SSH doesn’t work with the key for an user but works for another

authenticationsshssh-keysubuntu-12.04

Server (Ubuntu):

~/.ssh/authorized_keys file (on issue-user):

  • just one public key on one single line. No extra lines! No comments!
  • correct user/group owner
  • 644 rights

Local Machine (Windows 7):

  • works with the git user on the same server
  • doesn't work with the issue-user
  • the key pairs match

After running ssh issue-user@domain.com -vvv:

debug2: key: /c/***/***/.ssh/identity (0x0)
debug2: key: /c/***/***/.ssh/id_rsa (0x0)
debug2: key: /c/***/***/.ssh/id_dsa (0x0)
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /c/***/***/.ssh/identity
debug3: no such identity: /c/***/***/.ssh/identity
debug1: Trying private key: /c/***/***/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug3: sign_and_send_pubkey
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /c/***/***/.ssh/id_dsa
debug3: no such identity: /c/***/***/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

The id_rsa key file is definitely there: /c/***/***/.ssh/id_rsa

Best Answer

There is a problem in permissions on keys, parent directories and/or home directories of the two mentioned users. My server (Gentoo) explicitly forbids publicly readable keys.

Permissions on home should be o-rwx, on .ssh directory holding keys permissions should be 0700 and on the key file authorized_keys permissions should be 0640.

SSHD would log such problem into auth.log (depending on your syslog configuration).

Related Topic