just now, one user complained that he can't use his
public key as an
authentication to remote server.
he already generate the
public key & did all the necessary steps but still the remote server asked for
password after key in the
public key.
i tried used my id and it worked just fine, so it could be something wrong with his id or his
public key. try to regenerate his
public key but still the same thing.
as you see from below verbose message of
ssh, it still asked for
password after key in the
public key:
user1@local_server $ ssh -v remote_server
OpenSSH_3.8.1p1, OpenSSL 0.9.7a Feb 19 2003
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to remote_server [ip_address] port 22.
debug1: Connection established.
debug1: identity file /glb/home/user1/.ssh/identity type -1
debug1: identity file /glb/home/user1/.ssh/id_rsa type 1
debug1: identity file /glb/home/user1/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_3.8.1p1
debug1: match: OpenSSH_3.8.1p1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192)>
Enter passphrase for key '/glb/home/user1/.ssh/id_dsa':
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,hostbased
debug1: Next authentication method: password
user1@remote_server's password:
a friend of mine (
trew) found the solution... thanks :)
it is actually because his home directory is group writable (
775). for security reason,
authorized_keys file cannot be writable by anyone else, this also apply to the parent directory of
authorized_keys file, in this case - his home directory.
for more info refer to
http://dsd.lbl.gov/~ksb/Scratch/ssh_user_setup.html at the
authorized_keys section.
