[SOLVED] connecting two linux boxes remotely

however · 01-30-2019, 03:40 PM

maybe i got excited too early!

it seems that I must have made some typo errors earlier when tried to connect to ssh sever (locally) on box B. I dont think it was disabled after all. I suspected this when i saw you naming the key 'ed25519' (on browsing through /etc/ssh_config i did see already a key/file with the same name; in fact, I deleted the key pair that I had created manually earlier with the ssh-keygen utility on box B and, it still connects to box C.

So now, I have the ed25519 file/key and I need to copy it in box A (work computer) although something tells me that I might already have those key/files on box A (work pc) already (like I had it on box C hence connected with no issues); however, if not and, forgive my ignorance, how can i transfer anything between the two computers if they are not connected beforehand?

Quote:

PasswordAuthentication no

Done! and everything double and triple checked, box B and box C (on same LAN) are still connecting, though before reloading the ssh service.

Something else interesting happen when i try to reload the ssh service.

Code:

bash-5.0# /etc/ssh/sshd_config restart
bash: /etc/ssh/sshd_config: Permission denied
bash-5.0# whoami
root

michaelk · 01-30-2019, 04:14 PM

The keys located in /etc/ssh are the host keys used to authenticate the computer itself and to prevent man in the middle attacks. They are also stored in the client computer's users /home/username/.ssh/known_hosts file but are not used to login to the server.

The public key i.e xxx.pub is stored in the server's i.e. destination computer users i.e /home/username/.ssh/authorized_keys file. The private key stays on the client computer /home/username/.ssh/ directory.

It is common to transfer keys using password authentication then once you know you can use keys it is disabled. You say you can still connect successfully. Are you being prompted for a password?

To restart the ssh server run the command.
/etc/rc.d/rc.sshd restart

however · 01-30-2019, 05:27 PM

Quote:

Originally Posted by michaelk

To restart the ssh server run the command.
/etc/rc.d/rc.sshd restart

dah! of course! Thank you to point it out. Done it, successfully.

Quote:

Originally Posted by michaelk

Are you being prompted for a password?

Yes, i am/was.

Now, after ssh reload, i get

Code:

ash-5.0$ ssh 192.168.0.xxx
me@192.168.0.xxx: Permission denied (publickey,keyboard-interactive).
bash-5.0$

So, if i understand this correctly, i must recreate the key pair, using ssh-keygen utility?

michaelk · 01-30-2019, 05:57 PM

Yes, you need to recreate keys as posted previously.

lleb · 01-30-2019, 06:05 PM

Quote:

Originally Posted by however

dah! of course! Thank you to point it out. Done it, successfully.

Yes, i am/was.

Now, after ssh reload, i get

Code:

ash-5.0$ ssh 192.168.0.xxx
me@192.168.0.xxx: Permission denied (publickey,keyboard-interactive).
bash-5.0$

So, if i understand this correctly, i must recreate the key pair, using ssh-keygen utility?

read the links in my signature to further help with some good step by step guides for setting up ssh keys and config files.

however · 01-31-2019, 03:54 PM

good day everyone,

Quote:

Originally Posted by lleb

read the links in my signature to further help with some good step by step guides for setting up ssh keys and config files.

thank you so much! that is indeed a great tutorial!

so, where i am now: i have recreated the key pair, and was still unable to connect to ssh, both on box B and box C (locally or remotely).

Code:

bash-5.0# ssh 192.168.0.xxx
darkstar@192.168.0.xxx: Permission denied (publickey,keyboard-interactive). #local box B
bash-5.0#

bash-5.0# ssh 192.168.0.yyy
darkstar@192.168.0.xxx: Permission denied (publickey,keyboard-interactive). #remote box C
bash-5.0#

I remembered about

Quote:

PasswordAuthentication no

and decided to add that beautiful # and, back in business. Box B and box C love each other again.

Then from box B I managed to copy the id_rsa.pub key to box C with

Quote:

ssh-copy-id -i ~/.ssh/id_rsa.pub user@<IP_SERVER_B>

checked box C and now i have

Code:

darkstar@localhost:~$ ls -l /home/darkstar/.ssh
total 8
-rw------- 1 darkstar users 750 Jan 31 22:09 authorized_keys
-rw-r--r-- 1 darkstar users 348 Jan 30 20:43 known_hosts
darkstar@localhost:~$

all is great, so far.

Again, as suggested by Turbocapitalist, I try to uncomment

Quote:

PasswordAuthentication no

on both box B and box C and, again:

bash-5.0# ssh 192.168.0.xxx
darkstar@192.168.0.xxx: Permission denied (publickey,keyboard-interactive).
bash-5.0#

I understood that the advantage of ssh key pair logging/authentication was to avoid password input.
Am i supposed to have this password on? or off? What am i missing?

michaelk · 01-31-2019, 04:27 PM

You can add debug messages by using the -v option to the ssh command, adding more vs increases verbosity with max=3. That might help diagnose the problem.

I assume box B still has buth the public and public keys still in your .ssh directory. You should be able to login via keys on the same box via the command

ssh localhost.

however · 01-31-2019, 04:59 PM

Quote:

Originally Posted by michaelk

You can add debug messages by using the -v option to the ssh command, adding more vs increases verbosity with max=3. That might help diagnose the problem.

I assume box B still has buth the public and public keys still in your .ssh directory. You should be able to login via keys on the same box via the command

ssh localhost.

yes I still have both keys in ~/.ssh and this is what happen

Code:

ash-5.0$ ssh localhost
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is xxx123:enegngnrwnrwnyRWTHWRHWerhwrYHXOnbVIJCxr7A.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
darkstar@localhost: Permission denied (publickey,keyboard-interactive).
bash-5.0$

Code:

bash-5.0$ ssh darkstar@192.168.0.xxx -v
OpenSSH_7.9p1, OpenSSL 1.1.1a  20 Nov 2018
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to 192.168.0.xxx [192.168.0.xxx] port 22.
debug1: Connection established.
debug1: identity file /home/darkstar/.ssh/id_rsa type -1
debug1: identity file /home/darkstar/.ssh/id_rsa-cert type -1
debug1: identity file /home/darkstar/.ssh/id_dsa type -1
debug1: identity file /home/darkstar/.ssh/id_dsa-cert type -1
debug1: identity file /home/darkstar/.ssh/id_ecdsa type -1
debug1: identity file /home/darkstar/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/darkstar/.ssh/id_ed25519 type -1
debug1: identity file /home/darkstar/.ssh/id_ed25519-cert type -1
debug1: identity file /home/darkstar/.ssh/id_xmss type -1
debug1: identity file /home/darkstar/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.9
debug1: match: OpenSSH_7.9 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.0.xxx:22 as 'darkstar'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:qaefQHENHEHeabnqttttb+oM0wVhMSset3N0o2KHg
debug1: Host '192.168.0.xxx' is known and matches the ECDSA host key.
debug1: Found key in /home/darkstar/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: Will attempt key: /home/darkstar/.ssh/id_rsa 
debug1: Will attempt key: /home/darkstar/.ssh/id_dsa 
debug1: Will attempt key: /home/darkstar/.ssh/id_ecdsa 
debug1: Will attempt key: /home/darkstar/.ssh/id_ed25519 
debug1: Will attempt key: /home/darkstar/.ssh/id_xmss 
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/darkstar/.ssh/id_rsa
debug1: Trying private key: /home/darkstar/.ssh/id_dsa
debug1: Trying private key: /home/darkstar/.ssh/id_ecdsa
debug1: Trying private key: /home/darkstar/.ssh/id_ed25519
debug1: Trying private key: /home/darkstar/.ssh/id_xmss
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: No more authentication methods to try.
darkstar@192.168.0.xxx: Permission denied (publickey,keyboard-interactive).
bash-5.0$

I hope this helps

michaelk · 01-31-2019, 05:31 PM

What are the permissions of the files in box B's .ssh directory. It does not look like any keys are being offered.

however · 01-31-2019, 05:40 PM

Quote:

Originally Posted by michaelk

What are the permissions of the files in box B's .ssh directory. It does not look like any keys are being offered.

thanks for your quick replies

Quote:

drwx------ 2 darkstar users 4096 Jan 31 23:48 .ssh

michaelk · 01-31-2019, 05:45 PM

What about your ida_rsa key file?

The reason that ssh localhost might not of worked is because you didn't add the public key to box B's authorized_keys file...

however · 01-31-2019, 06:28 PM

Quote:

Originally Posted by michaelk

What about your ida_rsa key file?

box B

Code:

bash-5.0$ ls -l -a /home/darkstar/.ssh
total 20
drwx------  2 darkstar users 4096 Jan 31 23:48 .
drwx--x--x 38 darkstar users 4096 Jan 31 21:49 ..
-rw-------  1 darkstar users 3434 Jan 31 23:44 homedesktop_rsa
-rw-r--r--  1 darkstar users  750 Jan 31 23:44 homedesktop_rsa.pub
-rw-r--r--  1 darkstar users  174 Jan 31 23:48 known_hosts
bash-5.0$

Quote:

The reason that ssh localhost might not of worked is because you didn't add the public key to box B's authorized_keys file...

how do i add that?

interestingly, when I

Quote:

ssh-copy-id -i ~/.ssh/homedesktop_rsa.pub darkstar@192.168.0.xxx

i noticed that an 'authorized_keys' file was added to ~/.ssh on box C.

michaelk · 01-31-2019, 06:40 PM

Ok try,

ssh -i ~/.ssh/homedesktop_rsa darkstar@box_C _IP_address

If that works I suggest creating a config file as shown in lleb's signature link.

Turbocapitalist · 01-31-2019, 11:55 PM

Quote:

Originally Posted by however

interestingly, when I i noticed that an 'authorized_keys' file was added to ~/.ssh on box C.

Then the key transfer worked and you should be able to connect as michaelk suggests in #28 above.
Then modify the ~/.ssh/config file on the machine you are connecting from, if you would like to save typing in the future.

Code:

ssh -i ~/.ssh/homedesktop_rsa darkstar@box_C _IP_address

equals adding the following near the top of the ~/.ssh/config file on the machine you are connecting from:

Code:

Host box_c
        HostName box_C_IP_address
        User darkstar
        IdentitiesOnly yes
        IdentifyFile ~/.ssh/homedesktop_rsa 
        IdentityFile ~/.ssh/homedesktop_rsa 
        AddKeysToAgent ask

With that in place you can use the shortcut "ssh box_c" and the configuration file will fill in the rest of the details it has on record.

Skim through "man ssh_config" for an overview but read in detail the beginning of it.

Edit: fixed a typo

lleb · 02-01-2019, 08:37 AM

Quote:

Originally Posted by however

how do i add that?

interestingly, when I i noticed that an 'authorized_keys' file was added to ~/.ssh on box C.

Correct. the ssh-copy-id does a few things.

1. copies the rsa.pub file to the remote system.
2. creates or appends the authorized_keys file with your public RSA key
3. only works if you can ssh into the remote system and authenticate via some other means other than ssh keys.

All can be done without the ssh-copy-id, but that tends to make things simpler when it is available to the user.

check my links again and note the troubleshooting section for things to look into.

Your issues sound like a combination of issues from permissions to files not being updated. There are both issues and howto steps for troubleshooting as well as steps to resolve common issues in those links.

Hope they help.