password. Last, I disable the "pi" user. Ctrl-D brings me back to the Mac. Then I do the above "ssh-copy-id" with the new user (not "pi"), and then I am done.

By the way: I quite often do delete the known_hosts file on the Mac, because I can't be bothered editing the file if I re-use a Raspberry Pi with a new SD card.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.