Ubuntu – ssh: “Agent admitted failure to sign using the key”

passwordremote-accesssshUbuntu

I'm trying to set up password-less login with ssh on Ubuntu Server,
but I keep getting:

Agent admitted failure to sign using the key

and prompt for password.

I have generated new rsa keys. Before the system reboot it worked just fine.

All the links lead me to this bug, but nothing works. SSH Agent is still not running.

How to fix that? Maybe the files need specific permissions?

Best Answer

This problem involves two machines. WHich was re-booted? ssh-add will only add the key on the client. If the key isn't accepted, there isn't a client error and a server error will only show up if the -v option is used when ssh is invoked on the client, to request the connection.

I suppose its possible too that Ubuntu the package has, for some unknown reason, altered the error message shown. It isn't an error issued by openSSH-server, as it is used in Debian (or anywhere else I've seen it, e.g. RHEL, CentOS, Knoppix, others).

Related Solutions

SSH-Key Login – Requiring from Specific IP Ranges

Not sure how PAM would need to fit into this. With a recent version of SSH (like what is available on 8.04) it should be as easy as using a Match blocks for the address space you wish to allow.

So your sshd_config should contain something like this.

# global option no password auth (keys only)
PasswordAuthentication no

# permit password from rfc1918
Match Address 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
  PasswordAuthentication yes

Ubuntu – SSH-agent & SSH-add at reboot

You would need to leave the pass-phrase on the ssh key blank when you create it. That way you won't need to use ssh-agent. Clearly there are security implications of that choice - but ssh-agent will always require you to enter the pass-phrase first time if the key is protected.

Technically, you could probably use expect to pass a pass-phrase to ssh-agent from a script - but if you're prepared to put your pass-phrase into a script you may as well just leave it blank.

The usual way to improve security if you follow this route is to only allow the key in question access to a specifically crafted / restricted account on the other server.

Best Answer

Related Solutions

SSH-Key Login – Requiring from Specific IP Ranges

Ubuntu – SSH-agent & SSH-add at reboot

Related Topic