Cannot SSH using public key

IRJ

@DustinB3403 said in Cannot SSH using public key:

Why wouldn't you use ssh-copy-id to get the key to the public scan_user?

I copied the key to my box that way, and I am still getting same error. In practice, that is no different then what I was doing anyway. Maybe less steps, but same as specifying a key, right?

DustinB3403

@IRJ said in Cannot SSH using public key:

@DustinB3403 said in Cannot SSH using public key:

Why wouldn't you use ssh-copy-id to get the key to the public scan_user?

I copied the key to my box that way, and I am still getting same error. In practice, that is no different then what I was doing anyway. Maybe less steps, but same as specifying a key, right?

Well no, the ssh-copy-id command puts the key into the authorized keys on the public machine. The way you're doing it is applying a key to a user directory.

~/.ssh/authorized\ keys

Whereas the guide you're following is putting the key directly into

/home/scan_man/.ssh

The key is in a completely different location.

IRJ

@stacksofplates said in Cannot SSH using public key:

Also what distro are you logging into?

Using Ubuntu and trying to follow their broken guide :pouting_face:

https://tenable.force.com/s/article/SSH-Public-Key-Authentication

DustinB3403

@IRJ And to confirm, you aren't using putty to generate the key pair?

stacksofplates

Yeah I don't like Nessus for many reasons but one is because they're telling you to use DSA keys. That's been deprecated. Try using RSA.

IRJ

@DustinB3403 said in Cannot SSH using public key:

@IRJ And to confirm, you aren't using putty to generate the key pair?

right.

DustinB3403

Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .

This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key

travisdh1

@IRJ First off, generate the key as the user, just to make everything that much simpler. Use sudo if you have to.

sudo - scan_user keygen

Then copy the public key wherever.

sudo - scan_user ssh-copy-id scan_user@wherever

If those throw an error, try without the - (that tells sudo to fully load the scan_user profile.)

No mussing about with permissions, they are set coherently already.

As @DustinB3403 said, Nessus will have to support the encryption. If they don't support at least RSA, all these "security" things they tell you to do is not worth anything.

IRJ

@DustinB3403 said in Cannot SSH using public key:

Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .
This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key

Yeah those guides are fucked. This the second one I am following today and the second one that is completely fucked up.

travisdh1

@IRJ said in Cannot SSH using public key:

@DustinB3403 said in Cannot SSH using public key:
Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .
This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key
Yeah those guides are fucked. This the second one I am following today and the second one that is completely fucked up.

/agree

IRJ

@travisdh1 said in Cannot SSH using public key:

@IRJ said in Cannot SSH using public key:
@DustinB3403 said in Cannot SSH using public key:
Technically the guide I see here is showing RSA key pairs and not dsa, even though the instructions say to use

ssh-keygen -t dsa

. . .
This will create the following files 2 files;
/home/scan_man/.ssh/new_id_rsa.pub  ===> Public Key
/home/scan_man/.ssh/new_id_rsa  ===> Private Key
Yeah those guides are fucked. This the second one I am following today and the second one that is completely fucked up.
/agree

I figured the first one out. I guess I should make guides here once I am done, because the interwebs does not have any good documentation for this and Tenable has really screwed up.

IRJ

@travisdh1 said in Cannot SSH using public key:

@IRJ First off, generate the key as the user, just to make everything that much simpler. Use sudo if you have to.
sudo - scan_user keygen
Then copy the public key wherever.
sudo - scan_user ssh-copy-id scan_user@wherever
If those throw an error, try without the - (that tells sudo to fully load the scan_user profile.)

No mussing about with permissions, they are set coherently already.

As @DustinB3403 said, Nessus will have to support the encryption. If they don't support at least RSA, all these "security" things they tell you to do is not worth anything.

It should support RSA , and it looks like i should switch user to generate keys. I dont see anywhere to generate for another user.

DustinB3403

@IRJ Just login as the scan_user and then run the ssh-keygen process if you want to run it under that user account.

DustinB3403

Literally su scan_user
ssh-keygen -t rsa

IRJ

@DustinB3403 said in Cannot SSH using public key:

Literally su scan_user
ssh-keygen -t rsa

yeah doing it now.

IRJ

Still getting permission denied when trying to login even via ssh-copy-id

IRJ

I want to throw something right now!!! This should be so basic!!! ugh

DustinB3403

@IRJ okay lets take a step back.

Can you ssh into this unit as scan_user ?

ssh [email protected] ?

IRJ

@DustinB3403 said in Cannot SSH using public key:

@IRJ okay lets take a step back.

Can you ssh into this unit as scan_user ?

ssh [email protected] ?

I cannot right now because I have these lines in sshd

Match User scan_user
    PasswordAuthentication no

DustinB3403

@IRJ said in Cannot SSH using public key:

@DustinB3403 said in Cannot SSH using public key:

@IRJ okay lets take a step back.

Can you ssh into this unit as scan_user ?

ssh [email protected] ?

I cannot right now because I have these lines in sshd
Match User scan_user
    PasswordAuthentication no

Then you would never be able to copy the key to this system. You need password auth first, which can be disabled once you have working keys.

Unless you manually copy and paste the key to this system, which is stupid.

Just enable passauth for the time, setup the key with ssh-copy-id and then turn off the passwordauth.