Sign in

why does ssh ignore the key i literally just added?

Solvedauthenticationlinuxssh18 replies 路 314 views 路 started
Reply

Accepted solution

by Camila S.Jump to the reply

in CI, private keys pasted as secrets often lose the trailing newline or get CRLF line endings. make sure the key file ends with a newline and has 600 permissions, or the client silently skips it.

  1. Dev V.
    @dev.vance

    trying to SSH from Windows Terminal into the backup server and i get:

    Permission denied (publickey)... i added my public key to authorized_keys, double-checked it's the right one, even regenerated it once.. 馃敟 password login is disabled so i can't get in any other way. what did i do wrong??

    Ive checked the key fingerprint against the one on the server and they look the same. Im stuck oustide a box I need to fix today, with nothing but this error. Any debugging approach would be very welcome.

    facepalm

    2
  2. Mateo Castillo
    @tiny_shed

    uhh which user are you connecting as, and whose authorized_keys did the key go into? ?

    1 6 helpful
  4. Dev V.
    @dev.vance
    in reply to @fenna_lambda

    -vvv shows Windows Terminal offering a different key from my agent, never the one i added. sorry for the wall of text lol

    0 1 helpful
  5. Zora Fontaine
    @lucky_pusher222

    Watch the username. Cloud images use default users like ubuntu, ec2-user, admin or debian. Connecting as root or your own name with a key thats only in the default users authorized_keys fails with exactly this error.

    2 1 helpful
  6. Camila S.
    @camila.sato52
    in reply to @lucky_pusher222

    run the client in verbose mode first:

    ssh -vvv user@host

    look for Offering public key: lines 馃敟 if your key is never offered, the client isn't using it: pass -i ~/.ssh/id_ed25519 or set IdentityFile in ~/.ssh/config, if its offered and rejected, the server side is teh problem.

    2 0 helpful
  7. Diego
    @packetloop

    oh ive been there lol for me it was the firmware. swapped it and boom, fixed worked for me anyway 馃し

    6 2 helpful
  8. Clara Ortiz
    @cortiz
    in reply to @packetloop

    been there man newer OpenSSH versions disable ssh-rsa signatures using SHA-1 by default. very old clients or libraries (some older CI tools) may only offer that, so teh server refuses. prefer an ed25519 key, or upgrade teh client. lmk how it goes

    3 0 helpful
  10. Camila S.
    @camila.sato52

    hmm idk respectfully disagree, i tried that and it made windows worse

    13 0 helpful
  11. Kai Yilmaz
    @kyilmaz

    oh also i come back to this thread every week just for the drama

    0 2 helpful
  12. Anika
    @copper_rider

    @ash_socket did u ever fix it? ?

    thinking

    4 0 helpful
  13. Zora Fontaine
    @lucky_pusher222

    sshd is strict about permissions (StrictModes yes)... on the server: chmod 700 ~/.ssh, chmod 600 ~/.ssh/authorized_keys, and teh home directory must not be group- or world-writable, ownership must be the user, not root.

    4 0 helpful
  14. Ash
    @ash_socket

    Check the server log while you try to connect: sudo journalctl -u ssh -f (or -u sshd on RHEL family, /var/log/auth.log on older Debian/Ubuntu). It says exactly why: bad ownership, wrong user, key type not accepted.

    4 0 helpful
  15. Noah Wolfe
    @quiet_monk-1ms

    been there man bump. still happening with ssh for me. i swear server is cursed

    4 0 helpful
  16. Noah Wolfe
    @quiet_monk-1ms

    oh ive been there lol this. so much this

    0 5 helpful
  17. Camila S.
    @camila.sato52
    Accepted solution

    in CI, private keys pasted as secrets often lose the trailing newline or get CRLF line endings. make sure the key file ends with a newline and has 600 permissions, or the client silently skips it.

    6 6 helpful
  18. Fenna R.
    @fenna_lambda

    Id move away from managing authorized_keys by hand entirely and use SSH certificates or a cloud sessoin manager. fewer of these surprises. idk maybe im wrong lol

    12 1 helpful
  19. Dev V.
    @dev.vance
    in reply to @camila.sato52

    @camila.sato52 omggg fixed teh home directory permissions and the key was accepted instantly :D StrictModes strikes again.

    5 0 helpful
Read next 路 Defensive Security & Access Management
a remote salesperson gets locked out right after a password change. we unlock. it happens again
Solved 路 14 replies
Read

Reply to this topic

Sign in or create an account to reply.