Frustrating SSH issue

permissions on ~/.ssh should be 700 (drwx------) authorized_keys should be 600 (--rw------), (but 400 as you have probably works)

my strategy when transferring keys is to do "umask 77" first then the permissions will come out as needed.

I think that the lack of a password may well be the problem. It sounds to me as if the account may be locked... man {usermod,useradd} may help.

I take your point regarding the directory permissions, but as I said, both are the same, yet from one account it works, from the other it doesn't, so I'm not sure that being over generous on the permissions is the issue. I've just tried changing to drwx------ and it doesn't make any difference.

Adrian

Thanks for the suggestion. I've given Harry a password, and unlocked the account, but still no joy.

Adrian

Does /var/log/auth.log give a clue? You may need to enable logging in sshd first, i.e. no # comment signs for the log statements as below

/etc/ssh/sshd_config: # Logging SyslogFacility AUTH LogLevel INFO

Rob

Logging was already working.

I logged onto Pi 1 and set tail -f running on the log file.

Then from Pi 2, I ssh'd from Dick's account, and the log file gave :

Accepted publickey from tom from port ssh2

I then tried to ssh from Harry's account, and the log file didn't register at all until I entered Tom's password, at which point I got :

Accepted password for tom ...

Nothing in /var/log on Pi 2 has any messages relating to the SSH attempts

Adrian

In message , Jim Price writes

No user config files. ~/.ssh only has authorized_keys, known_hosts and the users own key files (although Harry shouldn't need them).

I've already tried giving Harry a password (and unlocking the account), and that makes no difference.

Adrian

If the files are identical the problem is permissions. perhaps you have wrong ownership or permissions on the home directory of the the user. ssh is very fussy about permissions.

Thanks for the suggestion.

Both have drwxr-xr-x

However dick is owned by dick in group dick harry is root / root. Changing it to harry / harry doesn't make any difference.

Adrian

Turn on verbose logging in the ssh config on both machines, repeat the attempted login for each account and compare the results. Where they diverge should reveal where the problem is. Post the relevant output here if you need any help with it. You might also find one of the many available diff programs useful to see where the logging diverges. We're about finished with the usual suspects when it comes to being able to diagnose the problem with insufficient clues.

try this: chown -R harry:harry ~harry/.ssh chmod -R uo-rwx ~harry/.ssh

Also check /etc/ssh/sshd_config to see if there's login restrictions by "allowgroups" or "allowusers".

??? A public key is -as the name says- supposed to be publicly known. Hence knowledge of Tom's public key can not be used by Dick to gain access to Tom's account.

To give a remote user access to an account the account owner must put the remote user's public key in her/his authorized_keys file. By doing so the account owner says: "I trust the owner of the accompanied private key to log into my account." The remote user uses her/his own private key to authorize.

If Dick is able to log into Tom's account without a password you must have done something else than giving Tom's public key to Dick (like putting Dick's public key in Tom's authorized_keys file).

That is expected behavior. Put Harry's public key in Tom's authorized_keys file to give Harry access to Tom's account without a password.

As a side note: If your public key could be used to gain access of your account then it would be impossible to withdraw a particular user's access rights without changing your own public/private key pair. And that would deny access to everybody instead of only that particular user.

Regards,

Kees.

In message , Adrian writes

Rather than replying in each subthread, an overall reply.

It seems that I'm stupid.

Kees Theunissen has hit the nail on the head, I was sharing the wrong keys. Tom and Dick had swapped keys, so both could ssh to each other, but Harry only had Tom's, whereas what was actually need was for Tom to have Harry's. Having given Tom Harry's key, it now works.

Many thanks to those who have taken the time to assist.

Adrian

In a mad moment - Adrian mumbled :

Time to check on what Bob and Alice were up to ? ;))

Have you tried giving both users the same primary group, say 'users'? Don't forget that you'll need to run

sudo chown -R dick.users /home/dick sudo chown -R harry.users /home/harry after you've changed the prime group for both users.

Ask Eve, she works for NSA.

With Charlie.

-- mrr

On Sun, 5 Jan 2014 03:35:48 +0100, Morten Reistad declaimed the following:

I'd refrained from commenting that Eve is just a victim -- it's the serpent that works for the NSA...

Because it's inconvenient to get up and walk 2 steps between the PC & pi to move data via a USBstik, I wanted to 'interconnect them'. Although I yielded to the absurdity of using the NationalRailway/ethernet to interconnect them, doesn't mean I'll now use SECURE-ENCRYPTION to inter-operate. Screw you!! Why can't you people SIMPLIFY?