CODEWITHSUNDEEP
sshcommand-lineconfigurationsshd
Nate-Wilkins
Nate-Wilkins

Reputation: 5502

Why does SSH work from the command line but not from the SSH config file?

I've found that when running ssh from the command line on my system is different than running it from the ~/.ssh/config file. But I'm not sure how to fix it or if its a problem with the program itself.

I have a server (blueberry.local) and a client (xps.local). Both have a user named bob. Both can resolve each-other with the host command from either box.

The server is running sshd with the following configuration (/etc/ssh/sshd_config):

UsePAM yes
Banner none
AddressFamily any
Port 22
X11Forwarding no
PermitRootLogin no
GatewayPorts no
PasswordAuthentication no
KbdInteractiveAuthentication no
PrintMotd no
AuthorizedKeysFile %h/.ssh/authorized_keys %h/.ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key


KexAlgorithms [email protected],curve25519-sha256,[email protected],diffie-hellman-group-exchange-sha256
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]

LogLevel INFO
UseDNS no

And from my client I'm running ssh with this configuration (~/.ssh/config):

Host blueberry.stark.local
  Port 22
  HostName blueberry.local
  IdentityFile ~/.ssh/blueberry_rsa
  IdentitiesOnly yes

When running ssh from the command line like this:

ssh [email protected] -i ~/.ssh/blueberry_rsa

The command works and I can successfully connect via ssh to the server.

However, when running ssh from the command line using the client configuration like this:

ssh [email protected]

I get an authentication error:

[email protected]: Permission denied (publickey).

What's going on here? I've tried to remove configuration properties and the like but it never works.

What's even stranger is that I have another client configuration just like that that works without any issues at all...

Upvotes: 0

Views: 1689

Answers (1)

deric4
deric4

Reputation: 1326

The issue is likely caused by two factors:

  1. Based on your example command, your Host and HostName values are mixed up:
Host <this should be what you type on the CLI>
  ...
  HostName <The real hostname of the server>
  ...

This means ssh isn't actually going to use any of the configuration you provided. Making the following change should work.

Host blueberry.local
  Port 22
  HostName blueberry.stark.local
  IdentityFile ~/.ssh/blueberry_rsa
  IdentitiesOnly yes

This is most likely if the following command works with the configuration you posted:

ssh [email protected]
  1. If you expected ssh to just try all of your private keys until it found the right one, (~/.ssh/blueberry_rsa), its likely you haven't added it to your ssh-agent (you can confirm by running ssh-add -L and check the output.
by default ssh will check these paths, then any additional keys in the agent:
~/.ssh/id_rsa 
~/.ssh/id_ecdsa 
~/.ssh/id_ecdsa_sk
~/.ssh/id_ed25519
~/.ssh/id_ed25519_sk
~/.ssh/id_xmss
~/.ssh/id_dsa

Its likely you only have ~/.ssh/id_rsa in your agent which is what is throwing the When in trouble, its always helpful to run ssh -vvv <rest of your command> to see whats happening under the hood 😉.

Upvotes: 1

Related Questions