Networking / Stage 10 of 14 · step 7 of 9

SSH key login isn't working

~20 min

Not running Starting usually ~20 s

Situation

You were given a deploy account on this server: your public key ~/.ssh/id_ed25519.pub is already in its authorized_keys. But ssh deploy@localhost answers Permission denied (publickey), and deploy has no password.

Task

ssh deploy@localhost logs in with your key, no password.
The permission check in sshd stays on: StrictModes yes.

There is no internet on the machine, and everything you need is installed.

Lab goals

0 of 2

ssh deploy@localhost logs in with the key, no password — not checked yet
sshd still checks the key file modes (StrictModes yes) — not checked yet

Hints

0 of 3 open · they open one at a time

Hint 1

Show the solution after 3 failed checks

Network · picked for this lab

SSH keys and ssh-agent

Cheat sheet

$_ — insert into the terminal

ssh-keygen -t ed25519 generate a pair
ssh-copy-id user@host install it on the server
ssh-keygen -l -f key.pub fingerprint
chmod 700 ~/.ssh directory — owner only
chmod 600 ~/.ssh/authorized_keys key file — owner only
ssh-add ~/.ssh/id_ed25519 load into the agent
ssh -i ~/.ssh/key -o IdentitiesOnly=yes host use a specific key

Generation

bash

ssh-keygen -t ed25519 -C "me@laptop"          # recommended type
ssh-keygen -t rsa -b 4096 -C "legacy"         # if RSA is required (old systems)
ssh-keygen -t ed25519 -f ~/.ssh/deploy_key    # a custom filename (several keys)
ssh-keygen -p -f ~/.ssh/id_ed25519            # change/add a passphrase on the key
ssh-keygen -y -f ~/.ssh/id_ed25519            # recover the .pub from the private key
ssh-keygen -l -f ~/.ssh/id_ed25519.pub        # fingerprint
ssh-keygen -t ed25519 -N '' -f key            # no passphrase (for automation/CI)

Installing on the server:

bash

ssh-copy-id user@host                          # the simplest way
ssh-copy-id -i ~/.ssh/deploy_key.pub user@host # with a specific key
cat ~/.ssh/id_ed25519.pub | ssh host 'cat >> ~/.ssh/authorized_keys'   # manually

File permissions

sshd enables StrictModes by default: it rejects ~/.ssh and the files in it if the group or others can write to them (the g+w/o+w bits), even when the owner is the right user. 700/600 is not the only value that passes the check, but it's the simplest recommendation that works:

bash

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_ed25519            # private key — owner only
chmod 644 ~/.ssh/id_ed25519.pub
chown -R "$USER:$USER" ~/.ssh

ssh-agent

The agent keeps the decrypted key in memory so you don't have to type the key's passphrase every time:

bash

eval "$(ssh-agent -s)"            # start the agent
ssh-add ~/.ssh/id_ed25519        # add the key (asks for its passphrase once)
ssh-add -l                       # which keys are loaded
ssh-add -t 3600 ~/.ssh/key       # auto-unload after an hour
ssh-add -d ~/.ssh/key            # remove one key
ssh-add -D                       # remove all keys
ssh -A user@host                 # agent forwarding — trusted hosts only!

Permission denied (publickey)

Is the public key present in ~/.ssh/authorized_keys on the server?
Permissions: ~/.ssh=700, authorized_keys=600, owner is the user itself. In the server's journal: journalctl -u ssh → "Authentication refused: bad ownership or modes".
Is the client sending the right key? ssh -v host shows which keys it tries; specify explicitly with ssh -i ~/.ssh/key host or set it in ~/.ssh/config (IdentityFile).

It asks for the key's passphrase every time

The key isn't in the agent: ssh-add ~/.ssh/id_ed25519. For it to happen automatically — AddKeysToAgent yes in ~/.ssh/config (see ssh-client).

The server doesn't accept keys at all

On the server, in sshd_config: PubkeyAuthentication yes, and the directory/file isn't bypassing AuthorizedKeysFile. After editing — sudo systemctl reload ssh (see sshd).

Several keys — the wrong one is offered / "Too many authentication failures"

The agent tries every key and hits the server's limit. Specify one explicitly: ssh -i key -o IdentitiesOnly=yes host.

Lost the private key

It cannot be recovered — generate a new one and update authorized_keys on the servers. (You can extract the public key from the private one with ssh-keygen -y, but never the other way around.)

SSH key login isn't working

Situation

Task

Signing in is needed to start the machine

Generation

File permissions

ssh-agent

Permission denied (publickey)

It asks for the key's passphrase every time

The server doesn't accept keys at all

Several keys — the wrong one is offered / "Too many authentication failures"

Lost the private key