Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Passwordless SCP file transfers between RaspberryPi and MacBook Pro.

All of the articles I have read on this subject say that this should be possible but I have yet to succeed. The process seems to be 1) create a pair of keys on my Pi, 2) transfer the public key to the Mac (.ssh/authorized_keys) and 3) adjust file permissions on the Mac. When I do this and try to transfer a file, the Mac still requests a password (at the PI) and if I provide this, the transfer occurs successfully. The same problem occurs with both SSH and SCP but I understand SCP uses SSH as the transfer mechanism so this doesn't surprise me. Any thoughts gratefully received.

MacBook Pro with Retina display, OS X Mavericks (10.9)

Posted on May 24, 2015 5:40 AM

Reply
5 replies

May 24, 2015 9:17 AM in response to mickf

Take the .pub file from the scp source system and put it in the .ssh/authorized_keys file of the destination account on the destination system.


The permissions on the source and destination account's home directory and .ssh files MUST be set correctly

Home directory drwxr-xr-x (or more restrictive)

.ssh directory drwx------

.ssh/id_rsa (or .ssh/id_des) -rw-------

.ssh/authorized_keys -rw-r--r-- (or more restrictive)

See "man ssh" for more details on permissions


If you are having connection problems look at destination system's sshd log information. On the Mac it would be in /var/log/system.log. I do NOT know what the log file would be on the Raspberry PI


Also on the source system us ssh -v -v -v destination.system.address

Between the sshd log and the ssh -v -v -v output you should be able to identify where ssh was having problems.


And yes, ssh is the foundation up which scp and sftp are built.

May 29, 2015 2:46 AM in response to BobHarris

Thank you for your response, Bob. Sorry about the delay in replying but I have a lot going on at the moment but I really do want to get to the bottom of this issue.

I have checked all of the items that you mention and as far as I can see all of the file permissions at both ends are correct. I have previously tried looking at the output of "SSH -v -v -v <Mac IP Address>" but am having trouble obtaining printed output so that I can study it "at leisure" (or copy it to someone else). On the Pi I tried redirecting the output os SSH (>>) and piping it (|) both to file and a printer but with no success. The basic syntax I used was:


SSH -v -v -v >> testtext1

and

SSH -v -v -v | lpr -P Canon_MP560


In the first case a file named testtext1 is created in my home directory but with no content.


I can't help thinking that my problems are due in part to ignorance of Linux (Unix) but any pointers would be welcome.


Mick F

May 29, 2015 7:58 AM in response to mickf

Use:

ssh -v -v -v 2>testtext1

That is to say, 2> filename so that you are redirecting standard error (file descriptor 2), not standard out (file descriptor 1).


The ssh -v -v -v output goes to standard error


And look at the sshd (destination systems ssh daemon's log file output). If going from the Raspberry Pi to the Mac, then look at the Mac's /var/log/system.log file.


If going from the Mac to the Raspberry Pi, then ASSUMING you are running a flavor of Linux, I would start with /var/log/secure, but if not in there, look at /var/log/messages. If that does not turn up anything, then "sudo grep sshd /var/log/* "


Anyway, the sshd log entries can often times tell you why the destination system refused your connection request.

Jun 13, 2015 8:19 AM in response to BobHarris

Hi Bob,

been on holiday, hence the delay.


Just to recap, my problem is that I can SCP files from my Pi to my Mac but the process ALWAYS requires my (Mac) password. I followed your advice and implemented "ssh -v -v -v 2><filename>" in the hope that it would provide a clue as to my problem. The output file is shown below.


1OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013
2debug1: Reading configuration data /etc/ssh/ssh_config
3debug1: /etc/ssh/ssh_config line 19: Applying options for *
4debug2: ssh_connect: needpriv 0
5debug1: Connecting to 10.0.1.13 [10.0.1.13] port 22.
6debug1: Connection established.
7debug3: Incorrect RSA1 identifier
8debug3: Could not load "/home/mick_f/.ssh/id_rsa" as a RSA1 public key
9debug1: identity file /home/mick_f/.ssh/id_rsa type 1
10debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
11debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
12debug1: identity file /home/mick_f/.ssh/id_rsa-cert type -1
13debug1: identity file /home/mick_f/.ssh/id_dsa type -1
14debug1: identity file /home/mick_f/.ssh/id_dsa-cert type -1
15debug1: identity file /home/mick_f/.ssh/id_ecdsa type -1
16debug1: identity file /home/mick_f/.ssh/id_ecdsa-cert type -1
17debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
18debug1: match: OpenSSH_6.2 pat OpenSSH*
19debug1: Enabling compatibility mode for protocol 2.0
20debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2
21debug2: fd 3 setting O_NONBLOCK
22debug3: load_hostkeys: loading entries for host "10.0.1.13" from file "/home/mick_f/.ssh/known_hosts"
23debug3: load_hostkeys: found key type RSA in file /home/mick_f/.ssh/known_hosts:3
24debug3: load_hostkeys: loaded 1 keys
25debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa
26debug1: SSH2_MSG_KEXINIT sent
27debug1: SSH2_MSG_KEXINIT received
28debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-e xchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,di ffie-hellman-group1-sha1
29debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
30debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blow fish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
31debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blow fish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
32debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
33debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
34debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
35debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
36debug2: kex_parse_kexinit:
37debug2: kex_parse_kexinit:
38debug2: kex_parse_kexinit: first_kex_follows 0
39debug2: kex_parse_kexinit: reserved 0
40debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie- hellman-group14-sha1,diffie-hellman-group1-sha1
41debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
42debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
43debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
44debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
45debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
46debug2: kex_parse_kexinit: none,zlib@openssh.com
47debug2: kex_parse_kexinit: none,zlib@openssh.com
48debug2: kex_parse_kexinit:
49debug2: kex_parse_kexinit:
50debug2: kex_parse_kexinit: first_kex_follows 0
51debug2: kex_parse_kexinit: reserved 0
52debug2: mac_setup: found hmac-md5
53debug1: kex: server->client aes128-ctr hmac-md5 none
54debug2: mac_setup: found hmac-md5
55debug1: kex: client->server aes128-ctr hmac-md5 none
56debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
57debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
58debug2: dh_gen_key: priv key bits set: 150/256
59debug2: bits set: 516/1024
60debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
61debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
62debug1: Server host key: RSA 9f:e1:f0:0e:20:0b:70:6a:59:0c:d1:3c:f6:fb:fc:ff
63debug3: load_hostkeys: loading entries for host "10.0.1.13" from file "/home/mick_f/.ssh/known_hosts"
64debug3: load_hostkeys: found key type RSA in file /home/mick_f/.ssh/known_hosts:3
65debug3: load_hostkeys: loaded 1 keys
66debug1: Host '10.0.1.13' is known and matches the RSA host key.
67debug1: Found key in /home/mick_f/.ssh/known_hosts:3
68debug2: bits set: 497/1024
69debug1: ssh_rsa_verify: signature correct
70debug2: kex_derive_keys
71debug2: set_newkeys: mode 1
72debug1: SSH2_MSG_NEWKEYS sent
73debug1: expecting SSH2_MSG_NEWKEYS
74debug2: set_newkeys: mode 0
75debug1: SSH2_MSG_NEWKEYS received
76debug1: Roaming not allowed by server
77debug1: SSH2_MSG_SERVICE_REQUEST sent
78debug2: service_accept: ssh-userauth
79debug1: SSH2_MSG_SERVICE_ACCEPT received
80debug2: key: /home/mick_f/.ssh/id_rsa (0xb7484310)
81debug2: key: /home/mick_f/.ssh/id_dsa ((nil))
82debug2: key: /home/mick_f/.ssh/id_ecdsa ((nil))
83debug1: Authentications that can continue: publickey,keyboard-interactive
84debug3: start over, passed a different list publickey,keyboard-interactive
85debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
86debug3: authmethod_lookup publickey
87debug3: remaining preferred: keyboard-interactive,password
88debug3: authmethod_is_enabled publickey
89debug1: Next authentication method: publickey
90debug1: Offering RSA public key: /home/mick_f/.ssh/id_rsa
91debug3: send_pubkey_test
92debug2: we sent a publickey packet, wait for reply
93debug1: Authentications that can continue: publickey,keyboard-interactive
94debug1: Trying private key: /home/mick_f/.ssh/id_dsa
95debug3: no such identity: /home/mick_f/.ssh/id_dsa
96debug1: Trying private key: /home/mick_f/.ssh/id_ecdsa
97debug3: no such identity: /home/mick_f/.ssh/id_ecdsa
98debug2: we did not send a packet, disable method
99debug3: authmethod_lookup keyboard-interactive
100debug3: remaining preferred: password
101debug3: authmethod_is_enabled keyboard-interactive
102debug1: Next authentication method: keyboard-interactive
103debug2: userauth_kbdint
104debug2: we sent a keyboard-interactive packet, wait for reply
105debug2: input_userauth_info_req
106debug2: input_userauth_info_req: num_prompts 1
107debug3: packet_send2: adding 32 (len 23 padlen 9 extra_pad 64)
108debug1: Authentications that can continue: publickey,keyboard-interactive
109debug2: userauth_kbdint
110debug2: we sent a keyboard-interactive packet, wait for reply
111debug2: input_userauth_info_req
112debug2: input_userauth_info_req: num_prompts 1
113debug3: packet_send2: adding 32 (len 23 padlen 9 extra_pad 64)
114debug1: Authentications that can continue: publickey,keyboard-interactive
115debug2: userauth_kbdint
116debug2: we sent a keyboard-interactive packet, wait for reply
117debug2: input_userauth_info_req
118debug2: input_userauth_info_req: num_prompts 1
119debug3: packet_send2: adding 32 (len 23 padlen 9 extra_pad 64)
120debug1: Authentications that can continue: publickey,keyboard-interactive
121debug2: we did not send a packet, disable method
122debug1: No more authentication methods to try.
123Permission denied (publickey,keyboard-interactive).


(I have absolutely no idea why this content is "tabled"; I opened the file from the the Pi using Mac's Textedit, highlighted and copied using Ctrl-C, and pasted it here using Ctrl-V !!!)


While a couple of lines have me puzzled (8, 76) I cannot directly see the problem. If anything strikes you, please let me know.


I looked at the logs on my Mac. The only relevant info I can find is in System Information, Logs where there is an Apple System Log ( /var/log/asl) and a sample is below which contains something that might be relevant.


2015-06-13 12:21:40 +0100 com.apple.launchd.peruser.501[166]: Throttling respawn: Will start in 7 seconds

2015-06-13 12:22:32 +0100 sshd: unknown [pam][805]: in od_record_create(): failed: 13

2015-06-13 12:22:32 +0100 sshd: unknown [pam][805]: in od_record_create_cstring(): failed: 13

2015-06-13 12:22:36 +0100 sshd: unknown [pam][805]: in od_record_create(): failed: 13

2015-06-13 12:22:36 +0100 sshd: unknown [pam][805]: in od_record_create_cstring(): failed: 13

2015-06-13 12:22:36 +0100 sshd: unknown [pam][805]: in pam_sm_authenticate(): OpenDirectory - Unable to get user record.

2015-06-13 12:22:36 +0100 sshd[803]: error: PAM: unknown user for illegal user home/michaelfarmer/.ssh from 10.0.1.11 via 10.0.1.13

2015-06-13 12:22:36 +0100 sshd: unknown [pam][806]: in od_record_create(): failed: 13

2015-06-13 12:22:36 +0100 sshd: unknown [pam][806]: in od_record_create_cstring(): failed: 13

2015-06-13 12:22:39 +0100 sshd: unknown [pam][806]: in od_record_create(): failed: 13

201


Thanks for your help so far and I look forward to any comments you may have.


Mick F

Jun 13, 2015 1:04 PM in response to mickf

debug1: Next authentication method: publickey

debug1: Offering RSA public key: /home/mick_f/.ssh/id_rsa

debug3: send_pubkey_test

debug2: we sent a publickey packet, wait for reply

debug1: Authentications that can continue: publickey,keyboard-interactive

debug1: Trying private key: /home/mick_f/.ssh/id_dsa

debug3: no such identity: /home/mick_f/.ssh/id_dsa

debug1: Trying private key: /home/mick_f/.ssh/id_ecdsa

debug3: no such identity: /home/mick_f/.ssh/id_ecdsa

debug2: we did not send a packet, disable method

debug3: authmethod_lookup keyboard-interactive

debug3: remaining preferred: password

This is basically saying, it tried your .ssh/id_rsa and the server did not accept it.


Why the server did not accept it is something that should be in the server's logs. When ssh fails to connect to my Mac, my Mac's /var/log/system.log file contains the sshd errors


From your server logs, this is most likely what the Mac does not like

2015-06-13 12:22:36 +0100 sshd[803]: error: PAM: unknown user for illegal user home/michaelfarmer/.ssh from 10.0.1.11 via 10.0.1.13

1st, is your Mac short username 'michaelfarmer' ??


2nd, on the Mac your home directory should be /Users/YourUserName, NOT /home/... I'm assuming that /home/username is the default home directory path when username cannot be found in whatever file Mac OS X uses to keep the user account information. Since it could not find 'michaelfarmer' it defaulted to /home/... (and after all ssh is a Unix utility and /home/... if frequently used on other Unix systems, so I can see sshd defaulting to /home when it cannot find a user record).


NOTE: If 'michaelfarmer' is your Mac username, exact spelling counts.

echo $USER

should tell you the exact spelling with exact upper/lowercase for your Mac account.


Anyway, it appears your problem has something to do with your username send from the Pi to your Mac and what your Mac thinks is your username.

Passwordless SCP file transfers between RaspberryPi and MacBook Pro.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.