SSH - Method 'publickey' disabled on HP-UX11i

[roadkill]

Hi,
I'm configuring ssh between a HP-UX11i (using OpenSSH_3.6.1p2, SSH protocols 1.5/2.0) and an Alpha Server based on TRU64 using (SSH2, commericial version) but am faced with a slight problem. I have managed to successfully configure ssh connectivity from HP-UX server to TRU64 server but the problem lies from TRU64 to HP-UX. This is what I have done:

(1) Create DSA keys on TRU64 server (i.e ssh-keygen -t dsa..) with empty passphrase. This creates a 2048bit DSA paired private/public key.
(2) Copied the public key to HP-UX server
- scp ~/.ssh2/id_dsa_2048_a.pub HP-UX:.ssh
(3) Converted the key on HP-UX server
- ssh-keygen -i -f id_dsa_2048_a.pub >>authorized_keys2 (and also to authorized_keys)
(4) On TRU 64 server I added entry to identification file (IdKey id_dsa_2048_a.pub)

This is all the settings I have done on both the servers but when I test ssh connectivity from TRU64 server to HP-UX server, I still get prompted for password:

ssh -v HP-UX server -l

RESULT
debug: SshAppCommon/sshappcommon.c:138: Allocating global SshRegex context.
debug: SshConfig/sshconfig.c:2796: Metaconfig parsing stopped at line 3.
debug: SshConfig/sshconfig.c:2704: Unable to open /usr/users/prdadm/.ssh2/ssh2_config
debug: Connecting to HP-UX, port 22... (SOCKS not used)
debug: Ssh2/ssh2.c:2297: Entering event loop.
debug: Ssh2Client/sshclient.c:1421: Creating transport protocol.
debug: SshAuthMethodClient/sshauthmethodc.c:83: Added "publickey" to usable methods.
debug: SshAuthMethodClient/sshauthmethodc.c:83: Added "keyboard-interactive" to usable methods.
debug: SshAuthMethodClient/sshauthmethodc.c:83: Added "password" to usable methods.
debug: Ssh2Client/sshclient.c:1462: Creating userauth protocol.
debug: client supports 3 auth methods: 'publickey,keyboard-interactive,password'
debug: Ssh2Common/sshcommon.c:529: local ip = TRU64 IP, local port = 1886
debug: Ssh2Common/sshcommon.c:531: remote ip = HP-UX IP, remote port = 22
debug: SshConnection/sshconn.c:1945: Wrapping...
debug: SshReadLine/sshreadline.c:2414: Initializing ReadLine...
debug: Remote version: SSH-2.0-OpenSSH_3.6.1p2
debug: OpenSSH: Major: 3 Minor: 6 Revision: 1
debug: Ssh2Transport/trcommon.c:1517: All versions of OpenSSH handle kex guesses incorrectly.
debug: Ssh2Transport/trcommon.c:1900: lang s to c: `', lang c to s: `'
debug: Ssh2Transport/trcommon.c:1965: c_to_s: cipher aes128-cbc, mac hmac-sha1, compression none
debug: Ssh2Transport/trcommon.c:1968: s_to_c: cipher aes128-cbc, mac hmac-sha1, compression none
debug: Remote host key found from database.
debug: Ssh2Common/sshcommon.c:330: Received SSH_CROSS_STARTUP packet from connection protocol.
debug: Ssh2Common/sshcommon.c:380: Received SSH_CROSS_ALGORITHMS packet from connection protocol.
debug: server offers auth methods 'external-keyx,gssapi,publickey,password,keyboard-interactive'.
debug: Ssh2AuthPubKeyClient/authc-pubkey.c:1590: adding keyfile "/usr/users/prdadm/.ssh2/id_dsa_prdadm_bdun0610" to candidates
debug: server offers auth methods 'external-keyx,gssapi,publickey,password,keyboard-interactive'.
debug: Ssh2AuthClient/sshauthc.c:318: Method 'publickey' disabled.
debug: server offers auth methods 'external-keyx,gssapi,publickey,password,keyboard-interactive'.
debug: server offers auth methods 'external-keyx,gssapi,publickey,password,keyboard-interactive'.
debug: Ssh2AuthPasswdClient/authc-passwd.c:105: Starting password query...
user password:

Permission in .ssh directory for files on HP-UX server are:
-rw------- authorized_keys, authorized_keys2
-rw-r--r-- id_dsa_2048_a.pub
-rw-r--r-- known_hosts

ssh_config file below:
# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for various options

# Host *
# ForwardAgent no
# ForwardX11 no
# RhostsAuthentication no
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# BatchMode no
# CheckHostIP yes
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port 22
Protocol 2
# Cipher 3des
# Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
# EscapeChar ~

ANY IDEAS what I'm doing wrong or what extra I need to do please.

thanks
Roadkill

[Sridhar Bhaskarla]

Hi,

Try isolating the problem first by doing. In first two cases Setup up public/private authentication to a different test account on the same server.

1. ssh to itselt on HP server to eliminate HP's sshd server configuration.
2. ssh to itself on Tru64 to eliminate Tru54's ssh client configuration.
3. Specify PreferredAuthentications as publickey explicitly and see if it still disables.
4. For testing, do not specify -f with ssh-keygen while generating the keys. Just use the defaults id_dsa, id_dsa.pub and simply append id_dsa.pub to authorized_keys on the HP server.

-Sri

[Steven E. Protter]

Its also quite possible that permissions issues between the systems /home/username/.ssh directories are not quite right.

I'm attaching a document that you seem to have already followed generally. I'd suggest checking permissions and running ssh tests in -v verbose mode to fully diagnose and correct this issue.

See attachment word format.

SEP

[Ermin Borovac]

>>> (4) On TRU 64 server I added entry to identification file (IdKey id_dsa_2048_a.pub)

Please make sure that your $HOME/.ssh2/identification file contains

IdKey id_dsa_2048_a

not

IdKey id_dsa_2048_a.pub