passworldless ssh not working

[Krog]

hi, i'm playing with a new single board computer (banana pro) and i want to share ssh keys with my main computer.
on both machines I have the same user called "krog" with different password.
on the banana pro I did:
ssh-keygen -t rsa
then I copied the public key from .ssh/id_rsa.pub of the banana pro
to .ssh/authorized_keys of the main computer
I did the opposite operations.
Now I can do ssh to the banana and the password is not asked, but from the banana to my main pc the password is still asked!

openssh was built with these use flags:

[Hu]

Does the server permit key-based authentication? Are the key files configured such that the server's rules will allow you to use them? OpenSSH has some builtin restrictions to prevent you from using certain very insecure configurations, such as world writable authorized_keys or world readable private keys. You can check some aspects of this by running ssh -vvv server to get very very verbose output from ssh. If you still need help, please post the output of ls -al ~/.ssh/ from both machines, cat -n ~/.ssh/config on the client, and cat -n /etc/ssh/sshd_config on the server.

[Krog]

ssh with password works both ways.

ssh from banana to krogpc (the one not working with the key):

[szatox]

Looks like damaged public key on the client (don't ask, I didn't believe it is possible until I saw it myself). Remove public key file and only leave private one there. Ssh will stop being smart and hopefully do the right thing this time.
You can also try extracting public key from private one to make sure your public keyfile is actually correct.

[ChrisJumper]

Hi Krog,

i think it is a bad idea to just copy private and public key on both machines. Ok if you just copied them on this two machines thats not a big deal, but if you have more then two and you use your banana public key to logon on computer 5, 6, 8... than an intruder on your krogpc could hijack all the other machines too, because you leave the private key!

Better is: Just generate another private and public key on krogpc and copy that public key (or if more then one, attach it) to your banana pc's user's .ssh/authorized_keys

I am not 100% Sure if its important, but the Key you generate on Banana have a "user@host" signature. I think its not important to match that. But its documentation friendly.

The error you have, is that i think: You have different Server Configurations (/etc/ssh/sshd_config)on both computers or forgot to restart the daemon after updating the configuration files. Hint: Line 36 on your Posted sshd_config "#AuthorizedKeysFile %h/.ssh/authorized_keys" its disabled!

Just because its complicate here are the steps that you have to take care of:

Romeo wants to login at Juliets account on juliet@capulet:

Romeo generate his ssh-keygen -t rsa keys.
He give one USB Stick with his public Key to Juliet.
Juliet log in on her Account (juliet@carpulet).
She adds Romeos public Key to her .ssh/authorized_keys File.
She had to start the sshd Daemon and allow in sshd_config:

[Hu]

Krog: your client output looks fine. The client tried to use the private key. There should be a server log message explaining why it declined to use the private key.

Your home directory permissions on krogpc look very strange. You should not be in the Portage group at all. It is unusual to have a setgid home directory. As I read the source, sshd will refuse to use any key file which is writable by group or world, as well as any key file in a directory that is group or world writable, recursively up to the root. Remove group write on your home directory and try again.

[Krog]

first of all: thanks for every hint.
I commented out that line of sshd_config
i now have:

[bbgermany]

Hi,

how did you copy the public keys from one host to another?

greets, bb
_________________
Desktop: Ryzen 5 5600G, 32GB, 2TB, RX7600
Notebook: Dell XPS 13 9370, 16GB, 1TB
Server #1: Ryzen 5 Pro 4650G, 64GB, 16.5TB
Server #2: Ryzen 4800H, 32GB, 22TB

[Krog]

i tried every way, from the copy-paste to the ssh-copy-id -i ~/.ssh/id_rsa.pub $remote_user@$remote_host
in both ways it works from krogc to banana but not from banana to krogpc...

[bbgermany]

Can you please try out my sshd_config files?

[Krog]

with passwordautentication no i will not be able to log in via password? that is now the only working way and i need that

[bbgermany]

[Krog]

no, no password... the needing is to create scripts on banana that does ssh and stuff on krogpc without asking for a password

[bbgermany]

Ok, have you tried the config now with the modification?

[Krog]

just now, still the same

[krinn]

listen to Hu, fix your /home permission

[bbgermany]

Hi,

the permissions are the same on my servers/clients (they are correctly working here) but the group membership is quite strange as Hu already told you.

Can you show the output of

[Krog]

[bbgermany]

Thats in my ssh_config only. Try it please:

[Krog]

[bbgermany]

Thats ok, it looks like a problem that really needs fixing although it is demanding

i meant, can you remove all the other lines from the config, just to make sure that this isnt the issue.

greets bb

EDIT: btw, have you checked the serverside logfile for the message when you try to access it? maybe you need to turn up debugging on the server as well for this to get more information.
_________________
Desktop: Ryzen 5 5600G, 32GB, 2TB, RX7600
Notebook: Dell XPS 13 9370, 16GB, 1TB
Server #1: Ryzen 5 Pro 4650G, 64GB, 16.5TB
Server #2: Ryzen 4800H, 32GB, 22TB

[Krog]

yeah i want to try that... how to turn to the maximum every possible debug output and where to look for the log?

[bbgermany]

Just check for "LogLevel" in your sshd_config and change it to DEBUG (everywhere I see it in uppercase, maybe its required this way). then you will see all the debug output after restarting the sshd in /var/log/auth.log

greets, bb
_________________
Desktop: Ryzen 5 5600G, 32GB, 2TB, RX7600
Notebook: Dell XPS 13 9370, 16GB, 1TB
Server #1: Ryzen 5 Pro 4650G, 64GB, 16.5TB
Server #2: Ryzen 4800H, 32GB, 22TB

[cboldt]

from `man sshd_config` ...

[Krog]

just to be safe, can i post logs obtained with this debug level?
i saw by accident that posting ssh -vvv leads to post here my key and i deleted from the paste...