ssh keeps asking for password

[Ionut Grigorescu_2]

Hi,

I have a Debian box with OpenSSH client on it and want to connect to a HP-UX 11.00 server with SSH2 - paswordless. I have generated locally on the client the key pair with ssh-keygen -t dsa and coppied the id_dsa.pub on the server in the $HOME/.ssh2/ directory. I have created there also the authorization file with the entry "Key id_dsa.pub", I have tried also with authorized_key2 file in which I've coppied my id_dsa.pub, The permissions for the files in ssh2 directory are 644, but still the sshd2 asks me for password if I'm trying to login on the HP-UX box (when I'm supplying the password it works, ofcourse). On the client I'm user grigorei, remote - omc, see the attached debug mode from the ssh login.

Thanks in advance
Ionut

[RAC_1]

Did you cut and paste the public key?? Do not do that do cat file >> to authozied_keys file.

Anil

[Keith Bryson]

Also check you have an identification file for the user, on the server you are connecting from, with an IdKey entry for the private key name.

Keith

[Ionut Grigorescu_2]

I've always did that with cat id_dsa.pub >> authorized_keys2.
That with identification doesn't work for OpenSSH, I have OpenSSH on the Debian Linux box...

[RAC_1]

"Not a RSA1 key file /home/grigorei/.ssh/id_dsa."

makes me think that, does it need to be a rsa key or a dsa key?? Try both and check.

On hp-ux authorized_keys file is authorized_keys and not authorized_keys2

Also what if you explicitely do ss -2

[Ionut Grigorescu_2]

Hello,

I have created both rsa and dsa keys, both authorized_keys and authorized_keys2 files, though in man sshd2_config the authorization file is authorization and it has to be in $HOME/.ssh2

[RAC_1]

Let's start all over again.
You are connecting from linux box (you have openssh on this) to hp-ux. Is that right?? If yes, on hp-ux the file has to be ~/.ssh/authorized_keys file.

Also give sshd -ddd on hp-ux and ssh -vvv from client side.

Anil

[Denver Osborn]

Have you also looked at the permissions of the user's home dir on both the server and the client?

They ~/.ssh shouldn't be world or group writable. Same goes for the ~/.ssh/authorized_keys file.

If you're not worried about permissions and don't want to change them, set "StrictModes no" in the servers sshd_config file.

Refer to "man sshd_config" for details.

-denver

[Ionut Grigorescu_2]

Hi,

let's put the things in order:

On the HP-UX side I have a MC/SG cluster, the /d/home directory is NFS-exported to the NIS domain to the cluster it belongs to, so I've thought it's a permission problem. So, I've copied the id_dsa.pub + id_rsa.pub also to the /.ssh2 (root login) - please note - in the $HOME of the user I'm logging in as there are two subdirectories: .ssh and .ssh2. In the .ssh are these two files : authorized_keys and authorized_keys2 where I put the id_dsa.pub and id_rsa.pub. In the root home directory there is only .ssh2, which - according to the man page - is the conf directory for ssh2. However, I've put everywhere the authorized_keys and authorized_keys2 with the rsa and dsa keys and also the authorization file were I put the public key names as instructed by man ssh2 - the identification file is needed by ssh2 only if I want to login from the local machine using ssh2 client (not OpenSSH!!!) to the other machine (in my case from my Unix box to the Debian box, which is not the case) - one comment: I have also another HP-UX 11.00 box where I have installed myself OpenSSH and I could login in it passwordless - I have ssh-agent on the Debian box and I have passed it the passphrase so it negotiates for me with the remote hosts - I don't have to type the passphrase in. I have also did a Ethereal trace but a sniffer cannnot give too many clues - this is actualy the reason for ssh, isn't it?

regards,
ionut

[Ionut Grigorescu_2]

Hi,

I've tried again with sshd -ddd on the server and ssh -vvv on the client. Attached the result.

[Ionut Grigorescu_2]

Hello,

I've found it!
on the OpenSSH client ssh-keygen -e -f id_dsa.pub > id_dsa_new.pub
-e option read the public key and output the key converted in "SECSH Public Key Format" to stdout to be used with various comercial ssh implementations.I have copied the new key to the .ssh2 directory on the ssh2 server and add the line "Key id_dsa_new.pub" to the authorization file. Now I can login without password/passphrase (ssh-agent is running also on my client).

case closed

[Ionut Grigorescu_2]

see the answer above