I am trying to setup password less login from my Mac OS X to to Ubuntu VM created by Virtual-box. I am using NAT->port forwarding option in VM and have host port as 3022. When I do      ssh -p 3022 ubuntu@127.0.0.1   from my local and I can able to login to ubuntu with password, and this works vice versa.  Now I have created public/private key file in my Mac and copied the pub key to VM (ubuntu/.ssh/authorized_keys)  So now when I do:  ssh -p 3022 ubuntu@127.0.0.1   and it's asking for the password again.  I verified the key from id_rsa.pub vs VM authorized_keys and key is same in both places  Can someone tell me if I am making any mistake in my steps?
69227
How do I set up SSH so I don't have to type my password when connecting to a host?
726
I'm having some issues SSH'ing to a server when logged into a particular VM.  From my local PC, I can log in to the server just fine using the command ssh -i .ssh/[my private key] username@domain.  If I then SSH into another unrelated server which also has the same private key and run the above command it will also log in just fine in to the server.  But, when I SSH into a particular OpenStack VM (again has the same private key) on the unrelated server and then SSH in to the server from there I start getting prompted for a passphrase. But a passphrase hasn't been set for the key so inevitably I get a "Permission denied (publickey)." error.  To double check, I removed the private key from the VM and scp'd the private key from my PC into it again and tried the same command I still get prompted for a passphrase.  In other words:   PC - SSH - Server1 = Works fine  PC - SSH - Server2 - SSH - Server1 =     Works fine  PC - SSH - Server2 - SSH - Virtual Machine - SSH - Server 1 =         Asks for a passphrase   What could be the reason behind this? It's definitely the right private key I'm using and it has the appropriate permissions.  Edit - Output of ssh -v -i .ssh/[my private key] username@domain as requested  OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 58: Applying options for * debug1: Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 22. debug1: Connection established. debug1: key_load_public: No such file or directory debug1: identity file /.ssh/[my private key].ppk type -1 debug1: key_load_public: No such file or directory debug1: identity file /.ssh/[my private key].ppk-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.4 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000 debug1: Authenticating to xxx.xxx.xxx.xxx:22 as '[my username]' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: algorithm: curve25519-sha256@libssh.org debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server-&gt;client cipher: chacha20-poly1305@openssh.com MAC: &lt;implicit&gt; compression: none debug1: kex: client-&gt;server cipher: chacha20-poly1305@openssh.com MAC: &lt;implicit&gt; compression: none debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64 debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:ZiugTjR5fM0E3evOwHoePFKspDQChA0Ab6L0q88KP/g debug1: Host 'xxx.xxx.xxx.xxx' is known and matches the ECDSA host key. debug1: Found key in /home/centos/.ssh/known_hosts:2 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: rekey after 134217728 blocks debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs=&lt;rsa-sha2-256,rsa-sha2-512&gt; debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey debug1: Trying private key: /.ssh/[my private key].ppk Enter passphrase for key '/.ssh/[my private key].ppk': Enter passphrase for key '/.ssh/[my private key].ppk': Enter passphrase for key '/.ssh/[my private key].ppk': debug1: No more authentication methods to try. Permission denied (publickey).
7606
I am trying to virtualize an old linux server, and the PtoV software requires a password login as root via ssh. However, the root login is being prevented with a "Permission Denied" error on the client end, and a "Failed Password for root" on the server end (when sshd is running in debug mode).  I HAVE set PermitRootLogin yes in /etc/ssh/sshd_config.  This is an old RedHat 7.3 server that has had hardening scripts like Bastille run on it years and years ago, and has many remnants of old OS's (like ipchains - no longer supported by the kernel) lying around. All to say I have little idea what has been altered from the original system, but there is a lot.   I can log in fine as root from the console I can su to root fine from within the console or ssh session I can ssh fine as a regular user.   My question is: What else could be preventing my root login on this server?  More information: /etc/pam.d/sshd   auth       required     pam_stack.so service=system-auth  auth       required     pam_nologin.so  account    required     pam_stack.so service=system-auth  password   required     pam_stack.so service=system-auth  session    required     pam_stack.so service=system-auth  session    required     pam_limits.so  session    optional     pam_console.so   /etc/pam.d/system-auth  auth        required      /lib/security/pam_env.so auth        sufficient    /lib/security/pam_unix.so likeauth nullok auth        required      /lib/security/pam_deny.so account     required      /lib/security/pam_unix.so password    required      /lib/security/pam_cracklib.so retry=3 type= password    sufficient    /lib/security/pam_unix.so nullok use_authtok md5 shadow password    required      /lib/security/pam_deny.so session     required      /lib/security/pam_limits.so session     required      /lib/security/pam_unix.so     Can anybody tell me if the hashing algorithm could be the culprit?  Keeping in mind that I can log in as an unprivileged user.
93721
How to automate SSH login with password? I'm configuring my test VM, so heavy security is not considered. SSH chosen for acceptable security with minimal configuration.  ex)  echo password | ssh id@server   This doesn't work.  I remember I did this with some tricks somebody guided me, but I can't remember now the trick I used...
79709
I tried to create a user with password via ssh (with root permission) like this:  ssh root@123.45.6.7 useradd -p $(openssl passwd -1 1234) newuser   By doing so, I could successfully create an account named newuser, but I couldn't login with the expected password (which is 1234)  It makes no difference if I add double quotes:    ssh root@123.45.6.7 "useradd -p $(openssl passwd -1 1234) newuser"   And then I was wondering if I can generate hashed password and save it as a variable locally, but still with no luck.  password=$(openssl passwd -1 1234) ssh root@123.45.6.7 "useradd -p $password newuser"   Is there something that I miss? Thanks in advance!
15332
I have a remote server. I planned to use public keys to connect over ssh without typing the password but the remote system rejects public key authentication.  So what is the best way to do it? What about using sshpass?
112805
While trying to communicate between my desktop Ubuntu 12.10 and Fedora 19 desktop, I am facing the error of Permission Denied (Public key). I am able to login through ssh from fedora to Ubuntu, but not vice-versa. I even performed telnet on both machines via port 22 and both machines are listening, but not through ssh. What to do? Any idea?  My sshd_config file is as follows:  # Package generated configuration file # See the sshd_config(5) manpage for details  # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes  # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768  # Logging SyslogFacility AUTH LogLevel INFO  # Authentication: LoginGraceTime 120 PermitRootLogin yes StrictModes yes  RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile    %h/.ssh/authorized_keys  # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes  # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no  # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no  # Change to no to disable tunnelled clear text passwords PasswordAuthentication yes  # Kerberos options #KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes  # GSSAPI options GSSAPIAuthentication no GSSAPICleanupCredentials yes  X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no  #MaxStartups 10:30:60 #Banner /etc/issue.net  # Allow client to pass locale environment variables AcceptEnv LANG LC_*  Subsystem sftp /usr/lib/openssh/sftp-server  # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication.  Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM yes   This is sshd_config of ubuntu system.
104257
What is the best way to SSH to my sever behind company proxy , it seems that 22 port is not opened by default , is there any simple way to do that rather than to install corkscrew ??   When I do :   ✗ ssh -i ~/.ec2/mykey.pem ubuntu@XX.XX.XXX.XXX ssh: connect to host XX.XX.XXX.XXX port 22: Operation timed out
70271
So I set up passwordless ssh using the following:   After setting this up, I'd expect that I wouldn't need a password to ssh.  My issue is that on my first connection to ssh, it will ask me for a password, but additional sessions on top of that will not ask for a password.    I've already checked my sshd_config to make sure that it contains:  RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile  %h/.ssh/authorized_keys   Pretty sure my permissions are right, because if they weren't then passwordless ssh wouldn't be working at all.  To add more "fun" to this problem, I noticed that when I restart my computer (either the client computer or the ssh server computer), sometimes it will work.  Then when I shut down the computer and try it again the next day, it doesn't work anymore.  Maybe this is completely random, but it's something I've noticed.
88684
I can't do ssh public key login to my server and I think this issue is related to the fact my home is encrypted. I chose the option "encrypt my home folder" under the Ubuntu install setup. The permissions on /home/MY-USER are 700.  I've tried another workstation and everything works fine. I would be glad if someone help me to get out this without removing the encryption.
12843
I (for a test) just randomly altered a private RSA key by opening it up in Vim and changing a few bytes. It is the private part of an SSH key pair used for logging in on a remote system. Puzzlingly, it still allows me to login.  I did some research and found that it is a base64 encoded ASN.1 container, so I pulled all the relevant integers out with OpenSSL and it seems only $d$, the private exponent, has changed (and only slightly at that). Is it possible the additional cached values are therefore being used to decrypt the value sent from the server, in order to still allow me to be logging in? The public key can (as expected) still be derived due to the other integers in the ASN.1 still being the same.  As I'm an encryption dufus I'd appreciate some guidance on how the above is possible. I've found when I modify the key in Vim by larger amounts it rejects me as expected. Thanks.
45515
I need to use another computer to access my ssh server. This is because a recently implemented vpn at my university doesn't work on my current computer and I have lost access to the server.   I ssh via encrypted ssh keys. Can I copy these keys to the new computer (on which the vpn works). I tried copying the id_rsa and id_rsa.pub files in the ~/.ssh folder but it doesn't recognize the keys and there is no prompt to input a password to decrypt the keys.   EDIT: I can't access the server to generate a new key pair for the new computer and am out of the country so can't physically access it.   Thanks.
117812
I have set up an EC2 instance with ArchLinux for a client, and I am currently in the testing phase.   I am using PuTTY from Windows 8 to SSH into the machine. I have set up the connection profile correctly, and specified the correct key file.   When trying to login, I am presented with the option to choose which user I want to login as. I choose "root" and the connection proceeds with no problem, though I am not asked for the root password.  I want to forbid root logins, but when trying to login as any other user I get from the system:  Server refused our key   Also I get a popup window saying:  Disconnected: No supported authentication methods available (server sent: publickey)   Why is it that I cannot login as any other user? It is very important for me to forbid root logins.   On a side note, is it normal that I am not prompted for the root password?
119615
Let's say there are two keys A and B, both of which are valid for user@host public key authentication. Since authorized_keys is configured for different behaviour depending on the key, ~/.ssh/config on the client uses something like  Host A.host     HostName host     User user     IdentityFile ~/.ssh/A Host B.host     HostName host     User user     IdentityFile ~/.ssh/B   That works fine. However, the moment I use ssh-agent and add both keys A and B (e.g. in order to enter their passphrases at login instead of when I call the respective ssh A.host or ssh B.host), the connection will always use the same id for both virtual hosts. Is there any way to specify which stored key ssh should use from ssh-agent without having to remove the other key?
48159
Some of my Linux &amp; FreeBSD systems have dozens of users. Staff will use these "ssh gateway" nodes to SSH into other internal servers.  We're concerned that some of these people use an unencrypted private SSH key (A key without a . , because if a cracker ever gained access to their account on this machine, they could steal the private key and now have access to any machine which uses this same key. For security reasons, we require all users to encrypt their private SSH keys with a passphrase.  How can I tell if a private key is not-encrypted (e.g. Does not contain a passphrase)? Is there a different method to do this on an ASCII-armored key vs. a non-ASCII-armored key?  Update:  To clarify, assume I have superuser access on the machine and I can read everybody's private keys.
26637
I use Ubuntu 16.04 and seek to harden my SSH authentication in a special manner.  The current situation:  I have a machine with a minimal Ubuntu server I use mainly to transfer files to via its local OpenSSH server. Now, I don't have a firewall on that machine from a few reasons and I also avoid using a key pair hence I use only a password. One of the only ways I have left to defend from brute force attacks, and the one I most desire at the moment, is using a mechanism that blocks a user for X amount of hours, after Y amount of connection tries.  The desired situation:  I wish to have a standalone mechanism (that is, not as part of a firewall) that blocks a user for X amount of hours, after Y amount of connection tries as a way to defend from brute force attacks.  My Question:  Do you know a utility (and specific configuration) that will let me achieve the desired situation?
81476
I want to unlock an encrypted LVM at startup on a headless Ubuntu 16.04 server. This is a fairly fresh install. The only installs I have done are mate-desktop, xrdp, dropbear, and busybox. My client is PuTTY on a Windows machine. I am fairly new to Linux, but here is the progress I have made:  Installed dropbear and busybox  Used puttygen to generate a key pair  Copied public key to ~/.ssh/authorized_keys and set proper permissions (700 on directory, 600 on file)  Copied public key to /etc/initramfs-tools/root/.ssh/authorized_keys and set proper permissions (700 on directory, 600 on file)  Confirmed my keys are good by successfully connecting to normal user session via PuTTY using key authentication  Created the script and modified the config files as outlined at  (Note: I did not perform step 8, but my /var/log/auth.log file did not contain the errors showcased in the Troubleshoot section of that blogpost if step 8 is not performed.)  Updated initramfs   When the system boots and shows the graphical LUKS unlock prompt, I get no response from the server when I try to connect via PuTTY. The connection times out. I have not been able to find any resources that deal with dropbear/busybox not running on boot. I am certain that if I could get a response, my key would work and I could unlock without problems. How can I find out why dropbear/busybox isn't running at boot? (For clarification, I can still unlock at the server and SSH into user session.)