Thursday, June 12, 2014

SSH key dilhemma

I repeatedly get the error "Server refused public-key signature despite accepting key!" in PuTTY when trying to connect to any of my servers, after adding my RSA public key to ~/.ssh/authorized_keys and making the appropriate sshd config changes. How can I enable RSA-based passwordless login for root?



authorized_keys:


Code:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlee0Cf1GhvdFckbuZJeFzMUnBXSzrJLVHtCcigsCLLPTMGKok​G2lxJnQMBsPd80qnAbiulMH+nwevDJoQStrxwcsl2mikikY3xwDhDozXYK0atEopFZBIWBIRuB3KjKna​mc0QPZbfi90kx2hqHkvzRBt5Czjy3FL17BPsrYXhrixtMdVqYhokuIK6XBvW8CUbGrzlvnBTLB6fCZdU​G+XjJCv7//jd+JDVbt7GKDnLlts7+JVk+edmsflTMOi1UIcKbXhDYJCpI1tsfpTklVwz28kFh5UBrG6ZqzcWm83yE7​TVXkyDmO98sYyz8d9VrZKJG9E0DfitrIH91iTmFE5h nopass2




sshd_config:


Code:

# Package generated configuration file

# See the sshd_config(5) manpage for details



# What ports, IPs and protocols we listen for

Port 22

# Use these options to restrict which interfaces/protocols sshd will bind to

#ListenAddress ::

#ListenAddress 0.0.0.0

Protocol 2

# HostKeys for protocol version 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_dsa_key

HostKey /etc/ssh/ssh_host_ecdsa_key

#Privilege Separation is turned on for security

UsePrivilegeSeparation yes



# Lifetime and size of ephemeral version 1 server key

KeyRegenerationInterval 3600

ServerKeyBits 768



# Logging

SyslogFacility AUTH

LogLevel INFO



# Authentication:

LoginGraceTime 120

PermitRootLogin yes

StrictModes no



RSAAuthentication yes

PubkeyAuthentication yes

AuthorizedKeysFile %h/.ssh/authorized_keys



# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts yes

# For this to work you will also need host keys in /etc/ssh_known_hosts

RhostsRSAAuthentication no

# similar for protocol version 2

HostbasedAuthentication no

# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication

IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)

PermitEmptyPasswords yes



# Change to yes to enable challenge-response passwords (beware issues with

# some PAM modules and threads)

ChallengeResponseAuthentication no



# Change to no to disable tunnelled clear text passwords

#PasswordAuthentication yes



# Kerberos options

#KerberosAuthentication no

#KerberosGetAFSToken no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes



# GSSAPI options

#GSSAPIAuthentication no

#GSSAPICleanupCredentials yes



X11Forwarding yes

X11DisplayOffset 10

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

#UseLogin no



#MaxStartups 10:30:60

#Banner /etc/issue.net



# Allow client to pass locale environment variables

AcceptEnv LANG LC_*



Subsystem sftp /usr/lib/openssh/sftp-server



# Set this to 'yes' to enable PAM authentication, account processing,

# and session processing. If this is enabled, PAM authentication will

# be allowed through the ChallengeResponseAuthentication and

# PasswordAuthentication. Depending on your PAM configuration,

# PAM authentication via ChallengeResponseAuthentication may bypass

# the setting of "PermitRootLogin without-password".

# If you just want the PAM account and session checks to run without

# PAM authentication, then enable this but set PasswordAuthentication

# and ChallengeResponseAuthentication to 'no'.

UsePAM yes




I am using PuTTY, Ubuntu 12.10, and OpenSSH

No comments:

Post a Comment