Re: ssh to remote machine with user login problem

[david robert <davidforlinux@yahoo.co.uk>]

details as follows

 

remote sshd_conf

 

# Package generated configuration file
# See the sshd(8) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 600
PermitRootLogin yes
#PermitRootLogin forced-commands-only
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes

# Change to yes to enable tunnelled clear text passwords
PasswordAuthentication no

# To change Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes

X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
KeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

Subsystem       sftp    /usr/lib/sftp-server

UsePAM yes

 

When i try the following commnd

 

diff authorized_keys id_rsa.pub

 

Result

 

1c1
< ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA229WYAsRv9lhplUxynEvTsq8HYd/e7vE78LEye4a1/IgVuW3u6vW0cUDXM/RRJjh1j/sLDJwaTbs/ildzXc8YNvOl3YoAVosHcEH1MTfMqDYdta3tpwqfwLZ+Ruq4XV3WSRTV56i8k7mCJ4zkjhpn715tgr5U84ZMQzbRT5ZXtk= root@test1
---
> ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzIB5fb6SJJJI2sDKOzyVtzCpyt9I/40z5Sv2x8dL2hJIJjknSXrYXseIhPOzmOXMPL9BsTu/5uCnQm+EPq1cBd1aFDcrla+yxSTcmhNQGa5S271//Tx+XBwVzBFccOcDqa+W5PzNqY6t+FpobhbOrf2AOPqGpUy5nxgRnHqHMhE= root@test2

 

When i try to run the commnads i am trying as follows

 

#ssh root@ipaddressofremotemachine

 

#ssh user@ipaddressofremotemachine

Pavlos Parissis <p_pavlos@freemail.gr> wrote:

> > hi,
> > 
> > I am sending all the details as follows
> > 
> > ssh -v output
> > 
> > debug1: Reading configuration data /etc/ssh/ssh_config
> > debug1: Connecting to x.x.x.x [x.x.x.x ] port 22.
> >
>  debug1: Connection established.
> > debug1: identity file /home/user/.ssh/identity type -1
> > debug1: identity file /home/user/.ssh/id_rsa type 1
> > debug1: identity file /home/user/.ssh/id_dsa type -1
> > debug1: Remote protocol version 2.0, remote software version OpenSSH_3.8.1p1
> > Debian-8.sarge.4
> > debug1: match: OpenSSH_3.8.1p1 Debian-8.sarge.4 pat OpenSSH*
> > debug1: Enabling compatibility mode for protocol 2.0
> > debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1 Debian-8.sarge.4
> > debug1: SSH2_MSG_KEXINIT sent
> > debug1: SSH2_MSG_KEXINIT received
> > debug1: kex: server->client aes128-cbc hmac-md5 none
> > debug1: kex: client->server aes128-cbc hmac-md5 none
> > debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
> > debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
> > debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
> > debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
> > debug1: Host 'x.x.x.x' is
>  known and matches the RSA host key.
> > debug1: Found key in /home/user/.ssh/known_hosts:1
> > debug1: ssh_rsa_verify: signature correct
> > debug1: SSH2_MSG_NEWKEYS sent
> > debug1: expecting SSH2_MSG_NEWKEYS
> > debug1: SSH2_MSG_NEWKEYS received
> > debug1: SSH2_MSG_SERVICE_REQUEST sent
> > debug1: SSH2_MSG_SERVICE_ACCEPT received
> > debug1: Authentications that can continue: publickey,keyboard-interactive
> > debug1: Next authentication method: publickey
> > debug1: Trying private key: /home/user/.ssh/identity
> > debug1: Offering public key: /home/user/.ssh/id_rsa
> > debug1: Authentications that can continue: publickey,keyboard-interactive
> > debug1: Trying private key: /home/user/.ssh/id_dsa
> > debug1: Next authentication method: keyboard-interactive
>
> It looks like your client is offering the RSA public key and your server
> is rejecting it.
>
> > Password:
> > 
> > sshd_config file from where i am
>  trying to access remote machine
>
> I asked the sshd_config of the remote server,may be i was not clear.
> Just make sure that the remote server has 
> PubkeyAuthentication yes
> in sshd_config
>
> > # Package generated configuration file
> > # See the sshd(8) manpage for details
> > # What ports, IPs and protocols we listen for
> > Port 22
> > # Use these options to restrict which interfaces/protocols sshd will bind to
> > #ListenAddress ::
> > #ListenAddress 0.0.0.0
> > Protocol 2
> > # HostKeys for protocol version 2
> > HostKey /etc/ssh/ssh_host_rsa_key
> > HostKey /etc/ssh/ssh_host_dsa_key
> > #Privilege Separation is turned on for security
> > UsePrivilegeSeparation yes
> > # Lifetime and size of ephemeral version 1 server key
> > KeyRegenerationInterval 3600
> > ServerKeyBits 768
> > # Logging
> > SyslogFacility AUTH
> > LogLevel INFO
> > # Authentication:
> > LoginGraceTime
>  600
> > PermitRootLogin yes
> > #PermitRootLogin forced-commands-only
> > StrictModes yes
> > RSAAuthentication yes
> > PubkeyAuthentication yes
> > AuthorizedKeysFile %h/.ssh/authorized_keys
> > # Don't read the user's ~/.rhosts and ~/.shosts files
> > IgnoreRhosts yes
> > # For this to work you will also need host keys in /etc/ssh_known_hosts
> > RhostsRSAAuthentication no
> > # similar for protocol version 2
> > HostbasedAuthentication no
> > # Uncomment if you don't trust ~/.ssh/known_hosts for
> > RhostsRSAAuthentication
> > #IgnoreUserKnownHosts yes
> > # To enable empty passwords, change to yes (NOT RECOMMENDED)
> > PermitEmptyPasswords no
> > # Change to no to disable s/key passwords
> > #ChallengeResponseAuthentication yes
> > # Change to yes to enable tunnelled clear text passwords
> > PasswordAuthentication no
> > 
> > # To change Kerberos options
> > #KerberosAuthentication
>  no
> > #KerberosOrLocalPasswd yes
> > #AFSTokenPassing no
> > #KerberosTicketCleanup no
> > # Kerberos TGT Passing does only work with the AFS kaserver
> > #KerberosTgtPassing yes
> > X11Forwarding no
> > X11DisplayOffset 10
> > PrintMotd no
> > PrintLastLog yes
> > KeepAlive yes
> > #UseLogin no
> > #MaxStartups 10:30:60
> > #Banner /etc/issue.net
> > Subsystem sftp /usr/lib/sftp-server
> > UsePAM yes
> > ssh_config
> > # $OpenBSD: ssh_config,v 1.19 2003/08/13 08:46:31 markus Exp $
> > # This is the ssh client system-wide configuration file. See
> > # ssh_config(5) for more information. This file provides defaults for
> > # users, and the values can be changed in per-user configuration files
> > # or on the command line.
> > # Configuration data is parsed as follows:
> > # 1. command line options
> > # 2. user-specific file
> > # 3. system-wide file
> > # Any configuration value
>  is only changed the first time it is set.
> > # Thus, host-specific definitions should be at the beginning of the
> > # configuration file, and defaults at the end.
> > # Site-wide defaults for various options
> > # Host *
> > # ForwardAgent no
> > # ForwardX11 no
> > # ForwardX11Trusted yes
> > # RhostsRSAAuthentication no
> > # RSAAuthentication yes
> > # PasswordAuthentication yes
> > # HostbasedAuthentication no
> > # BatchMode no
> > # CheckHostIP yes
> > # AddressFamily any
> > # ConnectTimeout 0
> > # StrictHostKeyChecking ask
> > # IdentityFile ~/.ssh/identity
> > # IdentityFile ~/.ssh/id_rsa
> > # IdentityFile ~/.ssh/id_dsa
> > # Port 22
> > # Protocol 2,1
> > # Cipher 3des
> > # Ciphers
> > aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
> > # EscapeChar ~
> > ~
> > 
> > file end
> > 
> > ~.ssh/config from the system which are
>  you using the ssh.
> > 
> > i am not able to see any config file only below are the list of files
> > available
> > 
> > authorized_keys id_rsa id_rsa.pub known_hosts
>
> are these files exist on the remote system?
>
> If the id_rsa.pub is the public key then
> diff authorized_keys id_rsa.pub
> should return nothing.
>
> But you said that in the remote system you have copied all the files under
> /root/.ssh to /home/user/.ssh.
> which means the remote server has the right public key information for the
> user.
> do a ls -ld on /home/user/.ssh /home/user and see if it is world-writable.
> If it is then you have two options
> a) make to be no-world-writable
> b) make sure the on sshd_config of the remote system you have StrictModes no,
> you shouldn't do that
>
> OK we checked that on remote system every thing is in place, let's go on the
> host you use ssh.
> are sure that you are using the right private key?
> when you access the remote
>  system as a root do you specify the identity/private
> key using ssh -i id_rsa?
> how do you use the ssh cmd in both cases?
>
> pavlos
>
>
>
>
> -- 
> To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org 
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

---

Yahoo! Photos ? NEW, now offering a quality print service from just 8p a photo.