SSH problem:keep asking me the password

[Wang,MinJie]

Hi all
I've installed Open-SSH on two HP-UX servers
And I want to configure SSH Client/User authentication
So I logged in Server A as root and run the following cmds:
Server A#ssh-keygen -t rsa
Server A#scp ~/.ssh/id_rsa.pub ServerB:~/.ssh/id_rsa.pub
Then I logged in Server B as root and:
Server B#cd ~/.ssh
Server B#touch authorized_keys
Server B#chmod 644 authorized_keys
Server B#cat id_rsa.pub >> authorized_keys
Then I logged in Server A as root again:
Server A#ssh Server B
And It prompted me to input PassPhrase
The reason I told you all above is that I think the configuration I've done is correct
Then I wanted to ssh to Server B as user1 and the problem come!
I follow the exactly same step as all above except that this time I created authorized_keys file in "~usesr1/.ssh/" directory
then this time it didn't work!
It keeps asking me the passwd of user1 on Server B
I don't know why.
Is that because we can't ssh to a server with passphrase unless we become a root?
Any advice

[Steven E. Protter]

Shalom,

Check the ownership and permissions of the home directory and .ssh foldder

drwxr-x--- 19 root root 4096 Mar 22 22:10 /root

The ownership must be right and the permissions must be exactly as they are above.

drwx------ 2 root root 4096 Oct 31 19:39 .ssh

-rw-r--r-- 1 root root 603 Nov 1 19:44 authorized_keys
-rw------- 1 root root 668 Oct 31 19:37 id_dsa
-rw-r--r-- 1 root root 601 Oct 31 19:37 id_dsa.pub
-rw-r--r-- 1 root root 1354 Mar 18 06:29 known_hosts


Any variance will cause the problem you are having.

SEP

[Senthil Prabu.S_1]

Hi,
The key file authorized_keys should be 0700 permission and as well for the .ssh file, since no others are allowed to read the key.


Use the attached doc to set up password less authentication.

HTH,
Prabu.S

[Ralph Grothe]

You have to distinguish between password and (RSA) passphrase.
In your sample shell snippet you generated an RSA key pair without explicitly giving ssh-keygen a -N "" to demand for a passphrase less key pair.
If you entered something when asked for a passphrase this is the string you need to retype on connect.
If so, you can either remove the passphrase from your key pair by e.g.

$ ssh-keygen -p -f ~/.ssh/id_rsa -P "current phrase" -N ""

Or more secure yet, you could start the ssh-agent (should be put in your shell's profile file), and give it the phrase only once.
Then for subsequent connects the remote sshd will always ask your running ssh-agent.

e.g. (assume a Bourne like shell)

$ eval $(ssh-agent -s)

$ ssh-add ~/.ssh/id_rsa

Here it will ask for the keys' passphrase,
so enter it.

Then at your heart's content run any ssh commands to the remote host.

On shutdown of your shell you would have to end the ssh-agent.
This is best set up in a shell trap.

e.g.

trap 'ssh-agent -k' 0