It seemed so easy to get ssh working without providing a password (using a public key)...
On you client just execute (password left empty):
ssh-keygen -t dsa
Copy the created id_dsa.pub file to the server:
scp ~/.ssh/id_dsa.pub myuser@222.222.222.222:~/.ssh/authorized_keys
scp ~/.ssh/id_dsa.pub myuser@222.222.222.222:~/.ssh/authorized_keys2
scp ~/.ssh/id_dsa.pub myuser@222.222.222.222:~/.ssh/id_dsa.pub
Then ssh to the server without using your normal password. Well for me that just did not work! The last three days I have been googling arround for help on the problem and at last I found the solution. It seems like the problem is common but the reasons varies. One of the major errors are permissions on directories. My problem was not related to permissions but to the sshd_config file on the server. As I couldn't find anyone posting a working configuration file here it goes:
/etc/ssh/sshd_config:
# Package generated configuration file# See the sshd(8) manpage for details# What ports, IPs and protocols we listen forPort 22# Use these options to restrict which interfaces/protocols sshd will bind to#ListenAddress ::#ListenAddress 0.0.0.0Protocol 2# HostKeys for protocol version 2HostKey /etc/ssh/ssh_host_rsa_keyHostKey /etc/ssh/ssh_host_dsa_key#Privilege Separation is turned on for securityUsePrivilegeSeparation yes# Lifetime and size of ephemeral version 1 server keyKeyRegenerationInterval 3600ServerKeyBits 768# LoggingSyslogFacility AUTHLogLevel INFO# Authentication:LoginGraceTime 120PermitRootLogin yesStrictModes yesRSAAuthentication yesPubkeyAuthentication yesAuthorizedKeysFile %h/.ssh/authorized_keys# Don't read the user's ~/.rhosts and ~/.shosts filesIgnoreRhosts yes# For this to work you will also need host keys in /etc/ssh_known_hostsRhostsRSAAuthentication yes# similar for protocol version 2HostbasedAuthentication yes# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication#IgnoreUserKnownHosts yes# To enable empty passwords, change to yes (NOT RECOMMENDED)PermitEmptyPasswords yes# Change to yes to enable challenge-response passwords (beware issues with# some PAM modules and threads)ChallengeResponseAuthentication no# Change to no to disable tunnelled clear text passwordsPasswordAuthentication yes# Kerberos options#KerberosAuthentication no#KerberosGetAFSToken no#KerberosOrLocalPasswd yes#KerberosTicketCleanup yes# GSSAPI options#GSSAPIAuthentication no#GSSAPICleanupCredentials yesX11Forwarding yesX11DisplayOffset 10PrintMotd noPrintLastLog yesTCPKeepAlive yes#UseLogin no#MaxStartups 10:30:60#Banner /etc/issue.net# Allow client to pass locale environment variablesAcceptEnv LANG LC_*Subsystem sftp /usr/lib/openssh/sftp-serverUsePAM noAllowTcpForwarding yesAuthorizedKeysFile /usr/NX/home/nx/.ssh/authorized_keys2This is the content of ~/.ssh directory on the client:
-rw------- 1 username staff 668 26 Okt 22:08 id_dsa-rw-r--r-- 1 username staff 635 26 Okt 22:08 id_dsa.pub-rw------- 1 username staff 786 22 Aug 19:27 known_hostsThis is the permisions of ~/.ssh directory on the server:
drwx------ 5 username staff 170 26 Okt 22:08 .sshThis is the content of ~/.ssh directory on the server:
-rw------- 1 username username 635 Oct 26 22:09 authorized_keys-rw------- 1 username username 635 Oct 26 22:09 authorized_keys2-rw------- 1 username username 635 Oct 26 22:09 id_dsa.pub-rw------- 1 username username 1326 Oct 26 02:05 known_hostsThis is the permisions of ~/.ssh directory on the server:
drwx------ 2 username username 4096 Oct 26 22:09 .sshThis is the permisions of the user directory (~) on the server:
drwxr-x--- 4 username username 4096 Nov 2 18:40 usernameIf this does not work you can change the log level in /etc/ssh/sshd_config:
LogLevel DEBUG3
Restart sshd:
sudo /etc/init.d/ssh restart
And watch the log while you try and log in:
tail -f /var/log/auth.log
By the way. I'm runing Ubuntu 8.04 on the server and OSX Leopard on the client. See also
http://www.securityfocus.com/infocus/1810
