{"id":1009,"date":"2011-09-13T12:15:18","date_gmt":"2011-09-13T16:15:18","guid":{"rendered":"http:\/\/antipaucity.com\/?p=1009"},"modified":"2011-09-13T12:15:18","modified_gmt":"2011-09-13T16:15:18","slug":"debugging-authorized_keys-and-ssh","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=1009","title":{"rendered":"debugging authorized_keys and ssh"},"content":{"rendered":"<p>I saw an interesting <a href=\"http:\/\/serverfault.com\/q\/310827\/2321\">question<\/a> this morning on <a href=\"http:\/\/serverfault.com\">ServerFault<\/a>, entitled &#8220;SSH Prompts for password even though private keys are available, presented to server and known to it&#8221;.<\/p>\n<blockquote>\n<ul>\n<li>when my user is not already connected to the server (first ssh connexion), it prompts for password even though privates keys are availiable (PuTTY + Pagent). After that first connection, if I open a secondary or a third connection it gets connected with the keys.<\/li>\n<li>If I close all connections and open a new one it prompts for the password.<\/li>\n<li>If I have let say 4 open connections and I close the first one (the one that prompted for the password), the fifth connection will be opened with the keys<\/li>\n<\/ul>\n<\/blockquote>\n<p>Now <em>that<\/em> is an interesting problem. The <a href=\"http:\/\/serverfault.com\/questions\/310827\/ssh-prompts-for-password-even-though-private-keys-are-available-presented-to-ser\/310829#310829\">answer<\/a>\u00a0supplied, with follow-on comments was also interesting, but the <em>process<\/em>\u00a0behind solving this is even more fascinating, I think.<\/p>\n<p>The issue is that password-less logins <em>should<\/em>\u00a0work. <code>sshd_config<\/code> has been set properly, and there is a set of matching keys in <code>authorized_keys<\/code>.<\/p>\n<p>But it doesn&#8217;t work, obviously &#8211; or there&#8217;d be no question raised.<\/p>\n<p>A list of items to look into, both from the supplied answer, and from my own thoughts (somebody else beat me to an answer):<\/p>\n<ul>\n<li>permissions on <code>.ssh\/authorized_keys<\/code> (must be 600)<\/li>\n<li>verify <code>sshd<\/code> has been started\/restarted post changes to <code>sshd_config<\/code><\/li>\n<li>check to see if home directory is remotely mounted \/ mounted on demand<\/li>\n<li>check to see if key has a passphrase in use<\/li>\n<li>look at\u00a0<code>\/var\/log\/auth.log<\/code> for errors<\/li>\n<li>check to see if the home directory is encrypted (<em>actual answer<\/em>)<\/li>\n<\/ul>\n<p>Debugging is something I have <a href=\"http:\/\/cnx.org\/content\/col11350\/latest\/\">written about<\/a> recently &#8211; it seems to <a href=\"http:\/\/antipaucity.com\/2011\/08\/08\/why-technical-intricacies-matter\">come up<\/a> over and over in my line of work.<\/p>\n<p>It&#8217;s a skill that&#8217;s vital to have in the IT world, and yet an awful lot of folks do not.<\/p>\n<hr \/>\n<p>The <a href=\"http:\/\/serverfault.com\/questions\/310827\/ssh-prompts-for-password-even-though-private-keys-are-available-presented-to-ser\/310829#310829\">answer<\/a>, for those interested:<\/p>\n<blockquote><p>It sounds like, for whatever reason, the user&#8217;s home directory is not available if the user is not logged in, so that sshd can&#8217;t find the authorized_keys file<\/p>\n<p>&#8230;<\/p>\n<p>The user&#8217;s home directory must be using ecrypt or something like that<\/p>\n<p>&#8230;<\/p>\n<p>that&#8217;d be the cause, then, since sshd can&#8217;t decrypt the contents of the home directory<\/p>\n<p>&#8230;<\/p>\n<p>Ubuntu Desktop asks if you want to encrypt the home directory (why not?) without mentioning what it may do to ssh&#8230; a simple &#8220;note: this will effect SSH&#8230;&#8221; would be helpful<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>I saw an interesting question this morning on ServerFault, entitled &#8220;SSH Prompts for password even though private keys are available, presented to server and known to it&#8221;. when my user is not already connected to the server (first ssh connexion), it prompts for password even though privates keys are availiable (PuTTY + Pagent). After that &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=1009\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">debugging authorized_keys and ssh<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,31,41],"tags":[],"keyring_services":[],"class_list":["post-1009","post","type-post","status-publish","format-standard","hentry","category-education","category-personal","category-technical"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/1009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1009"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/1009\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1009"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=1009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}