Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #172792 > unrolled thread

Issues with SSH pubkey authentication at remote server

Started byStephan Beck <sbeck@secure.mailbox.org>
First post2016-09-26 12:30 +0200
Last post2016-09-28 17:20 +0200
Articles 5 on this page of 25 — 6 participants

Back to article view | Back to linux.debian.user

Contents

  Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-26 12:30 +0200
    Re: Issues with SSH pubkey authentication at remote server Lisi Reisz <lisi.reisz@gmail.com> - 2016-09-26 13:30 +0200
      Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-26 13:50 +0200
        Re: Issues with SSH pubkey authentication at remote server Lisi Reisz <lisi.reisz@gmail.com> - 2016-09-26 14:10 +0200
          Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-26 17:20 +0200
            Re: Issues with SSH pubkey authentication at remote server Mark Fletcher <mark27q1@gmail.com> - 2016-09-27 01:00 +0200
              Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-27 10:00 +0200
                OpenSSH security update? was Re: Issues with SSH pubkey  authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-27 11:10 +0200
    Re: Issues with SSH pubkey authentication at remote server Mark Fletcher <mark27q1@gmail.com> - 2016-09-26 13:30 +0200
      Re: Issues with SSH pubkey authentication at remote server Dan Purgert <dan@djph.net> - 2016-09-26 14:10 +0200
        Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-26 17:10 +0200
          Re: Issues with SSH pubkey authentication at remote server Dan Purgert <dan@djph.net> - 2016-09-26 17:40 +0200
            Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-27 10:30 +0200
      Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-26 17:10 +0200
    Re: Issues with SSH pubkey authentication at remote server Lars Noodén <lars.nooden@gmail.com> - 2016-09-26 14:00 +0200
      Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-26 17:10 +0200
        Re: Issues with SSH pubkey authentication at remote server Lars Noodén <lars.nooden@gmail.com> - 2016-09-26 17:20 +0200
          Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-27 00:40 +0200
          Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-27 13:10 +0200
            Re: Issues with SSH pubkey authentication at remote server Lars Noodén <lars.nooden@gmail.com> - 2016-09-27 15:20 +0200
              Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-27 17:10 +0200
                Re: Issues with SSH pubkey authentication at remote server Lars Noodén <lars.nooden@gmail.com> - 2016-09-27 20:40 +0200
                  Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-28 10:50 +0200
                    Re: Issues with SSH pubkey authentication at remote server <tomas@tuxteam.de> - 2016-09-28 11:20 +0200
                      [SOLVED ]Re: Issues with SSH pubkey authentication at remote server Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-28 17:20 +0200

Page 2 of 2 — ← Prev page 1 [2]

#172857

FromStephan Beck <sbeck@secure.mailbox.org>
Date2016-09-27 17:10 +0200
Message-ID<sm2b7-2BP-9@gated-at.bofh.it>
In reply to#172850
Hi Lars,

Lars Noodén:
> On 09/27/2016 02:02 PM, Stephan Beck wrote:
>> Hi Lars,
>>
>> Lars Noodén:
>>> On 09/26/2016 05:46 PM, Stephan Beck wrote:
[sorry for trimming]

>> I've tried again and detected the following:
>> No agent is started when I login to the "local ssh user account".
> 
> It is the one that should be running under your local account that is of
> relevance, or at least should be.  How are you logging in to your "local
> ssh user account" there?
[...]

>Can you tell more about how your login session is started?

I connect to the "local ssh account" by ssh from my other user account.
Now I've tried it several times always repeating this
eval $(ssh-agent)
ssh-add /path/to/key
ssh-add -L (for checking)
procedure and I do not have to enter the passphrase for this session.
>From my point of view I do not need to have the same env in the "local
ssh account" as I have in the other account.

Thanks
Stephan

[toc] | [prev] | [next] | [standalone]

#172865

FromLars Noodén <lars.nooden@gmail.com>
Date2016-09-27 20:40 +0200
Message-ID<sm5sl-4Ah-1@gated-at.bofh.it>
In reply to#172857
On 09/27/2016 06:07 PM, Stephan Beck wrote:
> Lars Noodén:
>> On 09/27/2016 02:02 PM, Stephan Beck wrote:
>> Can you tell more about how your login session is started?
> 
> I connect to the "local ssh account" by ssh from my other user account.

Ok.  Now I see the arrangement.  You are missing a way for "local ssh
account" to receive information about any agent(s) it should have.
If you use ps you can probably see your main account running ssh-agent,
the system having launched it for you and managing the setting of the
appropriate environment variables.

> Now I've tried it several times always repeating this
> eval $(ssh-agent)
> ssh-add /path/to/key
> ssh-add -L (for checking)
> procedure and I do not have to enter the passphrase for this session.

You need a way for your "local ssh account" to start and use an agent.
I'm not sure of the optimal way for you.  Perhaps something in .bashrc?
Others here know more about the shells than I.

>From my point of view I do not need to have the same env in the "local
> ssh account" as I have in the other account.

No, but the "local ssh account" instances need to share the ssh-agent
variables.  If you are logging in multiple times at the same time, you'd
want to share the same agent for that account until the last one logs out.

Regards,
Lars

[toc] | [prev] | [next] | [standalone]

#172883

FromStephan Beck <sbeck@secure.mailbox.org>
Date2016-09-28 10:50 +0200
Message-ID<smiIW-4q0-15@gated-at.bofh.it>
In reply to#172865
Hi Lars,

Lars Noodén:
> On 09/27/2016 06:07 PM, Stephan Beck wrote:
>> Lars Noodén:
>>> On 09/27/2016 02:02 PM, Stephan Beck wrote:
>>> Can you tell more about how your login session is started?
>>
>> I connect to the "local ssh account" by ssh from my other user account.
> 
[...]
> You need a way for your "local ssh account" to start and use an agent.
> I'm not sure of the optimal way for you.  Perhaps something in .bashrc?
> Others here know more about the shells than I.

Or in .profile. But I am not really sure about the exact syntax to use
(this if/then "thing"). I still have to get familiar with that.

I just checked in LX Session Configuration that the ssh-agent is
configured as -->Core applications but disabled in --> Autostart. So
there is another program/process/script that has to be launching the
ssh-agent, because I find it twice in the process list when I login to
my "normal" user account. I'm shivering :-)

I'll keep you informed.

Thanks again.

Stephan

[toc] | [prev] | [next] | [standalone]

#172884

From<tomas@tuxteam.de>
Date2016-09-28 11:20 +0200
Message-ID<smjbX-4Pw-7@gated-at.bofh.it>
In reply to#172883
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Sep 28, 2016 at 08:36:00AM +0000, Stephan Beck wrote:
> Hi Lars,
> 
> Lars Noodén:
> > On 09/27/2016 06:07 PM, Stephan Beck wrote:
> >> Lars Noodén:
> >>> On 09/27/2016 02:02 PM, Stephan Beck wrote:
> >>> Can you tell more about how your login session is started?
> >>
> >> I connect to the "local ssh account" by ssh from my other user account.
> > 
> [...]
> > You need a way for your "local ssh account" to start and use an agent.
> > I'm not sure of the optimal way for you.  Perhaps something in .bashrc?
> > Others here know more about the shells than I.
> 
> Or in .profile. But I am not really sure about the exact syntax to use
> (this if/then "thing"). I still have to get familiar with that.
> 
> I just checked in LX Session Configuration that the ssh-agent is
> configured as -->Core applications but disabled in --> Autostart. So
> there is another program/process/script that has to be launching the
> ssh-agent, because I find it twice in the process list when I login to
> my "normal" user account. I'm shivering :-)

Yes. It depends. If you're typically using X as your environment
(perhaps via some desktop thing: in your case it seems to be LXDE),
then the first go to is your desktop thing's session management.

This way all consoles you start will inherit the "coordinates" of
the agent (in the form of the shell variables SSH_AGEN_PID,
SSH_AUTH_SOCK and perhaps others I forget). With no desktop environ
(plain X), X session management (see /etc/X11/XSession.d for
Debian; there is a 90x11-common_ssh-agent for that). Otherwise
you have to cook up something in your ~/.profile which looks
whether there's an agent around and set it up when no. In a nutshell


  - using a DE: your DE's session management
  - X without DE: X session management
  - naked console: .login, .profile (or .bash_profile, .bash_login)

Have fun
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlfrikAACgkQBcgs9XrR2kbyVwCcDqnECoJHdevg6AXn4Va6TcZO
J4YAnR8vi2TEcBsPNJrm9V2S/TVM6hhz
=wPAD
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#172887 — [SOLVED ]Re: Issues with SSH pubkey authentication at remote server

FromStephan Beck <sbeck@secure.mailbox.org>
Date2016-09-28 17:20 +0200
Subject[SOLVED ]Re: Issues with SSH pubkey authentication at remote server
Message-ID<smoOl-8oo-1@gated-at.bofh.it>
In reply to#172884
Hi,

tomas@tuxteam.de:
> On Wed, Sep 28, 2016 at 08:36:00AM +0000, Stephan Beck wrote:
>> Hi Lars,
> 
>> Lars Noodén:
>>> On 09/27/2016 06:07 PM, Stephan Beck wrote:
>>>> Lars Noodén:
>>>>> On 09/27/2016 02:02 PM, Stephan Beck wrote:
>>>>> Can you tell more about how your login session is started?
>>>>
>>>> I connect to the "local ssh account" by ssh from my other user account.
>>>
>> [...]
[...]
> Yes. It depends. If you're typically using X as your environment
> (perhaps via some desktop thing: in your case it seems to be LXDE),
> then the first go to is your desktop thing's session management.
> 
> This way all consoles you start will inherit the "coordinates" of
> the agent (in the form of the shell variables SSH_AGEN_PID,
> SSH_AUTH_SOCK and perhaps others I forget). With no desktop environ
> (plain X), X session management (see /etc/X11/XSession.d for
> Debian; there is a 90x11-common_ssh-agent for that). Otherwise
> you have to cook up something in your ~/.profile which looks
> whether there's an agent around and set it up when no. In a nutshell
> 
> 
>   - using a DE: your DE's session management
>   - X without DE: X session management
>   - naked console: .login, .profile (or .bash_profile, .bash_login)

Thanks, Tomás. I'll think about what might be the best solution for me.
Configuring LXDE-Startup applications is maybe the best (and easiest)
solution, whereas adapting ~/.profile I'd be forced to train my console
skills, although that would mean that it only affects this specific user
account.

Cheers,

Stephan


I put SOLVED in the subject line, because the "real" issue, the pubkey
authentication at the remote server is working fine now.

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web