Can't get ssh public key authentication to work
1
The server is running CentOS 7 and using OpenSSH. The client is running OpenSSH too.
To set up key-based authentication from the server to the client, I generated a new SSH keypair using the command: ssh-keygen
Then I used the ssh-copy-id utility to copy my public key over to the authorized_keys file: ssh-copy-id -i /var/spool/centreon/.ssh/id_rsa.pub centreon@194.30.1.34
As I expected, the utility asked for the password in order to complete the public key transfer. When all was done, I attempted to login. It should have let me through without requiring a password: ssh centreon@194.30.1.34
But I kept getting prompted for a password.
- I checked my authorized_keys file over on the client to make sure my
public key had been copied over correctly. Check. - I made sure that the file was read-write only for myself and none
others. Check. - I made sure that the following options were enabled in
/etc/ssh/sshd_config:PubkeyAuthentication yesandAuthorizedKeysFile .ssh/authorized_keys. Check.
Still, I kept getting prompted for a password.
This is the output of ssh centreon@194.30.1.34 -vv:
debug2: resolving "194.30.1.34" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 194.30.1.34 [194.30.1.34] port 22.
debug1: Connection established.
debug1: identity file /var/spool/centreon/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 194.30.1.34:22 as 'centreon'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5dqMvnfs9E33X/fn4ss+Ib4RiBQxiz634IAIB2rzo/U
debug1: Host '194.30.1.34' is known and matches the ECDSA host key.
debug1: Found key in /var/spool/centreon/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /var/spool/centreon/.ssh/id_rsa (0x55b36eff6320)
debug2: key: /var/spool/centreon/.ssh/id_dsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ecdsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ed25519 ((nil))
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: password
It seems is not using publickey method, but it is activated on sshd_config file.
I tried with ssh -o PreferredAuthentications=publickey centreon@194.30.1.34 but it doesn't work.
centos ssh openssh key-authentication
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
asked 1 hour ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
|
show 1 more comment
1
The server is running CentOS 7 and using OpenSSH. The client is running OpenSSH too.
To set up key-based authentication from the server to the client, I generated a new SSH keypair using the command: ssh-keygen
Then I used the ssh-copy-id utility to copy my public key over to the authorized_keys file: ssh-copy-id -i /var/spool/centreon/.ssh/id_rsa.pub centreon@194.30.1.34
As I expected, the utility asked for the password in order to complete the public key transfer. When all was done, I attempted to login. It should have let me through without requiring a password: ssh centreon@194.30.1.34
But I kept getting prompted for a password.
- I checked my authorized_keys file over on the client to make sure my
public key had been copied over correctly. Check. - I made sure that the file was read-write only for myself and none
others. Check. - I made sure that the following options were enabled in
/etc/ssh/sshd_config:PubkeyAuthentication yesandAuthorizedKeysFile .ssh/authorized_keys. Check.
Still, I kept getting prompted for a password.
This is the output of ssh centreon@194.30.1.34 -vv:
debug2: resolving "194.30.1.34" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 194.30.1.34 [194.30.1.34] port 22.
debug1: Connection established.
debug1: identity file /var/spool/centreon/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 194.30.1.34:22 as 'centreon'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5dqMvnfs9E33X/fn4ss+Ib4RiBQxiz634IAIB2rzo/U
debug1: Host '194.30.1.34' is known and matches the ECDSA host key.
debug1: Found key in /var/spool/centreon/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /var/spool/centreon/.ssh/id_rsa (0x55b36eff6320)
debug2: key: /var/spool/centreon/.ssh/id_dsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ecdsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ed25519 ((nil))
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: password
It seems is not using publickey method, but it is activated on sshd_config file.
I tried with ssh -o PreferredAuthentications=publickey centreon@194.30.1.34 but it doesn't work.
centos ssh openssh key-authentication
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
asked 1 hour ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Just to be sure, thePubkeyAuthenticationparameter is set at the remote end (194.30.1.34), right?
– Haxiel
1 hour ago
Yes! It is set.
– Mikel
58 mins ago
check if .ssh folder has right ownership and permissions and also your home folder
– rAlen
55 mins ago
Both .ssh folder and /var/spool/centreon/ folder (where the .ssh folder is) permissions are 700
– Mikel
48 mins ago
1
You may need to runsshdin debug mode on the remote machine to see what it is doing. Most of the time it's remote directory permissions (complete path to theauthorized_keysfile not fully secure).
– Stephen Harris
38 mins ago
|
show 1 more comment
1
1
1
The server is running CentOS 7 and using OpenSSH. The client is running OpenSSH too.
To set up key-based authentication from the server to the client, I generated a new SSH keypair using the command: ssh-keygen
Then I used the ssh-copy-id utility to copy my public key over to the authorized_keys file: ssh-copy-id -i /var/spool/centreon/.ssh/id_rsa.pub centreon@194.30.1.34
As I expected, the utility asked for the password in order to complete the public key transfer. When all was done, I attempted to login. It should have let me through without requiring a password: ssh centreon@194.30.1.34
But I kept getting prompted for a password.
- I checked my authorized_keys file over on the client to make sure my
public key had been copied over correctly. Check. - I made sure that the file was read-write only for myself and none
others. Check. - I made sure that the following options were enabled in
/etc/ssh/sshd_config:PubkeyAuthentication yesandAuthorizedKeysFile .ssh/authorized_keys. Check.
Still, I kept getting prompted for a password.
This is the output of ssh centreon@194.30.1.34 -vv:
debug2: resolving "194.30.1.34" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 194.30.1.34 [194.30.1.34] port 22.
debug1: Connection established.
debug1: identity file /var/spool/centreon/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 194.30.1.34:22 as 'centreon'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5dqMvnfs9E33X/fn4ss+Ib4RiBQxiz634IAIB2rzo/U
debug1: Host '194.30.1.34' is known and matches the ECDSA host key.
debug1: Found key in /var/spool/centreon/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /var/spool/centreon/.ssh/id_rsa (0x55b36eff6320)
debug2: key: /var/spool/centreon/.ssh/id_dsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ecdsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ed25519 ((nil))
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: password
It seems is not using publickey method, but it is activated on sshd_config file.
I tried with ssh -o PreferredAuthentications=publickey centreon@194.30.1.34 but it doesn't work.
centos ssh openssh key-authentication
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
asked 1 hour ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
The server is running CentOS 7 and using OpenSSH. The client is running OpenSSH too.
To set up key-based authentication from the server to the client, I generated a new SSH keypair using the command: ssh-keygen
Then I used the ssh-copy-id utility to copy my public key over to the authorized_keys file: ssh-copy-id -i /var/spool/centreon/.ssh/id_rsa.pub centreon@194.30.1.34
As I expected, the utility asked for the password in order to complete the public key transfer. When all was done, I attempted to login. It should have let me through without requiring a password: ssh centreon@194.30.1.34
But I kept getting prompted for a password.
- I checked my authorized_keys file over on the client to make sure my
public key had been copied over correctly. Check. - I made sure that the file was read-write only for myself and none
others. Check. - I made sure that the following options were enabled in
/etc/ssh/sshd_config:PubkeyAuthentication yesandAuthorizedKeysFile .ssh/authorized_keys. Check.
Still, I kept getting prompted for a password.
This is the output of ssh centreon@194.30.1.34 -vv:
debug2: resolving "194.30.1.34" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 194.30.1.34 [194.30.1.34] port 22.
debug1: Connection established.
debug1: identity file /var/spool/centreon/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/spool/centreon/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 194.30.1.34:22 as 'centreon'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5dqMvnfs9E33X/fn4ss+Ib4RiBQxiz634IAIB2rzo/U
debug1: Host '194.30.1.34' is known and matches the ECDSA host key.
debug1: Found key in /var/spool/centreon/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /var/spool/centreon/.ssh/id_rsa (0x55b36eff6320)
debug2: key: /var/spool/centreon/.ssh/id_dsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ecdsa ((nil))
debug2: key: /var/spool/centreon/.ssh/id_ed25519 ((nil))
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: password
It seems is not using publickey method, but it is activated on sshd_config file.
I tried with ssh -o PreferredAuthentications=publickey centreon@194.30.1.34 but it doesn't work.
centos ssh openssh key-authentication
centos ssh openssh key-authentication
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
asked 1 hour ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
asked 1 hour ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
edited 1 hour ago
Rui F Ribeiro
38.9k1479129
38.9k1479129
asked 1 hour ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 1 hour ago
Mikel
61
asked 1 hour ago
Mikel
61
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Just to be sure, thePubkeyAuthenticationparameter is set at the remote end (194.30.1.34), right?
– Haxiel
1 hour ago
Yes! It is set.
– Mikel
58 mins ago
check if .ssh folder has right ownership and permissions and also your home folder
– rAlen
55 mins ago
Both .ssh folder and /var/spool/centreon/ folder (where the .ssh folder is) permissions are 700
– Mikel
48 mins ago
1
You may need to runsshdin debug mode on the remote machine to see what it is doing. Most of the time it's remote directory permissions (complete path to theauthorized_keysfile not fully secure).
– Stephen Harris
38 mins ago
|
show 1 more comment
Just to be sure, thePubkeyAuthenticationparameter is set at the remote end (194.30.1.34), right?
– Haxiel
1 hour ago
Yes! It is set.
– Mikel
58 mins ago
check if .ssh folder has right ownership and permissions and also your home folder
– rAlen
55 mins ago
Both .ssh folder and /var/spool/centreon/ folder (where the .ssh folder is) permissions are 700
– Mikel
48 mins ago
1
You may need to runsshdin debug mode on the remote machine to see what it is doing. Most of the time it's remote directory permissions (complete path to theauthorized_keysfile not fully secure).
– Stephen Harris
38 mins ago
Just to be sure, the
PubkeyAuthentication parameter is set at the remote end (194.30.1.34), right?– Haxiel
1 hour ago
Just to be sure, the
PubkeyAuthentication parameter is set at the remote end (194.30.1.34), right?– Haxiel
1 hour ago
Yes! It is set.
– Mikel
58 mins ago
Yes! It is set.
– Mikel
58 mins ago
check if .ssh folder has right ownership and permissions and also your home folder
– rAlen
55 mins ago
check if .ssh folder has right ownership and permissions and also your home folder
– rAlen
55 mins ago
Both .ssh folder and /var/spool/centreon/ folder (where the .ssh folder is) permissions are 700
– Mikel
48 mins ago
Both .ssh folder and /var/spool/centreon/ folder (where the .ssh folder is) permissions are 700
– Mikel
48 mins ago
1
1
You may need to run
sshd in debug mode on the remote machine to see what it is doing. Most of the time it's remote directory permissions (complete path to the authorized_keys file not fully secure).– Stephen Harris
38 mins ago
You may need to run
sshd in debug mode on the remote machine to see what it is doing. Most of the time it's remote directory permissions (complete path to the authorized_keys file not fully secure).– Stephen Harris
38 mins ago
|
show 1 more comment
1 Answer
1
active
oldest
votes
0
# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_7.4, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: private host key #0: ssh-rsa SHA256:hrLms1qzSG4kzJWoYHSNRCqU4rT8D1MD6zBc NRcG3cQ
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:TxOu5pzDEA/jneXetbsvo0w0 lljcnaftCo+ttHGmksE
debug1: private host key #2: ssh-ed25519 SHA256:/B/n9JLWYa0TDCsXERy7riYynqnPppsC CKRPLIhmr9o
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 212.81.200.106 port 48632 on 192.168.1.18 port 22
debug1: Client protocol version 2.0; client software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Enabling compatibility mode for protocol 2.0
debug1: SELinux support disabled [preauth]
debug1: permanently_set_uid: 74/74 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp25 6,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user centreon service ssh-connection method none [p reauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "centreon"
debug1: PAM: setting PAM_RHOST to "yoshimura.ibex.es"
debug1: PAM: setting PAM_TTY to "ssh"
answered 26 mins ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Please edit this into the question, and remove it as an answer. You also need to show the section of the debug output for the attempted authentication, not the startup.
– Stephen Harris
4 mins ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Mikel is a new contributor. Be nice, and check out our Code of Conduct.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f491300%2fcant-get-ssh-public-key-authentication-to-work%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_7.4, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: private host key #0: ssh-rsa SHA256:hrLms1qzSG4kzJWoYHSNRCqU4rT8D1MD6zBc NRcG3cQ
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:TxOu5pzDEA/jneXetbsvo0w0 lljcnaftCo+ttHGmksE
debug1: private host key #2: ssh-ed25519 SHA256:/B/n9JLWYa0TDCsXERy7riYynqnPppsC CKRPLIhmr9o
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 212.81.200.106 port 48632 on 192.168.1.18 port 22
debug1: Client protocol version 2.0; client software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Enabling compatibility mode for protocol 2.0
debug1: SELinux support disabled [preauth]
debug1: permanently_set_uid: 74/74 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp25 6,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user centreon service ssh-connection method none [p reauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "centreon"
debug1: PAM: setting PAM_RHOST to "yoshimura.ibex.es"
debug1: PAM: setting PAM_TTY to "ssh"
answered 26 mins ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Please edit this into the question, and remove it as an answer. You also need to show the section of the debug output for the attempted authentication, not the startup.
– Stephen Harris
4 mins ago
add a comment |
0
# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_7.4, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: private host key #0: ssh-rsa SHA256:hrLms1qzSG4kzJWoYHSNRCqU4rT8D1MD6zBc NRcG3cQ
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:TxOu5pzDEA/jneXetbsvo0w0 lljcnaftCo+ttHGmksE
debug1: private host key #2: ssh-ed25519 SHA256:/B/n9JLWYa0TDCsXERy7riYynqnPppsC CKRPLIhmr9o
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 212.81.200.106 port 48632 on 192.168.1.18 port 22
debug1: Client protocol version 2.0; client software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Enabling compatibility mode for protocol 2.0
debug1: SELinux support disabled [preauth]
debug1: permanently_set_uid: 74/74 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp25 6,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user centreon service ssh-connection method none [p reauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "centreon"
debug1: PAM: setting PAM_RHOST to "yoshimura.ibex.es"
debug1: PAM: setting PAM_TTY to "ssh"
answered 26 mins ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Please edit this into the question, and remove it as an answer. You also need to show the section of the debug output for the attempted authentication, not the startup.
– Stephen Harris
4 mins ago
add a comment |
0
0
0
# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_7.4, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: private host key #0: ssh-rsa SHA256:hrLms1qzSG4kzJWoYHSNRCqU4rT8D1MD6zBc NRcG3cQ
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:TxOu5pzDEA/jneXetbsvo0w0 lljcnaftCo+ttHGmksE
debug1: private host key #2: ssh-ed25519 SHA256:/B/n9JLWYa0TDCsXERy7riYynqnPppsC CKRPLIhmr9o
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 212.81.200.106 port 48632 on 192.168.1.18 port 22
debug1: Client protocol version 2.0; client software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Enabling compatibility mode for protocol 2.0
debug1: SELinux support disabled [preauth]
debug1: permanently_set_uid: 74/74 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp25 6,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user centreon service ssh-connection method none [p reauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "centreon"
debug1: PAM: setting PAM_RHOST to "yoshimura.ibex.es"
debug1: PAM: setting PAM_TTY to "ssh"
answered 26 mins ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_7.4, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: private host key #0: ssh-rsa SHA256:hrLms1qzSG4kzJWoYHSNRCqU4rT8D1MD6zBc NRcG3cQ
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:TxOu5pzDEA/jneXetbsvo0w0 lljcnaftCo+ttHGmksE
debug1: private host key #2: ssh-ed25519 SHA256:/B/n9JLWYa0TDCsXERy7riYynqnPppsC CKRPLIhmr9o
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 212.81.200.106 port 48632 on 192.168.1.18 port 22
debug1: Client protocol version 2.0; client software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Enabling compatibility mode for protocol 2.0
debug1: SELinux support disabled [preauth]
debug1: permanently_set_uid: 74/74 [preauth]
debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp25 6,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: kex: curve25519-sha256 need=64 dh_need=64 [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: rekey after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user centreon service ssh-connection method none [p reauth]
debug1: attempt 0 failures 0 [preauth]
debug1: PAM: initializing for "centreon"
debug1: PAM: setting PAM_RHOST to "yoshimura.ibex.es"
debug1: PAM: setting PAM_TTY to "ssh"
answered 26 mins ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 26 mins ago
Mikel
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 26 mins ago
Mikel
61
answered 26 mins ago
Mikel
61
61
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Mikel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Please edit this into the question, and remove it as an answer. You also need to show the section of the debug output for the attempted authentication, not the startup.
– Stephen Harris
4 mins ago
add a comment |
Please edit this into the question, and remove it as an answer. You also need to show the section of the debug output for the attempted authentication, not the startup.
– Stephen Harris
4 mins ago
Please edit this into the question, and remove it as an answer. You also need to show the section of the debug output for the attempted authentication, not the startup.
– Stephen Harris
4 mins ago
Please edit this into the question, and remove it as an answer. You also need to show the section of the debug output for the attempted authentication, not the startup.
– Stephen Harris
4 mins ago
add a comment |
Mikel is a new contributor. Be nice, and check out our Code of Conduct.
draft saved
draft discarded
Mikel is a new contributor. Be nice, and check out our Code of Conduct.
Mikel is a new contributor. Be nice, and check out our Code of Conduct.
Mikel is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f491300%2fcant-get-ssh-public-key-authentication-to-work%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Just to be sure, the
PubkeyAuthenticationparameter is set at the remote end (194.30.1.34), right?– Haxiel
1 hour ago
Yes! It is set.
– Mikel
58 mins ago
check if .ssh folder has right ownership and permissions and also your home folder
– rAlen
55 mins ago
Both .ssh folder and /var/spool/centreon/ folder (where the .ssh folder is) permissions are 700
– Mikel
48 mins ago
1
You may need to run
sshdin debug mode on the remote machine to see what it is doing. Most of the time it's remote directory permissions (complete path to theauthorized_keysfile not fully secure).– Stephen Harris
38 mins ago