Permission denied when trying to ssh

Permission denied when trying to ssh

by Mary Cooch -
Number of replies: 13
Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Testers Picture of Translators

I have a dev site on  a VPS that was set up for me years ago and which I update regularly by simply going to my terminal, logging in and typing git pull origin master. (The only phrase I know.)

I  haven't updated in recent weeks for various reasons but when I tried today I got this error message:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

 - I haven't changed anything on my VPS - I don't know how to. The only change I can think of is that a few weeks ago I asked my hosting company to set up unoconv for me, which they did. That may or may not be relevant.

I have googled the error message but don't really understand the responses although one seems to suggest my folder permissions might have been changed. I will contact the hosting company, who are quite helpful, but if would be really good if someone has an idea what might have happened here so I can point them in the right direction or at least not sound completely ignorantsmile

Thanks


Average of ratings: -
In reply to Mary Cooch

Re: Permission denied when trying to ssh

by Ken Task -
Picture of Particularly helpful Moodlers

Would think just sharing the info you've shared hear about the ssh permission denied error would be all they needed.   Don't think unoconv is related.

Many folks have setup ssh access now with keys ... your workstation provides an ssh key to the server which is allowed.   So do you re-call in the past was the behavoir of such access logging on as root or some user and you were not prompted for a password?

There's been quite a few issues surrounding openssl - that which is used to generate those keys - so if it's been a while since you last ssh'd into that server, that could be the issue.   You *might* need to generate a key to send to server/technical folks so they can setup the key on the server.  Like I said, they should be able to help/fix.

'spirit of sharing', Ken


Average of ratings: -
In reply to Ken Task

Re: Permission denied when trying to ssh

by Mary Cooch -
Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Testers Picture of Translators

I've always just typed in ssh mywebsite@ 111.222.333.44 (if you know what I mean) and then I have been promoted for a password, which I've entered, and then I am in. But this time I wasn't even allowed to enter my password because once I typed the first details I was denied access. Well- let's see if they work weekends as I'll put in a support ticket now smile

Average of ratings: -
In reply to Mary Cooch

Re: Permission denied when trying to ssh

by Ken Task -
Picture of Particularly helpful Moodlers

Yes, that's one way to use the ssh command from command line.   In the past, I've had an issue where the true server admin changed the default port for ssh connections so something like that could have been done on the server end.   Without knowing what port to use when attempting to connect would mean scanning something like 65000 ports.    Uhhh ... don't think I'll do that.

There is something that you might be able to do to provide more information to help desk ... there's a 'debug' switch to the ssh command:

ssh -v user@serverIP

The -v's output to your screen what's going on in detail - a debug with level 1.   Now don't ask me what it all means!  Can increase debug using two v's ... like -vv in the command.

One of those debug output lines is similar to what you saw/get:

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password

So the connection tries publickey first.   Then gssapi-keyex.   Then gssapi-with-mic, then, and finally password.

You are getting a permission denied - which could be an issue on either end ... your end or server.

Try the -v switch for your command ... don't share back here ... but that will give more info for helpdesk folks.

'spirit of sharing', Ken



Average of ratings: -
In reply to Ken Task

Re: Permission denied when trying to ssh

by Mary Cooch -
Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Testers Picture of Translators
Well I am thoroughly confused sad This is what happens when you try to do things you know nothing about !

I did get some helpful suggestions from my webhosts but they began with "If you know the exact Private key.." .. well I didn't know I had one let alone a keypair, something else they mentioned. I also tried on a terminal on a different Ubuntu laptop and got the same permission denied error but I suppose maybe that is because my site is set up so it will only connect via the one laptop?? (The site itself is all online not on my laptop.)

Anyway  - I responded to their reply and will see what they say.

Average of ratings: -
In reply to Mary Cooch

Re: Permission denied when trying to ssh

by Emma Richardson -
Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers

When you first set up an ssh connection, your computer will normally save a key (like a long password) to help it recognize the site again.  If the key has changed, it might be your computer thinking it is the wrong site.  However, you said you are getting the same error from another computer which means it about has to be the site, not the computer.

Average of ratings: -
In reply to Mary Cooch

Re: Permission denied when trying to ssh

by Ken Task -
Picture of Particularly helpful Moodlers

Many servers have little apps running that help protect the server from hackers/crackers that might try a dictionary type attack on a server.   Think Ubuntu's most oft used/popular is Fail2Ban.   If an IPAddress attempts to login X number of times and fails to provide the correct password, the IP address is blocked - and depending upon how strict one has setup Fail2Ban that could be for a few hours or a day or X length of time ... or permanent (unless someone who has access to server clears the recorded IP address that's being blocked).

The other laptop you tried from might actually appear to the server as coming from the same IP address ... the gateway IP of whatever network you are on.

Did they suggest trying to login via this:

ssh -v loginname@IPAddressofserver

The -v in front is like turning on debugging in Moodle.


When using -v in front it outputs what's going on.

Now I am using a Mac to do this, but it should be similar on a Ubuntu.

First line output by the debug should show versions:

OpenSSH_xxxx, LibreSSL xxxx

debug1: Reading configuration data /etc/ssh/ssh_config

Shows what config file it's reading

debug1: /etc/ssh/ssh_config line 21: Applying options for *

Shows what options it's applying

debug1: Connecting to FQDN [IPADDRESSOFSERVER] port XX.

debug1: Connection established.

The last two shows it did connect to server ... the lines go on in a
working connection to show the files (keys) it's looking for to use to
connect ... i.e., send to the server.  Also tries different ciphers.
What's going on ... your laptop is negotiating with the server to see how
it can connect.

Eventually, one sees:

debug1: Authentications that can continue: publickey,gssapi-with-mic,password

IF your connection attempt stops at that line ... which is what you've reported ... it could be ownerships/permissions on directories/files on your laptop ... any laptop if that laptop also Ubuntu and acquired updates to it's OS.

Ubuntu laptops are just like Ubuntu servers in that they do get updates to operating system things ... and like I mentioned earlier, there has been issues this past year related to openssl thus ssh.

This is also similar to Moodle's setup of Moodle Networking.

If nothing else, the -v will give you information you could share with helpdesk and might help them provide more targeted suggestions.    There really isn't one set answer to the problem.

While Google is normally your friend, if one uses:

https://www.google.com/search?q=ubuntu+ssh+Permission+denied+%28publickey%2Cgssapi-keyex%2Cgssapi-with-mic%29&ie=utf-8&oe=utf-8

you'll see there are quite a few hits .... and the resolutions to the issue aren't always the same.

And I would be cautious about trying things that one might read.

'spirit of sharing', Ken


Average of ratings: -
In reply to Ken Task

Re: Permission denied when trying to ssh

by Mary Cooch -
Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Testers Picture of Translators

Right  - so -I am attaching what I saw on the terminal when I type in what you suggested. (Note - I removed this attachment)

Also when I accessed my server via the Plesk Control panel and looked at the SSH  option I got the message

Note: Password authentication is switched off in the local SSH server configuration. If you are unable to connect using the SSH Terminal, please set "PasswordAuthentication yes" in the /etc/ssh/sshd_config file.

I looked at that file in my laptop etc/ssh/ssh config file but it already said Password Authentication set to Yes.

Average of ratings: -
In reply to Mary Cooch

Re: Permission denied when trying to ssh

by Ken Task -
Picture of Particularly helpful Moodlers

Uhhhh, you might want to remove the readout file.  It does disclose a little too much.

Am looking at it now and will attempt to gather from it what I can.

'spirit of sharing', Ken

Average of ratings: -
In reply to Ken Task

Re: Permission denied when trying to ssh

by Mary Cooch -
Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Testers Picture of Translators

Thanks Ken. I removed it. I'm very disillusioned really because all I want is to be able to updage my dev site with a simple git pull command and for some reason it's all gone wrong and I don't have a clue how to remedy it.

Average of ratings: -
In reply to Mary Cooch

Re: Permission denied when trying to ssh

by Ken Task -
Picture of Particularly helpful Moodlers

You might have found the problem.

Since your attempt to connect is running through all possible methods/means (it runs through using all of the key files (public and private ... you have a couple that are for specific server hosts) in /home/marysredlaptop/.ssh/) until the last method left ... that of password.

"please set "PasswordAuthentication yes" in the /etc/ssh/sshd_config file" is the sshd_config file on your server - not the workstation you are using.

So if you have some sort of tool that can browse and edit files ... edit sshd_config in /etc/ssh/ and change the variable in that config file from PasswordAuthentication no to PasswordAuthentication yes

Save the file.

Might have to restart the sshd daemon for that change to take affect.  You might have to get helpdesk folks to not only edit it for you but restart the daemon (if that's required).

BTW, if I have found where you are hosted correctly, https://kb.layershift.com/ does have a page on using Putty (Windows ssh client) but nada for Ubuntu/MacOSX or other linux flavored machines.

Did see one troubleshooting suggestion that one might try (for grins .... just to see if you get a password prompt):

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no [username]@[IPADDRESS]

You replace the [] with appropriate info/values.

The only other thing found has to do with ownerships/permissons on .ssh directory/files in the home account with which you logged onto the Ubuntu laptop.

ls -lR .ssh

will list all the files (those keys) and show ownership/permissions).  I would think that all those should be owned by the account name you logged on with to the laptop readable and writable by that user ... with no other group nor other permissions ...

'spirit of sharing', Ken




Average of ratings: Useful (1)
In reply to Ken Task

Re: Permission denied when trying to ssh

by Mary Cooch -
Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Testers Picture of Translators
Yay smile Double success -first, because your prompting me to do that troubleshooting from my terminal alerted you to this (quotesmile

"please set "PasswordAuthentication yes" in the /etc/ssh/sshd_config file" is the sshd_config file on your server - not the workstation you are using.

in other words, the problem is at their end, not mine - and second because when I sent them that file as you suggested, I heard back (quotesmile

Terribly sorry for the misunderstanding! Can you try to ssh now? There was an issue with the ssh configuration on the server itself. Sorry for any inconvenience caused.

So I did, and all is back to normal again smile

Thank you so much for your advice. (PS - those aren't my hosts, unless they operate under several different names.)

Average of ratings: Useful (1)
In reply to Mary Cooch

Re: Permission denied when trying to ssh

by Ken Task -
Picture of Particularly helpful Moodlers

Good!  Give yourself a +1 cause you found it ... I just pointed out it referred to server ... not the workstation being used. ;)

'spirit of sharing', Ken


Average of ratings: Useful (1)
In reply to Ken Task

Re: Permission denied when trying to ssh

by Mary Cooch -
Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Testers Picture of Translators

Of course - nothing is ever that simple - once I managed to log in and upgrade my Moodle dev site I discovered that my version of PHP (5.4.23) is way too old for 3.2 which needs a minimum of 5.6.5 so the site doesn't work now anywaybig grinbig grin

But hopefully my PHP version can be upgraded without too much trauma on my part so I'm still calling it a successful end of day!

Average of ratings: -