Passwordless ssh authentication fails

tkota · November 12, 2012, 4:31pm

Unable to set ssh passwordless authentication
I am unable to ssh with passwordless authentication from Windows client onto UBuntu server. The ssh version on UBuntu is OpenSSH_5.8p1 Debian-7ubuntu1, OpenSSL 1.0.0e , while SSH on Windows Client is OpenSSH_5.1p1, OpenSSL 0.9.8k. I turned on ssh debugging and noticed these messages on server and client:

/usr/bin/sshd -d -p 2222 on server:
adminuser@server:~/.ssh$ /usr/sbin/sshd -d -p 2222
debug1: sshd version OpenSSH_5.8p1 Debian-7ubuntu1
debug1: could not open key file '/etc/ssh/ssh_host_rsa_key': Permission denied
Could not load host key: /etc/ssh/ssh_host_rsa_key
debug1: could not open key file '/etc/ssh/ssh_host_dsa_key': Permission denied
Could not load host key: /etc/ssh/ssh_host_dsa_key
debug1: could not open key file '/etc/ssh/ssh_host_ecdsa_key': Permission denied
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: rexec_argv[2]='-p'
debug1: rexec_argv[3]='2222'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 10.221.84.65 port 2414
debug1: Client protocol version 2.0; client software version OpenSSH_5.1
debug1: match: OpenSSH_5.1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1
debug1: list_hostkey_types: 
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup

ssh -vvv on client:

C:\Documents and Settings\clientuser>ssh -vvv -p 2222 
OpenSSH_5.1p1, OpenSSL 0.9.8k 25 Mar 2009

debug2: ssh_connect: needpriv 0
debug1: Connecting to server.com port 2222.
debug1: Connection established.
debug1: identity file /cygdrive/c/Documents and Settings/clientuser/.ssh/identi
ty type -1
debug3: Not a RSA1 key file /cygdrive/c/Documents and Settings/clientuser/.ssh/
id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /cygdrive/c/Documents and Settings/clientuser/.ssh/id_rsa
type 1
debug1: identity file /cygdrive/c/Documents and Settings/clientuser/.ssh/id_dsa
type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debia
n-7ubuntu1
debug1: match: OpenSSH_5.8p1 Debian-7ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
Read from socket failed: Connection reset by peer

I verified that the permissions on authorized_keys, .ssh etc on host are correct. I regenerated host keys to get around the 'Could not load host keys' and restarted ssh services, but problem persists. Here are contents of sshd_config:

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

Any suggestions on what could be wrong? The host private keys are unable to load because they are owned by 'root' user. Changing their permissions to anything other than mode 600 is not allowed. I appreciate any solutions. I am stuck at this point.. please help!

DGPickett · November 20, 2012, 4:24pm

First, I would make sure that the passwordless ssh works to localhost on both hosts. This way, you are dealing with one .ssh directory. The id_rsa file seems messed up from the printout. I often just "scp -rp .ssh wherever:." once I get localhost working, and then the keys match perfectly, although perversely any localhost//127.0.0.1 keys do not and it will tell you where they are to discard them so they can be reset for the local host keys.

Corona688 · November 20, 2012, 5:23pm

Make sure your home-directories are not world-writable.

acascianelli · November 21, 2012, 10:01am

In your sshd_config file, try changing PermitEmptyPasswords to yes.

DGPickett · November 21, 2012, 4:01pm

Yes, having the right permissions on $HOME and everything from .ssh*/ down is very important. Hence, I scp them with -p, so I do not get umask derived permissions.

frappa · November 24, 2012, 4:00am

Hi tkota:

the sshd_config files seems ok, I don't think you should edit it.
check for correct permissions on the server-side ~/.ssh directory of the user you are going to login with; they should be:
700 (rwx --- ---) for ~/.ssh directory
600 (rw- --- ---) for all the files inside ~/.ssh directory
please check that the public key you are using to perform passwordless authentication is correctly stored in server-side file ~/.ssh/authorized_keys
The format of the key should be something like:

ssh-rsa hkbvfggkwbugjbvwulbvgawDDHSFYGFVDKJCBK+89u8aunLJDBHUOGHzwyZK4PpmV1cA4D/l3WbjNKLWGN/ERWGPWMBVFI9PWHJVWERIQVH80H80WERHVQWRV+M0vbqQPnj/EkJ0HpF5xAxOEcYlb57GNV/5CKjai9z1DFIUaeJM8vj+f1ztDcj71s6vIw5Vm5EA+gk2Vj4siYhg08NUtCrdRWmFgmaf2wM0MrblJtbzeeOLwcWVyQzDpxLlhqpA76mgpO0TvALJJOHWw/+/GFUWET76T893T45GI2GD67WTgyd789g34ibgrifh0peh34n2f+f2jh0cbhkjb98gTFVCXDUCCFYKGILYPYPghkbfhkbwekfwe8ebncfwhc8o0wechppenc2q0pj+mknbn0B4pA9XJkvrD2Zi+pdV8U3nuTTUZTAysXdN8dV/xV3s6W9ENHhVulNZ5vmerWmAAvm1OBH0jPWipDagPhBZ1c+WVPDmYLbWKTGHTsOfDH0/+JFc8zCgtxkz10Z8x6efRjTQMkl6T988YlLAeBhRtPQ/of5mJ9kKOg4Ynyc9uHv+gY48VkpUoQQUGjkGOjMYQ4PR/tkQE6xqaOAEhWN79oys2R47f36aCkKOd7S8hxJ7AauMSCpBg/+3ClTeX8VdUsUZhAWtKwacicBVlQuSyUBByh2JhJkQX2fPsxF5uf9fOcl9hac= user@remotehost

be aware that the newlines in public key are just a consequence of the fact that the text may be wrapped by the text editor/viewer: the key itself should not contain newline characters (sometimes ssh_keygen on windows may produce weird output results).
For the same reason, if you generated the key pair on a windows machine, make sure to sanitize the content of the private and public key in order to comply with the server newline standard (see for example 'man dos2unix').

when invoking ssh on the client, please remember to specify the user to login with and try to explicitly indicate the private key you want to use in order to authenticate (using the -i switch of ssh).

see ya
fra