13 Apr
2010
13 Apr
'10
1:26 p.m.
I do apologise if this seems a stupid question.
I am struggling with this and probably missing something very basic. Have
done the initials - changed password to strong random one. Set up iptables -
all ports closed off except port 22 and 80. Fail2Ban running and configured,
I will change ssh to another port later. Set up non-root user, let's call
him fred - with again a strong password.
Checked sshd config file - using protocol 2. Used puttygen to generate
keypair, private key secured with a near-gibberish longish passphrase,
loaded private key into pageant. Saved public key to
/home/fred/.ssh/authorised_keys then chmod that to 744 and .ssh directory
(tried them also at 700 same effect). Changed PasswordAuthorisation in sshd
config file to no
Fire up Putty set VPS ip goto to data page and put in fred for username then
to ssh>auth page to set attempt using pageant and select the private key
file to use. Press open and lo and behold, it asks me for password. I put
that in and I am logged on. Why is it using passwords, why ignoring keys?
At my age you can't afford to lose too much hair, but I am pulling it out
over this
Keith
--
Keith
The most dangerous strategy is to jump a chasm in two leaps.
www.westnorfolkrspca.org.uk
13 Apr
13 Apr
1:30 p.m.
Checked sshd config file - using protocol 2. Used
puttygen to generate keypair, private key secured with a near-gibberish longish
passphrase, >loaded private key into pageant. Saved public key to
/home/fred/.ssh/authorised_keys then chmod that to 744 and .ssh directory (tried them also
>at 700 same effect). Changed PasswordAuthorisation in sshd config file to no
Have you restarted ssh? the changes in the config wont take effect until you do.
Fire up Putty set VPS ip goto to data page and put in
fred for username then to ssh>auth page to set attempt using pageant and select the
>private key file to use. Press open and lo and behold, it asks me for password. I put
that in and I am logged on. Why is it using passwords, why >ignoring keys?
You need to load your key into pagent before putty will use it. Open pagent, it should
minimise to the task bar. Right click > Add key, then select your private key. Once
your key is loaded, retry sshing with putty and it should log you straight in.
1:50 p.m.
You'll also want to set:
ChallengeResponseAuthentication no
in sshd_config, and made sure the permissions on .ssh and its contents are
at 0 for group and other - they'll be ignored otherwise. The best bet, if
it still doesn't work, is to check your ssh logs (/var/log/messages or
somewhere similar) for errors - ssh is pretty good at telling you why your
setup isn't working correctly.
On Tue, Apr 13, 2010 at 2:26 PM, Keith Williams <Keith(a)keiths-place.co.uk>wrote;wrote:
I do apologise if this seems a stupid question.
I am struggling with this and probably missing something very basic. Have
done the initials - changed password to strong random one. Set up iptables -
all ports closed off except port 22 and 80. Fail2Ban running and configured,
I will change ssh to another port later. Set up non-root user, let's call
him fred - with again a strong password.
Checked sshd config file - using protocol 2. Used puttygen to generate
keypair, private key secured with a near-gibberish longish passphrase,
loaded private key into pageant. Saved public key to
/home/fred/.ssh/authorised_keys then chmod that to 744 and .ssh directory
(tried them also at 700 same effect). Changed PasswordAuthorisation in sshd
config file to no
Fire up Putty set VPS ip goto to data page and put in fred for username
then to ssh>auth page to set attempt using pageant and select the private
key file to use. Press open and lo and behold, it asks me for password. I
put that in and I am logged on. Why is it using passwords, why ignoring
keys?
At my age you can't afford to lose too much hair, but I am pulling it out
over this
Keith
--
Keith
The most dangerous strategy is to jump a chasm in two leaps.
www.westnorfolkrspca.org.uk
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
15 Apr
15 Apr
7:07 a.m.
Keith Williams wrote:
[snip setup process]
Fire up Putty set VPS ip goto to data page and put in
fred for username
then to ssh>auth page to set attempt using pageant and select the
private key file to use. Press open and lo and behold, it asks me for
password. I put that in and I am logged on. Why is it using passwords,
why ignoring keys?
I presume that as you're using Putty you have only Windows at your end?
If you have access to either a Linux or MacOS X box then I would
suggest trying the ordinary ssh client with the -v option, which will
give you a full narrative of what's going on.
The ssh login sequence will always use keys for preference before
passwords, so the fact that it's falling back to passwords indicates
that the keys are not properly set up.
You may also get useful information by examining /var/log/auth.log just
after a logon attempt. If it has decided not to use keys it should tell
you why here.
I don't think you want 7xx as your file permissions on authorized_keys.
Looking at my systems I have 700 on ~/.ssh and 644 on authorized_keys.
There's no reason for authorized_keys to be executable.
HTH
John
7:18 a.m.
Hi all,
Late to the party here, so to speak, but I believe John is correct
with the permissions. From my experience, ssh will reject your
authorized_keys file if the permissions are too lax. They must be as
John described them - 700 for .ssh - and by the same token, I'd have
said 600 for authorized_keys.
Let us know if that helps at all,
James
On 15/04/2010, John Winters <john(a)sinodun.org.uk> wrote:
Keith Williams wrote:
[snip setup process]
Fire up Putty set VPS ip goto to data page and
put in fred for username
then to ssh>auth page to set attempt using pageant and select the
private key file to use. Press open and lo and behold, it asks me for
password. I put that in and I am logged on. Why is it using passwords,
why ignoring keys?
I presume that as you're using Putty you have only Windows at your end?
If you have access to either a Linux or MacOS X box then I would
suggest trying the ordinary ssh client with the -v option, which will
give you a full narrative of what's going on.
The ssh login sequence will always use keys for preference before
passwords, so the fact that it's falling back to passwords indicates
that the keys are not properly set up.
You may also get useful information by examining /var/log/auth.log just
after a logon attempt. If it has decided not to use keys it should tell
you why here.
I don't think you want 7xx as your file permissions on authorized_keys.
Looking at my systems I have 700 on ~/.ssh and 644 on authorized_keys.
There's no reason for authorized_keys to be executable.
HTH
John
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
5364
days inactive
5366
days old
4 comments
5 participants
participants (5)
-
James Gregory -
John Winters -
Keith Williams -
Luke Sheldrick -
Tom Crosby