6

I am trying to connect via SSH to my ubuntu server with public key authentication. For some reasons I get an "Permission denied (publickey)." on the client, whenever I execute

ssh -i ~/.ssh/id_rsa <username>@<ip> -p <port>.

The auth.log on my server has the following output:

sshd[1425]: Connection closed by <client-ip> [preauth]

But as soon as I login physically on my server, with the samer username, the following ssh connection from my client successes. But as soon as I logout physically, the next ssh session from my client fails.

/etc/ssh/sshd_config

# What ports, IPs and protocols we listen for
Port <port>
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no

PermitEmptyPasswords no
ChallengeResponseAuthentication no

PasswordAuthentication no

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM no

ClientAliveInterval 30
ClientAliveCountMax 99999

Any clues why this could happen? Or do you have any recommendations according security? Thank you!

countermode
  • 7,373
  • 5
  • 31
  • 58
caiuspb
  • 163
  • 1
  • 5
  • 1
    Try putting sshd in debug mode. Usually this spews to the current terminal; but in your case you might try: /usr/bin/sshd -d 2>&1 > ssh_debug.session. sshd will tell you what files it's trying to open and whether there are issues. Please note that sshd in debug will only answer one connection and then die; so be careful not to shoot yourself in the foot. – ericx Aug 28 '14 at 16:57
  • 2
    Do you have anything like `autofs` set up on the server? – Bratchley Aug 28 '14 at 17:11
  • 3
    In addition to what @JoelDavis said, do you have an encrypted home being mounted with something like [pam_mount](http://pam-mount.sourceforge.net/)? – phemmer Aug 28 '14 at 17:13
  • Hi .. thanks four your replies. @Patrick I guess it's going into the right direction. My home is encrypted. Additionally, my sshd config contains `UsePAM no`. I guess it has to say `yes`. But what about the security? I do not want to allow PW authentication. – caiuspb Aug 28 '14 at 17:38
  • Yep .. my encrypted home was keeping me away from a proper ssh login ;) I used https://help.ubuntu.com/community/SSH/OpenSSH/Keys to fix that issue. Thanks. – caiuspb Aug 28 '14 at 18:04
  • Just go for the most `no` and the least possible `yes`. `sudo nano /etc/ssh/sshd_config.d/50-redhat.conf; sudo systemctl restart sshd.service` `ChallengeResponseAuthentication no` `PasswordAuthentication no` `PermitEmptyPasswords no` `PubkeyAuthentication yes` `UsePAM no` ...enables you to login with your private key only and even though the user has a password, the password login is always denied. – Alex Jul 05 '21 at 00:26

1 Answers1

11

As mentioned in the comment, you're using an encrypted home directory, and are likely using pam_mount to mount it.
pam_mount mounts the partition using the password acquired during login. Since you're trying to log in via ssh public keys there are 2 issues:

  1. There is no password being sent during public key authentication, so it can't mount your home directory using it.
  2. When using pam_mount, your home directory is mounted after login, but sshd needs to get your authorized_keys file before login, and thus it's not mounted.

Either of these issues is enough to prevent it from working.

The only solution is to get your public keys out of the home directory. This is actually rather simple.

First copy the authorized_keys file out of the home directory:

cp -a /home/$USER/.ssh/authorized_keys /home/$USER-authorized_keys

Then tell sshd to use that file by adding the following to /etc/ssh/sshd_config (replace existing entry if present):

AuthorizedKeysFile .ssh/authorized_keys /home/%u-authorized_keys

And bounce sshd.

Note however that this will not mount your home directory. Your home directory still needs your password to decrypt. Depending on how you have pam_mount configured, it might prompt you for your password, or it might just drop you into a shell with your home unmounted.

phemmer
  • 70,657
  • 19
  • 188
  • 223
  • 1
    "Note however that this will not mount your home directory." <- in that case: when will a password prompt occur? already tried to configure "" but it won't start mounting it automatically via pam_mount after ssh login with public key auth – Master of Celebration Mar 23 '17 at 10:25