0

I've broken ssh passwordless logins on MacA and MacB on my LAN. (Catalina and Monterey.) I wanted to write a simple, low-paranoia, no-understanding-required recipe for setting up passwordless ssh for the several users on two local Macs. To start from scratch, I deleted ~/.ssh from each user.

I gleaned from the many different articles I found that running ssh-keygen (no args) on MacA and accepting the defaults, and then copying the resulting ~/.ssh to a user on MacB would be sufficient to allow me to ssh in as that user, as well as to then ssh back in to MacA.

(One Linux-oriented source mentioned using ssh-copy-id to copy the public/private keys to MacB. I found this in /usr/bin and tried it, but all it did was create a file in .ssh/ called authenticated_hosts -- it did not copy id_rsa or id_rsa.pub. So I abandoned that.)

As a last-ditch effort I used homebrew to install openSSL, but nothing changed.

At any rate, once I had duplicate ~/.ssh on both users, with the public and private key files in both and the permissions verified (700 on .ssh, 600 on id_rsa, and 644 on id_rsa.pub), I tried running ssh user@macb.local from MacA, but I'm always prompted for a password.

I'd appreciate a hand. Here is the verbose output:

OpenSSH_9.0p1, OpenSSL 1.1.1n  15 Mar 2022
debug1: Reading configuration data /opt/homebrew/etc/ssh/ssh_config
debug1: Connecting to retsina.local [fe80::b79e:86e0:dfcc%en0] port 22.
debug1: Connection established.
debug1: identity file /Users/chap/.ssh/id_rsa type 0
debug1: identity file /Users/chap/.ssh/id_rsa-cert type -1
debug1: identity file /Users/chap/.ssh/id_ecdsa type -1
debug1: identity file /Users/chap/.ssh/id_ecdsa-cert type -1
debug1: identity file /Users/chap/.ssh/id_ecdsa_sk type -1
debug1: identity file /Users/chap/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /Users/chap/.ssh/id_ed25519 type -1
debug1: identity file /Users/chap/.ssh/id_ed25519-cert type -1
debug1: identity file /Users/chap/.ssh/id_ed25519_sk type -1
debug1: identity file /Users/chap/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /Users/chap/.ssh/id_xmss type -1
debug1: identity file /Users/chap/.ssh/id_xmss-cert type -1
debug1: identity file /Users/chap/.ssh/id_dsa type -1
debug1: identity file /Users/chap/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.0
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.1
debug1: compat_banner: match: OpenSSH_8.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to retsina.local:22 as 'chap'
debug1: load_hostkeys: fopen /Users/chap/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:LPhM+eeposmTyzQiRXnh92AUZr/9MIrMgiW3VjLHCQM
debug1: load_hostkeys: fopen /Users/chap/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /opt/homebrew/etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'retsina.local' is known and matches the ED25519 host key.
debug1: Found key in /Users/chap/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: ssh_fetch_identitylist: agent contains no identities
debug1: Will attempt key: /Users/chap/.ssh/id_rsa RSA SHA256:sEwBJnORX9BWQ5itF6CoX36w7jcl6E0Lcnkunvh4ew8
debug1: Will attempt key: /Users/chap/.ssh/id_ecdsa
debug1: Will attempt key: /Users/chap/.ssh/id_ecdsa_sk
debug1: Will attempt key: /Users/chap/.ssh/id_ed25519
debug1: Will attempt key: /Users/chap/.ssh/id_ed25519_sk
debug1: Will attempt key: /Users/chap/.ssh/id_xmss
debug1: Will attempt key: /Users/chap/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/chap/.ssh/id_rsa RSA SHA256: [HIDDEN]
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Trying private key: /Users/chap/.ssh/id_ecdsa
debug1: Trying private key: /Users/chap/.ssh/id_ecdsa_sk
debug1: Trying private key: /Users/chap/.ssh/id_ed25519
debug1: Trying private key: /Users/chap/.ssh/id_ed25519_sk
debug1: Trying private key: /Users/chap/.ssh/id_xmss
debug1: Trying private key: /Users/chap/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
(chap@retsina.local) Password:

1 Answer 1

3

If I understand what you did, the problem is that the public key file in each of the ~/.ssh directories is named something like id_rsa.pub -- that means that's a key that's just sitting there, not one that's allowed to be used to authenticate to that account. You need to copy (or move) that key into a file named ~/.ssh/authorized_keys or ~/.ssh/authorized_keys2 in order to authorize it for login.

(I think this is what ssh-copy-id did. Did you delete the file it created afterward?)

Try running cat ~/.ssh/id_rsa.pub >>~/.ssh/authorized_keys on each of the computers, then try sshing back and forth and see if it works.

Note: as you pointed out in a comment, it's more common (and probably more secure) to use separate keypairs for each computer. That is, generate a keypair on each of the computers, then use ssh-copy-id to install each one's public key in the other's ~/.ssh/authorized_keys file. This way you could also authorize MacA's key to other computers, without implicitly authorizing MacB's key.

2
  • 1
    That worked (in fact, I used ssh-copy-id rather than cat, now that I understand why it does what it does). My confusion stemmed from the fact that I thought it was okay to generate a private key once, and then copy the same private/public key (and authorized_keys) to each account, when normally these would be different people with their own private keys. If you can note or comment upon that, it might catch the attention of someone else with the same idea.
    – Chap
    Apr 15 at 11:46
  • 1
    @Chap I added a note about that. Apr 16 at 1:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .