Unable to ssh with private key

Question

I'm trying to connect to remote ssh with private key. But it always prompted to password.

The key file id_rsa (this is copy from the server ~//.ssh/id_rsa file):

-----BEGIN OPENSSH PRIVATE KEY-----
xxx
-----END OPENSSH PRIVATE KEY-----

The command : ssh -vvv -i id_rsa root@xxxx

Here is the logs

 debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolving "xxxx" port 22
debug2: ssh_connect_direct
debug1: Connecting to xxxx [xx.xxx.xxx.xxx] port 22.
debug1: Connection established.
debug1: identity file id_rsa type -1
debug1: identity file id_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.0
debug1: match: OpenSSH_8.0 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to xxxx:22 as 'root'
debug3: hostkeys_foreach: reading file "/home/xxx/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/xxx/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys from xxxx
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc
debug2: ciphers stoc: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc
debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:DmkwRuhDE+dx8IhUpTXWYekQuvummjbjDVWyMasjNw8
debug3: hostkeys_foreach: reading file "/home/xxx/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/xxx/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys from xxxx
debug3: hostkeys_foreach: reading file "/home/xxx/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/xxx/.ssh/known_hosts:4
debug3: load_hostkeys: loaded 1 keys from 47.241.60.247
debug1: Host 'xxxx' is known and matches the ECDSA host key.
debug1: Found key in /home/xxx/.ssh/known_hosts:3
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: id_rsa  explicit
debug2: pubkey_prepare: done
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: id_rsa
debug3: sign_and_send_pubkey: RSA SHA256:AdRGwu8qJ2OWmEuqmKqwdUwEcAWuC4ab8hvHccC2Ha8
debug3: sign_and_send_pubkey: signing using rsa-sha2-512 SHA256:AdRGwu8qJ2OWmEuqmKqwdUwEcAWuC4ab8hvHccC2Ha8
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

have you tried disabling GSSAPI authentication on your machine? Looks like it's both broken and not what you want to use. — Marcus Müller, Jan 14 '22 at 15:11
Do you have access to the server? What is the result of grep sshd /var/log/syslog? — FelixJN, Jan 14 '22 at 15:17
@NoodleX What exactly means "The syslog is not there"? No output? File doesn't exist? If /var/log/syslog does not exist, try /var/log/messages. Please [edit] your question to provide requested information or clarification. — Bodo, Jan 14 '22 at 15:51
Welcome to unix.se! On the remote host (the one you try to connect to, using that private local key): check that you put the corresponding PUBLIC key (local server "~//.ssh/id_rsa.pub" ?) inside the remote_user "~remote_user/.ssh/authorized_keys" file, and check that is is only on 1 line (when pasting it coud become several: fix that), and also that neither .ssh nor authorized_keys are to wildly "open". (on the remote server (and as that remote user) : chmod 700 ~remote_user/.ssh ; chmod 600 ~remote_user/.ssh/authorized_keys ) — Olivier Dulac, Jan 14 '22 at 16:15
Does this answer your question? Why am I still getting a password prompt with ssh with public key authentication? — Chris Davies, Jan 14 '22 at 16:59

Seamus · Accepted Answer · 2022-01-15T00:30:14.347

I can't/won't try to decipher the log messages, and the following is offered on the basis of your issue with the password in your question. Two possibilities for this occur to me:

If you're getting a password prompt, that may be because you opted to password-protect your key when you generated your keys with ssh-keygen. This is not the same as authenticating yourself to the server with a passphrase - the password created during ssh-keygen is to prevent someone else from using the key pair you generated.
Just to briefly review basic SSH functionality:

The system from which you initiate the SSH connection is the client.
The system to which the client connects is the server.
The public & private key generation is done on the client
The public key is transferred from the client to the server
There are many good tutorials available on this proedure. This one from DO seems like a good one to me.

Unable to ssh with private key

1 Answers1