Jim Cheetham wrote:
On Jun 28, 2004, at 5:53 PM, G Chinnery wrote:
su ed to root su ed to apache to set up my id_rsa and id_rsa.pub keys and those are in /var/www/.ssh
had to copy the id_rsa.pub to /home/max/.ssh to scp it across to apollo:/home/max/.ssh/id_rsa.key then did what I had to do to the key.
ended up with authorized_keys file in /max/.ssh dir.
OK, so /var/www/.ssh/id_rsa* are owned by the apache user on the server. That's correct.
correct with permissions rw-r--r-- for both of them.
/var/www/.ssh/id_rsa.pub was copied to /home/max/.ssh - by which user? I guess root did it, so it may not have the right ownership. This will make no difference on the server, because no-one connects to it ...
correct again owner/group is root with rw-r--r-- perms again
id_rsa.pub was scp'd to apollo. I think you might have done this as the user 'max', because of your comment about copying. I presume that 'what you had to do' was to rename or copy this file and call it '/home/max/.ssh/authorized_keys' ?
correct again. remaned it to authorized_keys and now its got owner/group max and rw-r--r-- perms. I never noticed the owner/group b4 I guess that is wrong?
OK, how about sending the output of that ssh -v command? I'm only interested in the section following on from the first occurrance of "debug1: Authentications" ...You will need to copy that authorized_keys file from the /home/apache/.ssh directories to /home/max/.ssh to be able to use "ssh -l max". When ssh tries to connect with the username "max", it will only look in "/home/max/.ssh" for keys.
I still get asked for a password when I run the script, (should I call it a CGI? ) from a shell, and if I su to apache and run a command like...
ssh -v -l max apollo uname -a
I get a request for a password from max at apollo.
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/jim/.ssh/identity
debug1: Trying private key: /Users/jim/.ssh/id_rsa
debug1: Trying private key: /Users/jim/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
This unfortunately only tells us what the client is trying (i.e. your server) and not what the internal state of the remote server (apollo) is ... but it's a start.
I'm hoping that we will see the correct key file being "offered". If so, the problem is on apollo, and will probably be related to the permissions and ownership of the files in ~max/.ssh. If you could also include an 'ls -la' from that directory, that would be good.
-jim
[EMAIL PROTECTED] max]$ su
Password:
[EMAIL PROTECTED] max]# su apache
bash-2.05$ ssh -v -l max apollo uname -a
OpenSSH_2.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Seeding random number generator
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 48 geteuid 0 anon 1
debug1: Connecting to apollo [192.168.10.3] port 22.
debug1: temporarily_use_uid: 48/48 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 48/48 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /var/www/.ssh/identity type -1
debug1: identity file /var/www/.ssh/id_rsa type 1
debug1: identity file /var/www/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_2.9p2
debug1: match: OpenSSH_2.9p2 pat ^OpenSSH
debug1: Local version string SSH-1.5-OpenSSH_2.9p2
debug1: Waiting for server public key.
debug1: Received server public key (768 bits) and host key (1024 bits).
debug1: Host 'apollo' is known and matches the RSA1 host key.
debug1: Found key in /var/www/.ssh/known_hosts:1
debug1: Encryption type: blowfish
debug1: Sent encrypted session key.
debug1: Installing crc compensation attack detector.
debug1: Received encrypted confirmation.
debug1: Doing password authentication.
[EMAIL PROTECTED]'s password:
Graeme
