Networking / Stage 10 of 14

SSH — trusting the server and logging in with a key

Not running Starting usually ~20 s

Step 7 of 9 · lab · 20 min

SSH key login isn't working

The key for deploy is on the server, yet the login is refused. Use the log to find what the server distrusts and restore the login.

Situation

You were given a deploy account on this server: your public key ~/.ssh/id_ed25519.pub is already in its authorized_keys. But ssh deploy@localhost answers Permission denied (publickey), and deploy has no password.

Task

ssh deploy@localhost logs in with your key, no password.
The permission check in sshd stays on: StrictModes yes.

There is no internet on the machine, and everything you need is installed.

Lab · on your own

No commands are given in this lab: type them in the terminal yourself. Goals are checked on the machine after every command.

Goals

0 of 2

ssh deploy@localhost logs in with the key, no password — not done yet
sshd still checks the key file modes (StrictModes yes) — not done yet

Ctrl+Enter

Starts the machine node1 · Ubuntu 24.04

The machine is starting

Hints

0 of 3

Report a problem

Lab goals

0 of 2

ssh deploy@localhost logs in with the key, no password — not done yet
sshd still checks the key file modes (StrictModes yes) — not done yet

node1 Ubuntu 24.04

Lab goals

0 of 2

ssh deploy@localhost logs in with the key, no password — not done yet
sshd still checks the key file modes (StrictModes yes) — not done yet

Network · picked for this lab

SSH keys and ssh-agent

Cheat sheet

$_ — insert into the terminal

ssh-keygen -t ed25519 generate a pair
ssh-copy-id user@host install it on the server
ssh-keygen -l -f key.pub fingerprint
chmod 700 ~/.ssh directory — owner only
chmod 600 ~/.ssh/authorized_keys key file — owner only
ssh-add ~/.ssh/id_ed25519 load into the agent
ssh -i ~/.ssh/key -o IdentitiesOnly=yes host use a specific key

Generation

bash

ssh-keygen -t ed25519 -C "me@laptop"          # recommended type
ssh-keygen -t rsa -b 4096 -C "legacy"         # if RSA is required (old systems)
ssh-keygen -t ed25519 -f ~/.ssh/deploy_key    # a custom filename (several keys)
ssh-keygen -p -f ~/.ssh/id_ed25519            # change/add a passphrase on the key
ssh-keygen -y -f ~/.ssh/id_ed25519            # recover the .pub from the private key
ssh-keygen -l -f ~/.ssh/id_ed25519.pub        # fingerprint
ssh-keygen -t ed25519 -N '' -f key            # no passphrase (for automation/CI)

Installing on the server:

bash

ssh-copy-id user@host                          # the simplest way
ssh-copy-id -i ~/.ssh/deploy_key.pub user@host # with a specific key
cat ~/.ssh/id_ed25519.pub | ssh host 'cat >> ~/.ssh/authorized_keys'   # manually

File permissions

sshd enables StrictModes by default: it rejects ~/.ssh and the files in it if the group or others can write to them (the g+w/o+w bits), even when the owner is the right user. 700/600 is not the only value that passes the check, but it's the simplest recommendation that works:

bash

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_ed25519            # private key — owner only
chmod 644 ~/.ssh/id_ed25519.pub
chown -R "$USER:$USER" ~/.ssh

ssh-agent

The agent keeps the decrypted key in memory so you don't have to type the key's passphrase every time:

bash

eval "$(ssh-agent -s)"            # start the agent
ssh-add ~/.ssh/id_ed25519        # add the key (asks for its passphrase once)
ssh-add -l                       # which keys are loaded
ssh-add -t 3600 ~/.ssh/key       # auto-unload after an hour
ssh-add -d ~/.ssh/key            # remove one key
ssh-add -D                       # remove all keys
ssh -A user@host                 # agent forwarding — trusted hosts only!

Permission denied (publickey)

Is the public key present in ~/.ssh/authorized_keys on the server?
Permissions: ~/.ssh=700, authorized_keys=600, owner is the user itself. In the server's journal: journalctl -u ssh → "Authentication refused: bad ownership or modes".
Is the client sending the right key? ssh -v host shows which keys it tries; specify explicitly with ssh -i ~/.ssh/key host or set it in ~/.ssh/config (IdentityFile).

It asks for the key's passphrase every time

The key isn't in the agent: ssh-add ~/.ssh/id_ed25519. For it to happen automatically — AddKeysToAgent yes in ~/.ssh/config (see ssh-client).

The server doesn't accept keys at all

On the server, in sshd_config: PubkeyAuthentication yes, and the directory/file isn't bypassing AuthorizedKeysFile. After editing — sudo systemctl reload ssh (see sshd).

Several keys — the wrong one is offered / "Too many authentication failures"

The agent tries every key and hits the server's limit. Specify one explicitly: ssh -i key -o IdentitiesOnly=yes host.

Lost the private key

It cannot be recovered — generate a new one and update authorized_keys on the servers. (You can extract the public key from the private one with ssh-keygen -y, but never the other way around.)

SSH — trusting the server and logging in with a key

Situation

Task

Signing in is needed to start the machine

Generation

File permissions

ssh-agent

Permission denied (publickey)

It asks for the key's passphrase every time

The server doesn't accept keys at all

Several keys — the wrong one is offered / "Too many authentication failures"

Lost the private key