Re: Public key authentication works for one account, but NOT other account...

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The server seems not to accept the public key it receives in the first scenario.

You can find out why if you start the sshd with debug level logging (similar to the -vvv for the client).

One reason could be that the permissions on the home directory of jon2 are wrong; sshd checks if they are safe and if not refuses to read .ssh/* in that home dir.

Or did you copy authorized_keys from one account to the other and forget to chown it? I have done so quite a few times. :-(

Dirk

Am 20.03.10 01:50, schrieb Jon Price:
Hi,

Public key authentication seems to work for one account but does NOT
work (prompts for password) for another account.
Why might this be?

I have a problem with public key authentication.  This all happens on
the same server ("server1") which runs Solaris 10 and OpenSSH 5.3p1.
There are two scenarios.  Neither scenario should prompt for password
because I added "jon" account's public key into the
.ssh/authorized_keys file's for both the ndio account and the jon2
account. However, Scenario 1 prompts for password (problem) and
Scenario 2 does NOT prompt for password (good).

Scenario 1 -- prompts for password (problem)
Start as user "jon". Run  ssh -v -v -v -Y ndio@server1
       this prompts for password

Scenario 2 -- does NOT prompt for password (good)
Start as user "jon". Run  ssh -v -v -v -Y jon2@server1
       Goes right to command prompt for user jon2

Below is debug output for both cases.
It is clear that public key authentication worked for scenario 2 and
that it did NOT work for scenario 1

But what could be the cause of the problem for scenario 1?

------------------------------------------------------------
Scenario1 - Problem (prompts for password)

<snip>

These messages are identical to the "success" case below..

debug1: Next authentication method: publickey
debug1: Trying private key: /export/home/jon/.ssh/identity
debug3: no such identity: /export/home/jon/.ssh/identity
debug1: Offering public key: /export/home/jon/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 368 bytes for a total of 1477

This is where messages become different than the success case below...
Note that NO messages are left out here. debug3: Wrote 368 ..... msg
is followed by the debug1: Authentications that can continue .... msg.

debug1: Authentications that can continue:
publickey,password,keyboard-interactive
debug1: Trying private key: /export/home/jon/.ssh/id_dsa
debug3: no such identity: /export/home/jon/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive


----------------------------------------------------------
Scenario 2 - Good (No prompt for password)

These messages are identical to the failure case above..
<snip>
debug1: Next authentication method: publickey
debug1: Trying private key: /export/home/jon/.ssh/identity
debug3: no such identity: /export/home/jon/.ssh/identity
debug1: Offering public key: /export/home/jon/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 368 bytes for a total of 1477

This is where messages become different than the failure case above.
Note that NO messages are left out here. debug3: Wrote 368 ..... msg
is followed by the debug1: Server accepts key: ... msg.

debug1: Server accepts key: pkalg ssh-rsa blen 277
debug2: input_userauth_pk_ok: fp a2:ee:ea:88:cd:8e:c3:c9:c5:63:dd:30:ea:55:93:db
debug3: sign_and_send_pubkey
debug1: read PEM private key done: type RSA
debug3: Wrote 640 bytes for a total of 2117
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Requesting no-more-sessions@xxxxxxxxxxx
debug1: Entering interactive session.
<snip>
-----------------------------------------------------------------------------------------

End


[Index of Archives]     [Open SSH Unix Development]     [Fedora Users]     [Fedora Desktop]     [Yosemite Backpacking]     [KDE Users]     [Gnome Users]

  Powered by Linux