A new colleague got a deploy account, and their key was put on the server. They write: "It won't let me in." Try logging in yourself — a practice SSH server, training, runs on this machine.
Start on the card brings the server up and puts the key in place. ssh training id -un logs in to the server and runs id -un there, which prints who you are logged in as.
Logging in with a key
The key for the deploy account is already on the practice server training. Log in as it and run id -un, then look at the server log and at the key file.
First, predict
The student's public key is in deploy's authorized_keys. What will ssh training id -un print?
Now start the exercise, run the command and compare your prediction with the output.
Why did the server refuse even though the student's public key is in deploy's authorized_keys?
-
The server does take keys:
publickeycomes first in(publickey,password,keyboard-interactive). The file caused the refusal. -
Everyone can read the file: the mode is
-rw-rw-rw-. What the server dislikes is that everyone can write to it too. -
It is the same key — the setup put it there. In its log the server complains about the file's owner and mode:
bad ownership or modes.
authorized_keys has mode -rw-rw-rw-: anyone can write to it, so the server would not take keys from it.