SSH without a password not working (Public Key)

Question

Level 1

5 points

SSH without a password not working (Public Key)

Hi,

I am trying to setup some unattended backups to my server using an SSH public key, but everytime I try to SSH in I get prompted for my password. These are the steps I followed...

1. I created my the public key on my client system using the following command:

ssh-keygen -t dsa

I left the passphrase empty

2. I verified that my private and public key were created in ~.ssh
3. On my home directory on my server I created the folder .ssh and set the permissions to 0700, and the authorized_keys file with the permissions of 0600.
4. I next used the command

ssh remote_host "echo $(cat ~/.ssh/id_dsa.pub) >> ~/.ssh/authorized_keys"
5. I next verified that my key was added to authorized_keys file on the server.
6. then I try to ssh, but I am still asked for a password.

I have set this up many times on my Linux server without an issue. Is there something in the ssh_config file that I need to change on OS X Server 10.5.8?

Thanks!

Mac Pro, Mac OS X (10.5.8)

Posted on Sep 30, 2009 1:19 PM

Reply

Answer 1

ScottMSEM Author

Level 1

5 points

Sep 30, 2009 1:23 PM in response to ScottMSEM

One more thing...

Just so I am clear, I can ssh to the server normally. I just can't ssh with a public key.

Reply

Answer 2

jaydisc

Level 4

1,464 points

Sep 30, 2009 11:19 PM in response to ScottMSEM

Try running ssh with -vv to get more info about the publickey attempt, e.g.

ssh -vv user@host

Reply

Answer 3

ScottMSEM Author

Level 1

5 points

Oct 9, 2009 1:00 PM in response to jaydisc

I am still working on this one, and would love some input. I tried the ssh -vv command, and it appears that the key is just not being accepted. At I tried creating both a dsa key, and an rsa key, but neither worked. Here is some of the output of the -vv option...

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/sford/.ssh/identity
debug1: Offering public key: /Users/sford/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug1: Offering public key: /Users/sford/.ssh/id_dsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive
debug2: we did not send a packet, disable method
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input userauth_inforeq
debug2: input userauth_inforeq: num_prompts 1

Does anyone see anything that stands out?

Reply

Answer 4

foilpan

Level 4

1,385 points

Oct 9, 2009 1:12 PM in response to ScottMSEM

make sure the permissions are correct on your keys.

check here and elsewhere for examples. basically, your account should be the only one with access to the public key.

http://kimmo.suominen.com/docs/ssh/#chmod

Reply

Answer 5

ScottMSEM Author

Level 1

5 points

Oct 9, 2009 3:07 PM in response to foilpan

the permissions on my keys are set correctly. I am going to try editing the ssh_config file (i've already backed the original up), but does anyone know how to restart the sshd on OS X?

"service sshd restart" does not work (unrecognized command 'restart')

I am used to using sudo /etc/init.d/ssh restart

Reply

Answer 6

jaydisc

Level 4

1,464 points

Oct 9, 2009 3:35 PM in response to ScottMSEM

Editing config files is definitely hasty. This should work fine. It always has on all my OS X machines.

Firstly, can you please show us the output of this command on both the client and server:

cd ~;ls -al .ssh

Also, editing ssh_config will not do anything for sshd. Perhaps you meant sshd_config. If you really want to make changes to the client config (ssh_config), just add your directives in ~/.ssh/config. That's what I do. For example, I have the following in mine:

GSSAPIAuthentication yes
PreferredAuthentications gssapi-with-mic,publickey,password,keyboard-interactive

And if you want to restart sshd, you can uncheck/check the checkbox in System Preferences. If you don't have GUI access, I'm pretty sure this will also reload the config:

killall -HUP sshd

Reply

Answer 7

ScottMSEM Author

Level 1

5 points

Oct 9, 2009 3:43 PM in response to jaydisc

On my client system .ssh is..

drwx------ 5 sford staff 170 Oct 9 13:08 .ssh

On my user folder on my server .ssh is...

drwx------+ 3 sford admin 102 Oct 9 13:07 .ssh

Thanks for clarifying the sshd. I was making changes to ssh_config, but thought I needed to restart ssh to make the changes take effect.

I also have the directive GSSAPIAuthentication yes, but do not have PreferredAuthentications gssapi-with-mic,publickey,password,keyboard-interactive

Reply

Answer 8

jaydisc

Level 4

1,464 points

Oct 9, 2009 3:57 PM in response to ScottMSEM

Sorry, can you run those ls -al .ssh/ commands with a trailing slash. I'm more interested in the contents of those folders.

The only reason I had those two directives in my .ssh/config is because gssapi was not the highest priority and it was my preference to be so. Neither of those directives should help or hinder your current goal.

Reply

Answer 9

ScottMSEM Author

Level 1

5 points

Oct 9, 2009 4:01 PM in response to jaydisc

Here you go...

CLIENT

-rw------- 1 sford staff 736 Oct 9 12:09 id_dsa
-rw-r--r-- 1 sford staff 628 Oct 9 12:09 id_dsa.pub
-rw-r--r-- 1 sford staff 393 Oct 9 11:58 known_hosts

SERVER

drwx------+ 3 sford admin 102 Oct 9 13:07 .
drwxrwx-wx+ 22 sford admin 748 Oct 9 13:07 ..
-rw-r--r--+ 1 sford admin 0 Oct 9 13:07 authorized_keys

Reply

Answer 10

jaydisc

Level 4

1,464 points

Oct 9, 2009 4:11 PM in response to ScottMSEM

Looks like you got some ACLs on the server side. Can you add the -e flag and run again on the server:

ls -ale ~/.ssh/

If in fact I'm right, and you don't need them, you can remove all the ACLs with:

chmod -R -N ~/.ssh/

Then try again.

Reply

Answer 11

ScottMSEM Author

Level 1

5 points

Oct 9, 2009 4:13 PM in response to jaydisc

here is the info on the ACL

0: group:msem allow add file,delete,add_subdirectory,delete_child,writeattr,writeextattr,file_inherit,di rectoryinherit
-rw-r--r--+ 1 sford admin 0 Oct 9 13:07 authorized_keys
0: group:msem inherited allow write,delete,append,writeattr,writeextattr

Reply

Answer 12

jaydisc

Level 4

1,464 points

Oct 9, 2009 4:39 PM in response to ScottMSEM

I think I just found the problem. Your authorized_keys file on the server is 0 bytes.

Reply

Answer 13

ScottMSEM Author

Level 1

5 points

Oct 12, 2009 2:25 PM in response to jaydisc

First of all, thanks so much for continuing to work with me on this.

I realize that must have seemed like a great oversight on my part, but I did have my public key in the authorized_keys file for my tests. I had just removed it before I copied and pasted the info to show you. I just readded the public key, and tried unsuccessfully to connect. Is there anything else you can think of? Can you show me how you have your ssh_config file setup?

Reply

Answer 14

jaydisc

Level 4

1,464 points

Oct 13, 2009 8:55 PM in response to ScottMSEM

Again, the best thing to supply is the output of this from both servers:

ls -ale ~/.ssh/

DId you try stripping the ACL from ~/.ssh on the server?

My ~/.ssh/config file contains:

GSSAPIAuthentication yes
PreferredAuthentications gssapi-with-mic,publickey,password,keyboard-interactive

I have not modified /etc/ssh_config on the client or /etc/sshd_config

Have you by change modified anything in those files? Have you updated ssh? This should all work seamlessly on an OS X Install. Are you maybe running MacPorts or fink or something like that?

Lastly, watch /var/log/secure.log when you attempt to login. Any reporting should be there.

Reply

Answer 15

ScottMSEM Author

Level 1

5 points

Oct 16, 2009 11:21 AM in response to jaydisc

Obviously something has changed on the default configuration of OpenSSH. I installed OS X Server on VMWare Fusion on my laptop, and recreated my file server. I was able to setup SSH keys no problem. I opened up both my ssh_config, and my sshd_config files on both systems (file server, and vmware file server), and they are identical. I have removed all ACL's from the .ssh folder on my user folder on my file server, but problem still persists. The log files for secure.log show the failed attempts, but I can't figure out where the problem lies. I may just reinstall the OS, as it has been over a year.

I really appreciate you taking the time to work with me on this.

All the best!

Reply