Linux – SSH public/private authentication failing in Google compute engine instances

authenticationgoogle-compute-enginelinuxsshUbuntu

I have two instances (host names are namenode and datanode1 ) of Ubuntu 14.04 LTS running on Google compute engine.
I am struggling setting up ssh root access to between them.

I am providing some information so you can help me solve this issue

I generated the key pair (namenode, namenode.pub) on namenode. The public key on namenode looks like this

root@namenode:~# cat .ssh/namenode.pub 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsxYETzfP3Kv9QgRZ5AnJGu6LNTuAJj67DhUzJVad1Cis7qQ7X7GSv1S+HQESiK/H1u3duVunMB+eiV1ktF/V42r5o3HCTTckiChSuu4B+wkHCqaHFYtGJZIMncPb4CvuyhzPz+Zb
mlV7YRGqw5lO+cQLSxCQpmBkIR1iQHRbtLIRenUTI3cXnJ22OhRea63R1/d+LspJreI8lnfmVLMr3MLUfi/U2vX3kR2EaH1QAoO1+dnRzuqsZE/ehbzT/DfBifRdoRCzhXuWgNKNxc/O0V3MwflnvPaWxxDC7FNQ7//nFg4gl8j4yV8
XFvuCyzJTQ9nS3wN+6Dms7MfDQtl4v root@namenode

I added this public key to datanode1's authorized keys.

root@datanode1:~# cat .ssh/authorized_keys 
# namenode
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsxYETzfP3Kv9QgRZ5AnJGu6LNTuAJj67DhUzJVad1Cis7qQ7X7GSv1S+HQESiK/H1u3duVunMB
+eiV1ktF/V42r5o3HCTTckiChSuu4B+wkHCqaHFYtGJZIMncPb4CvuyhzPz+ZbmlV7YRGqw5lO+cQLSxCQpmBkIR1iQHRbtLIRenUTI3cXnJ22OhR
ea63R1/d+LspJreI8lnfmVLMr3MLUfi/U2vX3kR2EaH1QAoO1+dnRzuqsZE/ehbzT/DfBifRdoRCzhXuWgNKNxc/O0V3MwflnvPaWxxDC7FNQ7//n
Fg4gl8j4yV8XFvuCyzJTQ9nS3wN+6Dms7MfDQtl4v root@namenode

I addded the identity like this

root@namenode:~# eval `ssh-agent -s`
Agent pid 4030
root@namenode:~# ssh-add .ssh/namenode
Identity added: .ssh/namenode (.ssh/namenode)

this is the verbose output 

root@namenode:~# ssh -v -i .ssh/namenode.pub root@datanode1
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to datanode1 [10.240.218.126] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file .ssh/namenode.pub type 1
debug1: identity file .ssh/namenode.pub-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA b8:70:6e:f6:8c:4e:8e:ed:2b:46:d6:d4:d9:4d:ec:bb
debug1: Host 'datanode1' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:4
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: .ssh/namenode.pub
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).

the permissions for the authorized keys on datanode1 is

-rw------- 1 root root 3695 Mar 19 18:53 .ssh/authorized_keys

Please help me solve this. I have been struggling since 2 days.

Best Answer

ssh -v -i .ssh/namenode.pub root@datanode1

When you specify an ssh key on the command line, it should be the private key file, not the public file. So you should reference .ssh/namenode here, not .ssh/namenode.pub.

It looks like you added the private key to ssh-add, but there's no indication in the ssh debug trace that it communicated with the ssh agent or offered the private key to the remote server. Perhaps you ran ssh in a different session (terminal window) from the ssh-add command, so that ssh didn't have access to the environment variables telling it how to access the agent.

Finally, the contents of the namenode.pub line is one long line. Make sure you copied it into the remote authorized_keys file as one long line, instead of three lines.

Related Topic