Sign in

IS IT MY KEY, THE SERVER, OR WSL2? A PUBLICKEY MYSTERY

Solvedauthenticationlinuxssh14 replies · 377 views · started
Reply

Accepted solution

by Kofi SorensenJump to the reply

lol same thing happened to me newer OpenSSH versions disable ssh-rsa signatures using SHA-1 by default. Very old clients or libraries (some older CI tools) may only offer that, so teh server refuses. Prefer an ed25519 key, or upgrade teh client.

  1. Alba
    @aholm-23u

    hmmmm ok trying to SSH from WSL2 into a new EC2 instance and i get:

    Permission denied (publickey). I added my public key to authorized_keys, double-checked it's the right one, even regenerated it once. Password login is disabled so I can't get in any other way. What did I do wrong?

    Ive checked the key fingerprint against the one on the server and they look the same. Im stuck outside a box i need to fix today, with nothing but this error. Any debugging approach would be very welcome.

    14
  2. Hugo Rossi
    @hugor167

    wait which user are you connecting as, and whose authorized_keys did the key go into?? ??

    2 0 helpful
  3. Jonas Kaur
    @night_pusher312

    how is this thread still going lmao :/ have u checked your instance settings?? mine were reset after an update :)

    0 2 helpful
  5. Kofi Sorensen
    @patchrider

    help!! ok this thread just saved my weekend

    3 0 helpful
  6. Silas Weber
    @silas.weber

    ahh classic check the server log while u try to connect: sudo journalctl -u ssh -f (or -u sshd on RHEL family, /var/log/auth.log on older Debian/Ubuntu). it says exactly why: bad ownership, wrong user, key type not accepted.

    thumbsup

    0 1 helpful
  7. Ruben D.
    @rubend529

    sshd is strict about permissions (StrictModes yes), on the server: chmod 700 ~/.ssh, chmod 600 ~/.ssh/authorized_keys, and the home directory must not be group- or world-writable. ownership must be teh user, not root. lmk how it goes

    5 5 helpful
  9. Ruben D.
    @rubend529

    oh ive been there lol run teh client in verbose mode first:

    ssh -vvv user@host

    look for Offering public key: lines. If your key is never offered, teh client isnt using it: pass -i ~/.ssh/id_ed25519 or set IdentityFile in ~/.ssh/config... if its offered and rejected, teh server side is the problem.

    thinking

    1 0 helpful
  10. Daria
    @dhaddad

    honestly just reset the DNS and save yourself the pain. +1 same here lmk how it goes

    thinking

    1 0 helpful
  11. Pia Haddad
    @pia_lucky
    in reply to @dhaddad

    Watch the username. Cloud images use default users like ubuntu, ec2-user, admin or debian... connecting as root or your own name with a key thats only in the default users authorized_keys fails with exactly this error.

    5 2 helpful
  12. Jonas Kaur
    @night_pusher312

    holy cow ok update: did what @mateoj261 said and its fine now cant believe it was that simple lol

    thumbsup

    0 6 helpful
  13. Kofi Sorensen
    @patchrider
    in reply to @night_pusher312 Accepted solution

    lol same thing happened to me newer OpenSSH versions disable ssh-rsa signatures using SHA-1 by default. Very old clients or libraries (some older CI tools) may only offer that, so teh server refuses. Prefer an ed25519 key, or upgrade teh client.

    4 4 helpful
  15. Alba
    @aholm-23u
    in reply to @patchrider

    @patchrider omg finally the CI secret was missing its final newline. fixed it and teh depoly step connects again. thx everyone!

    5 0 helpful
Read next · Defensive Security & Access Management
unable to get local issuer certificate. but the cert is new!
Solved · 8 replies
Read

Reply to this topic

Sign in or create an account to reply.