Sign in

why does ssh ignore the key i literally just added?

Solvedauthenticationlinuxssh18 replies · 296 views · started
Reply
Accepted solution by Camila S. — in CI, private keys pasted as secrets often lose the trailing newline or get CRLF line endings. make sure the key file ends with a newline…
  1. Dev V.
    @dev.vance

    trying to SSH from Windows Terminal into the backup server and i get:

    Permission denied (publickey)... i added my public key to authorized_keys, double-checked it's the right one, even regenerated it once.. 🔥 password login is disabled so i can't get in any other way. what did i do wrong??

    Ive checked the key fingerprint against the one on the server and they look the same. Im stuck oustide a box I need to fix today, with nothing but this error. Any debugging approach would be very welcome.

    facepalm

    2
  2. Mateo Castillo
    @tiny_shed

    uhh which user are you connecting as, and whose authorized_keys did the key go into? ?

    1 6 helpful
  4. Dev V.
    @dev.vance
    in reply to @fenna_lambda

    -vvv shows Windows Terminal offering a different key from my agent, never the one i added. sorry for the wall of text lol

    0 1 helpful
  5. Zora Fontaine
    @lucky_pusher222

    Watch the username. Cloud images use default users like ubuntu, ec2-user, admin or debian. Connecting as root or your own name with a key thats only in the default users authorized_keys fails with exactly this error.

    2 1 helpful
  6. Camila S.
    @camila.sato52
    in reply to @lucky_pusher222

    run the client in verbose mode first:

    ssh -vvv user@host

    look for Offering public key: lines 🔥 if your key is never offered, the client isn't using it: pass -i ~/.ssh/id_ed25519 or set IdentityFile in ~/.ssh/config, if its offered and rejected, the server side is teh problem.

    2 0 helpful
  7. Diego
    @packetloop

    oh ive been there lol for me it was the firmware. swapped it and boom, fixed worked for me anyway 🤷

    6 1 helpful
  8. Clara Ortiz
    @cortiz
    in reply to @packetloop

    been there man newer OpenSSH versions disable ssh-rsa signatures using SHA-1 by default. very old clients or libraries (some older CI tools) may only offer that, so teh server refuses. prefer an ed25519 key, or upgrade teh client. lmk how it goes

    3 0 helpful
  10. Camila S.
    @camila.sato52

    hmm idk respectfully disagree, i tried that and it made windows worse

    13 0 helpful
  11. Kai Yilmaz
    @kyilmaz

    oh also i come back to this thread every week just for the drama

    0 2 helpful
  12. Anika
    @copper_rider

    @ash_socket did u ever fix it? ?

    thinking

    4 0 helpful
  13. Zora Fontaine
    @lucky_pusher222

    sshd is strict about permissions (StrictModes yes)... on the server: chmod 700 ~/.ssh, chmod 600 ~/.ssh/authorized_keys, and teh home directory must not be group- or world-writable, ownership must be the user, not root.

    4 0 helpful
  14. Ash
    @ash_socket

    Check the server log while you try to connect: sudo journalctl -u ssh -f (or -u sshd on RHEL family, /var/log/auth.log on older Debian/Ubuntu). It says exactly why: bad ownership, wrong user, key type not accepted.

    4 0 helpful
  15. Noah Wolfe
    @quiet_monk-1ms

    been there man bump. still happening with ssh for me. i swear server is cursed

    4 0 helpful
  16. Noah Wolfe
    @quiet_monk-1ms

    oh ive been there lol this. so much this

    0 5 helpful
  17. Camila S.
    @camila.sato52
    Accepted solution

    in CI, private keys pasted as secrets often lose the trailing newline or get CRLF line endings. make sure the key file ends with a newline and has 600 permissions, or the client silently skips it.

    5 6 helpful
  18. Fenna R.
    @fenna_lambda

    Id move away from managing authorized_keys by hand entirely and use SSH certificates or a cloud sessoin manager. fewer of these surprises. idk maybe im wrong lol

    11 0 helpful
  19. Dev V.
    @dev.vance
    in reply to @camila.sato52

    @camila.sato52 omggg fixed teh home directory permissions and the key was accepted instantly :D StrictModes strikes again.

    5 0 helpful

Reply to this topic

Sign in or create an account to reply.