ssh no longer allows public key authentication
If public key authentication doesn't work: make sure that on the server side, your home directory (~
), the ~/.ssh
directory, and the ~/.ssh/authorized_keys
file, are all writable only by their owner. In particular, none of them must be writable by the group (even if the user is alone in the group). chmod 755
or chmod 700
is ok, chmod 770
is not.
What to check when something is wrong:
- Run
ssh -vvv
to see a lot of debugging output. If you post a question asking why you can't connect with ssh, include this output (you may want to anonymize host and user names). - If you can, check the server logs in
/var/log/auth.log
. - If public key authentication isn't working, check the permissions again, especially the group bit (see above).
I ran into the same thing and finally figured out that it was because I encrypted my home directory. SSH can't read the authorized_keys file until you log in, so basically it forces you to password authenticate first. See the section about the encrypted home directory on the following link:
https://help.ubuntu.com/community/SSH/OpenSSH/Keys#Encrypted_Home_Directory
If you check the permissions on the directories, and there is a "." right after them, then you may have selinux enabled, which will mess w/ the key exchange, and default to manual password identification.
You can disable SELinux to troubleshoot by following the instructions here: http://www.centos.org/docs/5/html/5.1/Deployment_Guide/sec-sel-enable-disable-enforcement.html, or just edit the /etc/selinux/config file and change it from "enforcing" to "disabled".
Hope this helps.