Cannot SSH using public key

IRJ

Hey guys I am trying to configure this scan user for key login, but I am beating my head against the desk as I've run out of googling resources...

Here is my error message:

debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: mars_scan_user_key
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
scan_user@mars: Permission denied (publickey).

Here is the relevant parts my sshd_config

PasswordAuthentication yes

# Nessus scan user
Match User scan_user
    PasswordAuthentication no

# Key Authentication
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys .ssh/authorized_keys2

My steps for installation were as follows:

sudo useradd -m scan_user
sudo groupadd scan
sudo usermod -aG scan scan_user 
sudo mkdir /home/scan_user/.ssh

I generated the key as sudo, but dropped the key in /home/scan_user/.ssh/new_id_rsa.pub and changed owner of that directory to scan_user

sudo ssh-keygen -t dsa
sudo mv /home/scan_user/.ssh/new_id_rsa.pub /home/scan_user/.ssh/authorized_keys
sudo chown -R scan_user:scan_user /home/scan_user/.ssh/
sudo chmod 0600 /home/scan_user/.ssh/authorized_keys
sudo chmod 0700 /home/scan_user/.ssh
sudo scp /home/scan_user/.ssh/new_id_rsa [email protected]:mars_scan_user_key

Then from my box I am running the following command

ssh -v -i mars_scan_user_key scan_user@mars

DustinB3403

Why wouldn't you use ssh-copy-id to get the key to the public scan_user?

IRJ

@DustinB3403 said in Cannot SSH using public key:

Why wouldn't you use ssh-copy-id to get the key to the public scan_user?

I am trying to configure for a nessus scan. I need to upload it via GUI.

stacksofplates

@IRJ said in Cannot SSH using public key:

@DustinB3403 said in Cannot SSH using public key:

Why wouldn't you use ssh-copy-id to get the key to the public scan_user?

I am trying to configure for a nessus scan. I need to upload it via GUI.

What key size are you setting? I vaguely remember Nessus not supporting something. It might have been ecdsa keys but it might have been the size also. It's been a while.

stacksofplates

Also what distro are you logging into?

IRJ

@DustinB3403 said in Cannot SSH using public key:

Why wouldn't you use ssh-copy-id to get the key to the public scan_user?

I copied the key to my box that way, and I am still getting same error. In practice, that is no different then what I was doing anyway. Maybe less steps, but same as specifying a key, right?

DustinB3403

@IRJ said in Cannot SSH using public key:

@DustinB3403 said in Cannot SSH using public key:

Why wouldn't you use ssh-copy-id to get the key to the public scan_user?

I copied the key to my box that way, and I am still getting same error. In practice, that is no different then what I was doing anyway. Maybe less steps, but same as specifying a key, right?

Well no, the ssh-copy-id command puts the key into the authorized keys on the public machine. The way you're doing it is applying a key to a user directory.

~/.ssh/authorized\ keys

Whereas the guide you're following is putting the key directly into

/home/scan_man/.ssh

The key is in a completely different location.

IRJ

@stacksofplates said in Cannot SSH using public key:

Also what distro are you logging into?

Using Ubuntu and trying to follow their broken guide :pouting_face:

https://tenable.force.com/s/article/SSH-Public-Key-Authentication

DustinB3403

@IRJ And to confirm, you aren't using putty to generate the key pair?

stacksofplates

Yeah I don't like Nessus for many reasons but one is because they're telling you to use DSA keys. That's been deprecated. Try using RSA.

IRJ

@DustinB3403 said in Cannot SSH using public key:

@IRJ And to confirm, you aren't using putty to generate the key pair?

right.

DustinB3403

Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .

This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key

travisdh1

@IRJ First off, generate the key as the user, just to make everything that much simpler. Use sudo if you have to.

sudo - scan_user keygen

Then copy the public key wherever.

sudo - scan_user ssh-copy-id scan_user@wherever

If those throw an error, try without the - (that tells sudo to fully load the scan_user profile.)

No mussing about with permissions, they are set coherently already.

As @DustinB3403 said, Nessus will have to support the encryption. If they don't support at least RSA, all these "security" things they tell you to do is not worth anything.

IRJ

@DustinB3403 said in Cannot SSH using public key:

Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .
This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key

Yeah those guides are fucked. This the second one I am following today and the second one that is completely fucked up.

travisdh1

@IRJ said in Cannot SSH using public key:

@DustinB3403 said in Cannot SSH using public key:
Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .
This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key
Yeah those guides are fucked. This the second one I am following today and the second one that is completely fucked up.

/agree

IRJ

@travisdh1 said in Cannot SSH using public key:

@IRJ said in Cannot SSH using public key:
@DustinB3403 said in Cannot SSH using public key:
Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .
This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key
Yeah those guides are fucked. This the second one I am following today and the second one that is completely fucked up.
/agree

I figured the first one out. I guess I should make guides here once I am done, because the interwebs does not have any good documentation for this and Tenable has really screwed up.

IRJ

@travisdh1 said in Cannot SSH using public key:

@IRJ First off, generate the key as the user, just to make everything that much simpler. Use sudo if you have to.
sudo - scan_user keygen
Then copy the public key wherever.
sudo - scan_user ssh-copy-id scan_user@wherever
If those throw an error, try without the - (that tells sudo to fully load the scan_user profile.)

No mussing about with permissions, they are set coherently already.

As @DustinB3403 said, Nessus will have to support the encryption. If they don't support at least RSA, all these "security" things they tell you to do is not worth anything.

It should support RSA , and it looks like i should switch user to generate keys. I dont see anywhere to generate for another user.

DustinB3403

@IRJ Just login as the scan_user and then run the ssh-keygen process if you want to run it under that user account.

DustinB3403

Literally su scan_user
ssh-keygen -t rsa

IRJ

@DustinB3403 said in Cannot SSH using public key:

Literally su scan_user
ssh-keygen -t rsa

yeah doing it now.