My problem is the following. I wish to configure the .ssh/config as such, that when I write
ssh exampleX
It is the same as if I wrote
ssh -i /path/to/key.pem user#address
Note that the above command works.
Following the answers here I tried to create the file as
Host exampleX
HostName address
User user
IdentityFile /path/to/key.pem
Taken from
ssh -i /path/to/key.pem user#address
Yet when I run
ssh exampleX
I get the error
ssh: Could not resolve hostname exampleX: Name or service not known
But if I manually run the command
ssh -i /path/to/key.pem user#address
everything works. Where am I making the mistake in creating the file?
Edit
If I run
sudo ssh exampleX -v
I get the output
OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
ssh: Could not resolve hostname exampleX: Name or service not known
but if I run it without sudo i get a longer stream, that ends with
debug1: Authentications that can continue: publickey
debug1: Trying private key: /path/to/key.pem
Load key "/path/to/key.pem": Permission denied
debug1: No more authentication methods to try.
Permission denied (publickey).
Edit 2
Due to some confusion , I restate my question
What does the config file has to look like, so that running
ssh exampleX
will work the same as running
ssh -i /path/to/key.pem user#address
When you run your command through sudo, you are using the .ssh/config file that corresponds to the user that sudo runs as. If you really need to run this ssh command as root, you need the configuration added to ~root/.ssh/config instead of ~/.ssh/config.
If possible, run your ssh as a normal user, not as root.
(Since the question was edited, I edited accordingly my answer)
Check the permissions of the file ~/.ssh/config: it must have strict permissions: read/write for the user, and not accessible by others, as explained in the man page.
Check also you have read access (as a user) to the file /path/to/key.pem. The debug option you used with ssh suggests you don't have.
I am trying to create a git repository on my web host and clone it on my computer. Here's what I did:
I created a repository on the remote server.
I generated a key pair: ssh-keygen -t dsa.
I added my key to ssh-agent.
I copied to the server public key in ~/.ssh.
And then, after an attempt to run the command git clone ssh://user#host/path-to-repository, I get an error:
Unable to negotiate with XX.XXX.XX.XX: no matching host key type found. Their offer: ssh-dss
fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists.
What does that mean?
The recent openssh version deprecated DSA keys by default. You should suggest to your GIT provider to add some reasonable host key. Relying only on DSA is not a good idea.
As a workaround, you need to tell your ssh client that you want to accept DSA host keys, as described in the official documentation for legacy usage. You have few possibilities, but I recommend to add these lines into your ~/.ssh/config file:
Host your-remote-host
HostkeyAlgorithms +ssh-dss
Other possibility is to use environment variable GIT_SSH to specify these options:
GIT_SSH_COMMAND="ssh -oHostKeyAlgorithms=+ssh-dss" git clone ssh://user#host/path-to-repository
You can also add -oHostKeyAlgorithms=+ssh-dss in your ssh line:
ssh -oHostKeyAlgorithms=+ssh-dss user#host
For me this worked: (added into .ssh\config)
Host *
HostkeyAlgorithms +ssh-dss
PubkeyAcceptedKeyTypes +ssh-dss
If you would like to contain this security hole to a single repo, you can add a config option to any Git repos that need this by running this command in those repos. (Note: only works with git version >= 2.10, released 2016-09-04)
git config core.sshCommand 'ssh -oHostKeyAlgorithms=+ssh-dss'
This only works after the repo is setup, however. If you're not comfortable adding a remote manually (and just want to clone), then you can run the clone like this:
GIT_SSH_COMMAND='ssh -oHostKeyAlgorithms=+ssh-dss' git clone ssh://user#host/path-to-repository
Then run the first command to make it permanent.
If you don't have the latest Git and still would like to keep the hole as local as possible, I recommend putting
export GIT_SSH_COMMAND='ssh -oHostKeyAlgorithms=+ssh-dss'
in a file somewhere, say git_ssh_allow_dsa_keys.sh, and sourceing it when needed.
I want to collaborate a little with the solution for the server side. So, the server is saying it does not support DSA, this is because the openssh client does not activate it by default:
OpenSSH 7.0 and greater similarly disable the ssh-dss (DSA) public key algorithm. It too is weak and we recommend against its use.
So, to fix this this in the server side I should activate other Key algorithms like RSA o ECDSA. I just had this problem with a server in a lan.
I suggest the following:
Update the openssh:
yum update openssh-server
Merge new configurations in the sshd_config if there is a sshd_config.rpmnew.
Verify there are hosts keys at /etc/ssh/. If not generate new ones, see man ssh-keygen.
$ ll /etc/ssh/
total 580
-rw-r--r--. 1 root root 553185 Mar 3 2017 moduli
-rw-r--r--. 1 root root 1874 Mar 3 2017 ssh_config
drwxr-xr-x. 2 root root 4096 Apr 17 17:56 ssh_config.d
-rw-------. 1 root root 3887 Mar 3 2017 sshd_config
-rw-r-----. 1 root ssh_keys 227 Aug 30 15:33 ssh_host_ecdsa_key
-rw-r--r--. 1 root root 162 Aug 30 15:33 ssh_host_ecdsa_key.pub
-rw-r-----. 1 root ssh_keys 387 Aug 30 15:33 ssh_host_ed25519_key
-rw-r--r--. 1 root root 82 Aug 30 15:33 ssh_host_ed25519_key.pub
-rw-r-----. 1 root ssh_keys 1675 Aug 30 15:33 ssh_host_rsa_key
-rw-r--r--. 1 root root 382 Aug 30 15:33 ssh_host_rsa_key.pub
Verify in the /etc/ssh/sshd_config the HostKey configuration. It should allow the configuration of RSA and ECDSA. (If all of them are commented by default it will allow too the RSA, see in man sshd_config the part of HostKey).
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
For the client side, create a key for ssh (not a DSA like in the question) by just doing this:
ssh-keygen
After this, because there are more options than ssh-dss(DSA) the client openssh (>=v7) should connect with RSA or better algorithm.
Here another good article.
This is my first question answered, I welcome suggestions :D .
In my case for bitbucket, the following worked.
Host yourhost(ex: bitbucket.com)
User git
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
Add to vi ~/.ssh/config:
Host YOUR_HOST_NAME
HostkeyAlgorithms ssh-dss
In my case error was:
Unable to negotiate with IP_ADDRESS port 22: no matching host key
type found. Their offer: ssh-rsa,ssh-dss
In this case it helps in vi ~/.ssh/config:
Host YOUR_HOST_NAME
HostKeyAlgorithms ssh-dss
PubkeyAcceptedKeyTypes ssh-rsa
So, host key algorithm is ssh-dss and pub key is ssh-rsa.
And then I can use ssh for this host in normally (with out any flags).
You either follow above approach or this one
Create the config file in the .ssh directory and add these line.
host xxx.xxx
Hostname xxx.xxx
IdentityFile ~/.ssh/id_rsa
User xxx
KexAlgorithms +diffie-hellman-group1-sha1
I upgraded to Fedora 20 a few weeks back. I had very few issues in the upgrade process and the system is stable. One lingering issue I have is described below.
I have one computer on my LAN with a reverse port forward set up back to the recently updated fedora 20 machine. I can verify the reverse forward works because the following is successful from the fedora 20 computer:
$ ssh -p 1234 xxxxx#localhost
xxxxxx#localhost's password:
Last login: Mon Dec 1 14:08:22 2014 from localhost.localdomain
However if I specify the port number after localhost I get a “could not resolve” error as shown below:
$ ssh -v xxxxx#localhost:1234
OpenSSH_6.4, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 51: Applying options for *
ssh: Could not resolve hostname localhost:1234: Name or service not known
So in the first situation it sees hostname=localhost and resolves that to an IP address. In the second situation it sees hostname=”localhost:1234:” ...
The contents of /etc/host is :
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
Right now I'm trying to determine if this is a resolving thing or something else. a "dig localhost" doesn't return an answer section so that suggest it is. At the same time localhost:port# works in a browser. I don't know how localhost is resolved from /etc/hosts, I assume NetworkManager does this? I'm not running any sort of internal DNS server on my LAN.
I'm happy to provide additional information if requested & thanks in advance
You have to use the -p option to specify a port with SSH, not the hostname:port format.
ssh -v xxxxx#localhost -p 1234
$ ssh -v xxxxx#localhost:1234
ssh: Could not resolve hostname localhost:1234: Name or service not known
"user#host:port" or "host:port" simply aren't valid syntax for specifying a destination on the ssh command line. ssh treats everything after the "#" as a hostname. It doesn't treat part of that field as a port number, and it's not documented to do so.
The specific error indicates that ssh is trying to look up the IP address for a nonexistent host named "localhost:1234" and failing.
I added the public SSH key to the authorized_keys file. ssh localhost should log me in without asking for the password.
I did that and tried typing ssh localhost, but it still asks me to type in the password. Is there another setting that I have to go through to make it work?
I have followed the instructions for changing permissions:
Below is the result if I do ssh -v localhost.
debug1: Reading configuration data /home/john/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to localhost [127.0.0.1] port 22.
debug1: Connection established.
debug1: identity file /home/john/.ssh/identity type 1
debug1: identity file /home/john/.ssh/id_rsa type -1
debug1: identity file /home/john/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.7p1 Debian-8ubuntu3
debug1: match: OpenSSH_4.7p1 Debian-8ubuntu3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'localhost' is known and matches the RSA host key.
debug1: Found key in /home/john/.ssh/known_hosts:12
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/john/.ssh/identity
debug1: Server accepts key: pkalg ssh-rsa blen 149
debug1: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Then it asks for a passphase after the above log. Why isn't it logging me in without a password?
You need to verify the permissions of the authorized_keys file and the folder / parent folders in which it is located.
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
For more information see this page.
You may also need to change/verify the permissions of your home directory to remove write access for the group and others.
chmod go-w ~
SELinux can also cause authorized_keys not to work. Especially for root in CentOS 6 and 7. There isn't any need to disable it though.
Once you've verified your permissions are correct, you can fix this like so:
chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys
restorecon -R -v /root/.ssh
Setting ssh authorized_keys seem to be simple, but it hides some traps I'm trying to figure.
-- SERVER --
In /etc/ssh/sshd_config, set passwordAuthentication yes to let the server temporarily accept password authentication
-- CLIENT --
consider Cygwin as Linux emulation and install & run OpenSSH
1. Generate private and public keys (client side)
# ssh-keygen
Here pressing just Enter, you get default two files, "id_rsa" and "id_rsa.pub", in ~/.ssh/, but if you give a name_for_the_key, the generated files are saved in your current working directory.
2. Transfer the your_key.pub file to the target machine, ssh-copy-id user_name#host_name
If you didn't create a default key, this is the first step to go wrong
... you should use:
ssh-copy-id -i path/to/key_name.pub user_name#host_name
3. Logging ssh user_name#host_name will work only for the default id_rsa file, so here is the second trap. You need to do ssh -i path/to/key_name user#host
(Use ssh -v ... option to see what is happening.)
If the server still asks for a password then you gave something. To Enter passphrase: when you've created keys (so it's normal).
If ssh is not listening on the default port 22, you must use ssh -p port_nr.
-- SERVER -----
4. Modify file /etc/ssh/sshd_config to have
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile %h/.ssh/authorized_keys
(uncomment if case)
This tells ssh to accept file authorized_keys and look in the user home directory for the key_name sting written in the .ssh/authorized_keys file.
5 Set permissions on the target machine
chmod 755 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
Also turn off pass authentication,
passwordAuthentication no
to close the gate to all ssh root/admin/....#your_domain attempts.
6. Ensure ownership and group ownership of all non-root home directories are appropriate.
chown -R ~ usernamehere
chgrp -R ~/.ssh/ user
===============================================
7. Consider the excellent http://www.fail2ban.org
8. Extra
SSH tunnel to access a MySQL (bind = 127.0.0.1) server
Also be sure your home directory is not writeable by others:
chmod g-w,o-w /home/USERNAME
This answer is stolen from here.
The desperate may also make sure they don't have extra newlines in the authorized_keys file due to copying file id_rsa.pub's text out of a confused terminal.
Listing a public key in .ssh/authorized_keys is necessary, but not sufficient for sshd (server) to accept it. If your private key is passphrase-protected, you'll need to give ssh (client) the passphrase every time. Or you can use ssh-agent, or a GNOME equivalent.
Your updated trace is consistent with a passphrase-protected private key. See ssh-agent, or use ssh-keygen -p.
In the following, user is your username.
mkdir -p /home/user/.ssh
ssh-keygen -t rsa
touch /home/user/.ssh/authorized_keys
touch /home/user/.ssh/known_hosts
chown -R user:user /home/user/.ssh
chmod 700 /home/user/.ssh
chmod 600 /home/user/.ssh/id*
chmod 644 /home/user/.ssh/id*.pub
chmod 644 /home/user/.ssh/authorized_keys
chmod 644 /home/user/.ssh/known_hosts
Beware that SELinux can trigger this error as well, even if all permissions seem to be OK. Disabling it did the trick for me (insert usual disclaimers about disabling it).
Look in file /var/log/auth.log on the server for sshd authentication errors.
If all else fails, then run the sshd server in debug mode:
sudo /usr/sbin/sshd -ddd -p 2200
Then connect from the client:
ssh user#host -p 2200
In my case, I found the error section at the end:
debug1: userauth_pubkey: test whether pkalg/pkblob are acceptable for RSA SHA256:6bL+waAtghY5BOaY9i+pIX9wHJHvY4r/mOh2YaL9RvQ [preauth]
==> debug2: userauth_pubkey: disabled because of invalid user [preauth]
debug2: userauth_pubkey: authenticated 0 pkalg ssh-rsa [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]
debug3: send packet: type 51 [preauth]
debug3: receive packet: type 50 [preauth]
With this information I realized that my sshd_config file was restricting logins to members of the ssh group. The following command fixed this permission error:
sudo usermod -a -G ssh NEW_USER
Try "ssh-add" which worked for me.
The thing that did the trick for me finally was to make sure that the owner/group were not root, but user:
chown -R ~/.ssh/ user
chgrp -R ~/.ssh/ user
Issue these on the command line:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
After you do this, make sure your directory is like this:
drwx------ 2 lab lab 4.0K Mar 13 08:33 .
drwx------ 8 lab lab 4.0K Mar 13 08:07 ..
-rw------- 1 lab lab 436 Mar 13 08:33 authorized_keys
-rw------- 1 lab lab 1.7K Mar 13 07:35 id_rsa
-rw-r--r-- 1 lab lab 413 Mar 13 07:35 id_rsa.pub
In my case I needed to put my authorized_keys file in .openssh.
This location is specified in /etc/ssh/sshd_config under the option AuthorizedKeysFile %h/.ssh/authorized_keys.
Another tip to remember: Since v7.0 OpenSSH disables DSS/DSA SSH keys by default due to their inherit weakness. So if you have OpenSSH v7.0+, make sure your key is not ssh-dss.
If you are stuck with DSA keys, you can re-enable support locally by
updating your sshd_config and ~/.ssh/config files with lines like so: PubkeyAcceptedKeyTypes=+ssh-dss
Another issue you have to take care of: If your generated file names are not the default id_rsa and id_rsa.pub.
You have to create the .ssh/config file and define manually which id file you are going to use with the connection.
An example is here:
Host remote_host_name
HostName 172.xx.xx.xx
User my_user
IdentityFile /home/my_user/.ssh/my_user_custom
Make sure that the target user has a password set. Run passwd username to set one. This was required for me even if password SSH login was disabled.
Just look in file /var/log/auth.log on the server. Setting additional verbosity with -vv on the client side won't help, because the server is unlikely to offer too much information to a possible attacker.
My problem was a modified AuthorizedKeysFile, when the automation to populate /etc/ssh/authorized_keys had not yet been run.
$sudo grep AuthorizedKeysFile /etc/ssh/sshd_config
#AuthorizedKeysFile .ssh/authorized_keys
AuthorizedKeysFile /etc/ssh/authorized_keys/%u
Make sure you've copied the whole public key to authorized_keys; the ssh rsa prefix is necessary for the key to work.
I issued sudo chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys and chmod go-w $HOME $HOME/.ssh from a previous answer and it fixed my problem on a CentOS 7 box that I had messed up the permissions on while trying to get Samba shares working.
It seems like a permission problem. Usually it happens if the permission of some file/directory is not correctly set up. In most case they are ~/.ssh and ~/.ssh/*. In my case they are /home/xxx.
You can change the log level of sshd by modifying file /etc/ssh/sshd_config(search for LogLevel, and set it to DEBUG) and then check the output in file /var/log/auth.log to see what happened exactly.
This solves my problem:
ssh-agent bash
ssh-add
In my case it's because the user's group is not set in AllowGroups of configuration file /etc/ssh/sshd_config. After adding it, everything works fine.
You need to verify the properties of the files.
To assign the required property, use:
$ chmod 600 ~/.ssh/sshKey
$ chmod 644 ~/.ssh/sshKey.pub
I use it this way.
cat ~/.ssh/id_rsa.pub| ssh user#remote-system 'umask 077; cat >>~/.ssh/authorized_keys'
On that note, make sure your sshd configuration has this line:
PermitRootLogin without-password
Set as the above, and then restart sshd (/etc/init.d/sshd restart).
Log out and try log in in again!
The default, I believe, is:
PermitRootLogin no
I have the home directory in a non-standard location and in sshd logs I have the following line, even if all permissions were just fine (see the other answers):
Could not open authorized keys '/data/home/user1/.ssh/authorized_keys': Permission denied
I have found a solution here: Trouble with ssh public key authentication to RHEL 6.5
In my particular case:
Added a new line in /etc/selinux/targeted/contexts/files/file_contexts.homedirs:
This is the original line for regular home directories:
/home/[^/]*/\.ssh(/.*)? unconfined_u:object_r:ssh_home_t:s0
This is my new line:
/data/home/[^/]*/\.ssh(/.*)? unconfined_u:object_r:ssh_home_t:s0
Followed by a restorecon -r /data/ and a sshd restart.
I had this problem and none of the other answers solved it, although of course the other answers were correct.
In my case, it turned out that the /root directory itself (not e.g. /root/.ssh) had the wrong permissions. I needed:
chown root.root /root
chmod 700 /root
Of course, those permissions should be something like that (maybe chmod 770) regardless. However, it specifically prevented sshd from working, even though /root/.ssh and /root/.ssh/authorized_keys both had correct permissions and owners.
I had this problem when I added the group of the login user to another user.
Let's say there is an SSH-login user called userA and a non-SSH-login user userB. userA has the group userA as well. I modified userB to have the group userA as well. The lead to the the described behaviour, so that userA was not able to login without a prompt.
After I removed the group userA from userB, the login without a prompt worked again.
I have had the same issues since before, but today I had to set up one new server. What I could learn in this time...
The basic process to allow authentication without a password is as follows:
On the server, validate if your home folder has the .ssh folder. If it doesn't exist, you can create it manually with a mkdir command and then to assign the correct permissions with chmod, or otherwise you could use the same utility, ssh-keygen, to create private/public keys, but on the server for your user. This process will create the required .ssh folder.
On the local machine you also need to create the private/public keys with the ssh-keygen utility.
You need to move your public key to file .ssh/authorized_keys to the server. To achieve this, you can use the ssh-copy-id utility, or you can do it manually using the cat and scp commands.
In the best of cases, this will allow connect to your server without a password.
OK, now the issues that I found today: first there are several key generation algorithms: rsa, dsa, ecdsa and ed25519 and there are many releases of OpenSSH (you can have one version on your local machine and an old version on your server):
Hint: Using ssh -v helps to see additional information when you are connecting to the server.
OpenSSH_8.2p1 Ubuntu-4, OpenSSL 1.1.1f 31 Mar 2020
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
The error in my case today was that I was trying to use a key with a "newer" generation algorithm that was not supported by the installed version of OpenSSH on the server. When I had checked the supported algorithms, another error that I found was that the server was rejecting my algorithm:
debug1: Skipping ssh-dss key /home/user/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
After that, I had to change the algorithm of my key and then I could connect with the server successfully.
OpenSSH releases notes: Link