topic Re: scp sking for password! in Operating System - HP-UX

scp sking for password!

Ahmed_58 — Mon, 25 Oct 2010 04:44:14 GMT

I generate ssh key for scp and copy it to the other system as "authorized_keys", but still prompt for password!. the permission looks OK see below for file permission and the log of scp run.
----------------------------------------------
drwx------ 2 dbitf bc 1024 Oct 25 08:26 .ssh
----------------------------------------------
-rw-r--r-- 1 dbitf bc 604 Oct 24 11:01 authorized_keys
-rw------- 1 dbitf bc 668 Oct 14 13:51 id_dsa
-rw-r--r-- 1 dbitf bc 603 Oct 14 13:51 id_dsa.pub

-------------------------------------------
$ scp -v dbitf@bat-bc1:/usr3/live/edw_extracts/test /home/dbitf
Executing: program /opt/ssh/bin/ssh host bat-bc1, user dbitf, command scp -v -f /usr3/live/edw_extracts/test
OpenSSH_5.3p1+sftpfilecontrol-v1.3-hpn13v5, OpenSSL 0.9.8l 5 Nov 2009
HP-UX Secure Shell-A.05.30.007, HP-UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug1: Connecting to bat-bc1 [10.3.4.16] port 22.
debug1: Connection established.
debug1: identity file /home/dbitf/.ssh/identity type -1
debug1: identity file /home/dbitf/.ssh/id_rsa type -1
debug1: identity file /home/dbitf/.ssh/id_dsa type 2
debug1: Remote protocol version 1.99, remote software version OpenSSH_5.3p1+sftpfilecontrol-v1.3-hpn13v5
debug1: match: OpenSSH_5.3p1+sftpfilecontrol-v1.3-hpn13v5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3p1+sftpfilecontrol-v1.3-hpn13v5
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'bat-bc1' is known and matches the RSA host key.
debug1: Found key in /home/dbitf/.ssh/known_hosts:9
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received

---------------------------------------------------------------------------
This system is a private property of BAHRAIN TELECOMMUNICATION.
Do not attempt to login unless you are an authorized user.
Any authorized or unauthorized access or use may be monitored and
can result in criminal or civil prosecution under applicable law.
---------------------------------------------------------------------------

debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/dbitf/.ssh/identity
debug1: Trying private key: /home/dbitf/.ssh/id_rsa
debug1: Offering public key: /home/dbitf/.ssh/id_dsa
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: keyboard-interactive
Password:
---------------------------------------------
Regards,
Ahmed

Re: scp sking for password!

SivaOX — Mon, 25 Oct 2010 05:10:46 GMT

It seems like a permission issue.
ie, user of one server (dbitf@bat-bc1) doesn't have a access to the another user's home directory of another server (/home/dbitf).

Try to copy the file to someother location where 777 permissions are set.
HTH:)

Re: scp sking for password!

Ahmed_58 — Mon, 25 Oct 2010 05:18:36 GMT

Dear SivaOX,
still the same, the directory has 777 permission, not only this the user id on both servers is the same.

Ahmed

Re: scp sking for password!

SivaOX — Mon, 25 Oct 2010 05:20:35 GMT

I am using RSA, and found no issues.

debug1: Next authentication method: publickey
debug1: Trying private key: /oracle/.ssh/identity
debug1: Offering public key: /oracle/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).

Re: scp sking for password!

Aneesh Mohan — Mon, 25 Oct 2010 05:20:53 GMT

Hi Ahmed,

How are you ?.

The problem seems you are trying with dsa key in your authorized_keys.

You may generate rsa key and update in authorized_keys of remote server.

Please try the following:
ServerA and ServerB both should run the ssh daemons.To allow ServerA to SSH to ServerB without password

Login to the source server (server A)

# ssh-keygen -t rsa

accpet all defaults sttings.

This generates two files id_rsa.pub and id_rsa

Now,id_rsa.pub needs to be appended to the authorized_keys file on ServerB

Rename this file to some other name , for identification.

#mv id_rsa.pub _rsa.pub

copy this file to serverB.

# scp _rsa.pub ServerB:~/.ssh/_rsa.pub

Login to server B

move to the .ssh folder under your home directory

Take a backup of the file authorized_keys

#cp -p authorized_keys authorized_keys.backup

# cat _rsa.pub >> authorized_keys

Now try login from server A to B

Note: If you are implementing it first time there will not be any authorized_keys file. So you can simply rename the file id_rsa.pub _rsa.pub to authorized_keys
Repeat this process starting from server B to A to allow passwordless login from server B to A

Aneesh

Re: scp sking for password!

SivaOX — Mon, 25 Oct 2010 05:26:05 GMT

Hi Ahmed,
Can you please verify, are these both servers using same algorithm? (RSA/DSA)

Re: scp sking for password!

Ahmed_58 — Mon, 25 Oct 2010 05:38:41 GMT

Hi Aneesh, I'm OK thanks...

I done exactly what you told me, bu still ahking for a password.

Siva,
I tried DSA and now I generate RSA but still the same.

Ahmed

Re: scp sking for password!

Horia Chirculescu — Mon, 25 Oct 2010 05:49:51 GMT

Hello Ahmed,

What do you get on syslog (on bat-bc1?)

Try to do a scp (or ssh the same result...) then

cat /var/adm/syslog/syslog.log

Horia.

Re: scp sking for password!

Ahmed_58 — Mon, 25 Oct 2010 05:55:35 GMT

Dear Horia,
in syslog I'm getting:

bat-bc1 sshd[9449]: Authentication refused: bad ownership or modes for directory /usr3/live/edw_extracts

-------------------------------------

the permission is :
drwxrwxrwx 5 bc bc 21504 Oct 25 09:22 edw_extracts

Ahmed

Re: scp sking for password!

Horia Chirculescu — Mon, 25 Oct 2010 06:10:54 GMT

>Authentication refused: bad ownership or modes for directory /usr3/live/edw_extracts

Looks like dbitf has a problem with this directory (or the parent directory).

Log in as dbitf in the bat-bc1 machine and try to copy the file "test" to the home base:

$cp /usr3/live/edw_extracts/test /home/dbitf

Horia.

Re: scp sking for password!

Ahmed_58 — Mon, 25 Oct 2010 06:14:27 GMT

Dear Horia,

it is working with manuall copy to the same machine.

$ cp /usr3/live/edw_extracts/test /home/dbitf
$
$ cd /home/dbitf
$ ll
-rwxr-xr-x 1 dbitf bc 0 Oct 25 10:11 test

Re: scp sking for password!

ani007 — Mon, 25 Oct 2010 06:19:03 GMT

perform the following commands on the user account you are trying to setup
chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Re: scp sking for password!

Ahmed_58 — Mon, 25 Oct 2010 06:19:22 GMT

Horia,
It is working now....I need to change both the owner and the mod to:

bat-bc1:/usr3/live>chmod 755 edw_extracts
bat-bc1:/usr3/live>chown dbitf edw_extracts

Thanks to all,..
Ahmed

Re: scp sking for password!

Ahmed_58 — Mon, 25 Oct 2010 06:25:32 GMT

An advice to all for using SCP allways look at the syslog.

thanks to all, specially HORIA u r HERO.

Regards,
Ahmed