Question

Followed the tutorials to the letter, server still won't accept my SSH keys.

Posted August 15, 2020 162 views
SecurityDigitalOcean

I followed the tutorials both for OpenSSH keys AND PuttyGen keys.

https://www.digitalocean.com/docs/droplets/how-to/add-ssh-keys/
https://www.digitalocean.com/docs/droplets/how-to/add-ssh-keys/create-with-openssh/
https://www.digitalocean.com/docs/droplets/how-to/add-ssh-keys/create-with-putty/
https://www.digitalocean.com/docs/droplets/how-to/add-ssh-keys/to-account/
https://www.digitalocean.com/docs/droplets/how-to/add-ssh-keys/to-existing-droplet/
https://www.digitalocean.com/docs/droplets/how-to/connect-with-ssh/
https://www.digitalocean.com/docs/droplets/how-to/transfer-files/

None of that worked so please don’t suggest anything from any of those links. The keys are in the right format and can be uploaded, but the Digital Ocean server is rejecting my keys from both Putty and Filezilla. Has Digital Ocean been having a problem with this recently? I didn’t have any problems with this service before this week.

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer

Hi @austincapobianco,

Let’s first being with the usual stuff:

  • Your home directory ~, your ~/.ssh directory and the ~/.ssh/authorized_keys file on the remote machine must be writable only by you: rwx------ andrwxr-xr-x are fine, but rwxrwx---is no good, even if you are the only user in your group (if you prefer numeric modes: 700 or 755, not 775).
  • If~/.ssh or authorized_keys is a symbolic link, the canonical path (with symbolic links expanded) is checked.
  • Your ~/.ssh/authorized_keys file (on the remote machine) must be readable (at least 400), but you’ll need it to be also writable (600) if you will add any more keys to it.
  • Your private key file (on the local machine) must be readable and writable only by you: rw——-, i.e. 600.

Now that we’ve passed the standard stuff, let’s get going on the more interesting stuff.

When you run

/usr/sbin/sshd -d -p 2222

On your droplet, you can then connect without a password, what does the debug information says on your droplet, It should state something like

Authentication allowed

In this case, what you can do is temporarily stop the SSH daemon and replace it with one in debug mode. Don’t worry, stopping the SSH daemon won’t kill any existing connections. This means it’s possible to run this without being connected to the droplet’s Console but it’s somewhat risky. If the connection does get broken for any kind of reason, you’ll need to connect using your droplet’s console. Anyway, you can run the following

service ssh stop
/usr/sbin/sshd -d
#...debug output...
service ssh start

If it again runs with the debug mode being on, then for sure it’s the SELinux causing the issues, it’s most probably set to Enforcing. The .ssh dir will probably be mislabeled. Look at /var/log/audit/audit.log. Check with ls -laZ and then Run restorecon -r -v /path/to/users/.ssh.

Regards,
KFSys

Submit an Answer