<div dir="ltr"><div><div><div><div><div><div><div><div><div><div>Hello ! </div>I send you this mail because I have a problem linked with SSH and FreeIPA. </div>I have multiple servers : - One with FreeIPA server 3.0.0-26 </div></div>- The others with FreeIPA client 3.0.0-26 </div>They are running on RHEL 6.4. </div> </div>I configured a root user on each of them. On one specific server, I created an rsa key in order to connect passwordlessly from a specific server to all the others </div>#### ssh-keygen -t rsa #### </div>I distributed the public key on all the others : #### </div>for i in ${my_server_list}; do scp /root/.ssh/id_rsa.pub $i:/root/.ssh/authorized_keys; done #### <div><div><div>Once it was done, I modified the rights on these files : #### for i in ${my_server_list}; do scp $i "chmod 644 /root/.ssh/authorized_keys"; done #### </div><div>And I was able to connect to all these servers without entering a password. The system was working well. </div><div>When I installed ipa-server on a specific server, this connection with the RSA key was not possible anymore. </div><div>Each time I tried to connect to the server through SSH, it keeps asking me for a password. </div><div>I tried to install the ipa-client on another server to just check if I had the same behaviour and indeed, each time I run ipa-client-install, I can't connect passwordlessly with root anymore. </div><div>Here is the commannd I use for the ipa-client-install : #### ipa-client-install -U --realm=MYREALM --domain=<a href="http://mydomain.com">mydomain.com</a> --server=<a href="http://myipaserver.mydomain.com">myipaserver.mydomain.com</a> --principal=admin --password=XXXXX --mkhomedir -N --ca-cert=/tmp/ca.crt --hostname=<a href="http://myipaclient1.mydomain.com">myipaclient1.mydomain.com</a> #### </div><div>When I add the option --no-sshd, the ssh passwordless connection is still operationnal, but if I don't put this option, then my ssh passwordless connection does not work anymore. </div><div>Here is the content of the sshd_config file before (ssh pubkey connection working) and after (ssh pubkey connection not working) : </div><div>Before : #### AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv XMODIFIERS AllowGroups staff root ChallengeResponseAuthentication no ClientAliveCountMax 0 ClientAliveCountMax 99999 ClientAliveInterval 300 DSAAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials yes HostbasedAuthentication no IgnoreRhosts yes IgnoreUserKnownHosts yes KerberosAuthentication no LogLevel VERBOSE MaxAuthTries 4 PasswordAuthentication yes PermitEmptyPasswords no PermitRootLogin yes Protocol 2 PubkeyAuthentication yes RhostsRSAAuthentication no RSAAuthentication yes StrictModes yes Subsystem sftp /usr/libexec/openssh/sftp-server SyslogFacility AUTHPRIV TCPKeepAlive yes UsePAM yes X11Forwarding yes #### </div><div>After, when it does not work : #### AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv XMODIFIERS AllowGroups staff root AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys ChallengeResponseAuthentication no ClientAliveCountMax 0 ClientAliveCountMax 99999 ClientAliveInterval 300 DSAAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials yes HostbasedAuthentication no IgnoreRhosts yes IgnoreUserKnownHosts yes KerberosAuthentication no LogLevel VERBOSE MaxAuthTries 4 PasswordAuthentication yes PermitEmptyPasswords no PermitRootLogin yes Protocol 2 PubkeyAuthentication yes RhostsRSAAuthentication no RSAAuthentication yes StrictModes yes Subsystem sftp /usr/libexec/openssh/sftp-server SyslogFacility AUTHPRIV TCPKeepAlive yes UsePAM yes X11Forwarding yes #### </div><div>A quick diff -u shows me that the only difference between these configurations is the following parameter in the new file (when it does not work) : #### AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys </div><div>#### </div><div>Here is the log of the SSH connection when it works : #### ssh -vvv <a href="http://myipaclient1.mydomain.com">myipaclient1.mydomain.com</a> OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 <a href="http://myipaclient1.mydomain.com">myipaclient1.mydomain.com</a> debug1: permanently_set_uid: 0/0 debug1: permanently_drop_suid: 0 debug3: Not a RSA1 key file /root/.ssh/id_rsa. debug2: key_type_from_name: unknown key type '-----BEGIN' debug3: key_read: missing keytype debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug2: key_type_from_name: unknown key type '-----END' debug3: key_read: missing keytype debug1: identity file /root/.ssh/id_rsa type 1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug2: fd 5 setting O_NONBLOCK debug2: fd 4 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug3: Wrote 792 bytes for a total of 813 debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a> debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a> debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug3: Wrote 24 bytes for a total of 837 debug2: dh_gen_key: priv key bits set: 131/256 debug2: bits set: 547/1024 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug3: Wrote 144 bytes for a total of 981 debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts debug3: check_host_in_hostfile: filename /var/lib/sss/pubconf/known_hosts debug3: key_read: type mismatch debug3: check_host_in_hostfile: match line 3 debug1: Host '<a href="http://myipaclient1.mydomain.com">myipaclient1.mydomain.com</a>' is known and matches the RSA host key. debug1: Found key in /var/lib/sss/pubconf/known_hosts:3 debug2: bits set: 543/1024 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: Wrote 16 bytes for a total of 997 debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug3: Wrote 48 bytes for a total of 1045 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /root/.ssh/id_rsa (0x7fc58a994d60) debug2: key: /root/.ssh/id_dsa ((nil)) debug3: Wrote 64 bytes for a total of 1109 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup gssapi-keyex debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-keyex debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug2: we did not send a packet, disable method debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_0' not found debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_0' not found debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_0' not found debug2: we did not send a packet, disable method debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering public key: /root/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug3: Wrote 368 bytes for a total of 1477 debug1: Server accepts key: pkalg ssh-rsa blen 277 debug2: input_userauth_pk_ok: SHA1 fp 8a:27:ab:1c:29:62:e8:d5:c0:f8:39:08:48:c8:5e:87:95:d9:13:8f debug3: sign_and_send_pubkey debug1: read PEM private key done: type RSA debug3: Wrote 640 bytes for a total of 2117 debug1: Authentication succeeded (publickey). debug1: channel 0: new [client-session] debug3: ssh_session2_open: channel_new: 0 debug2: channel 0: send open debug1: Requesting <a href="mailto:no-more-sessions@openssh.com">no-more-sessions@openssh.com</a> debug1: Entering interactive session. debug3: Wrote 128 bytes for a total of 2245 debug2: callback start debug2: client_session2_setup: id 0 debug2: channel 0: request pty-req confirm 1 debug1: Sending environment. debug3: Ignored env HOSTNAME debug3: Ignored env TERM debug3: Ignored env SHELL debug3: Ignored env HISTSIZE debug3: Ignored env SSH_CLIENT debug3: Ignored env SSH_TTY debug3: Ignored env USER debug3: Ignored env LS_COLORS debug3: Ignored env MAIL debug3: Ignored env PATH debug3: Ignored env PWD debug1: Sending env LANG = en_US.UTF-8 debug2: channel 0: request env confirm 0 debug3: Ignored env KRB5CCNAME debug3: Ignored env HISTCONTROL debug3: Ignored env SHLVL debug3: Ignored env HOME debug3: Ignored env LOGNAME debug3: Ignored env SSH_CONNECTION debug3: Ignored env LESSOPEN debug3: Ignored env HISTTIMEFORMAT debug3: Ignored env G_BROKEN_FILENAMES debug3: Ignored env _ debug3: Ignored env OLDPWD debug2: channel 0: request shell confirm 1 debug2: callback done debug2: channel 0: open confirm rwindow 0 rmax 32768 debug3: Wrote 448 bytes for a total of 2693 debug2: channel_input_status_confirm: type 99 id 0 debug2: PTY allocation request accepted on channel 0 debug2: channel 0: rcvd adjust 2097152 debug2: channel_input_status_confirm: type 99 id 0 debug2: shell request accepted on channel 0 Last login: Tue Jun 2 18:16:48 2015 from <a href="http://myotherserver.mydomain.com">myotherserver.mydomain.com</a> #### </div><div>And here it is when it does not work : #### ssh -vvv <a href="http://myipaclient1.mydomain.com">myipaclient1.mydomain.com</a> OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 <a href="http://myipaclient1.mydomain.com">myipaclient1.mydomain.com</a> debug1: permanently_set_uid: 0/0 debug1: permanently_drop_suid: 0 debug3: Not a RSA1 key file /root/.ssh/id_rsa. debug2: key_type_from_name: unknown key type '-----BEGIN' debug3: key_read: missing keytype debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug2: key_type_from_name: unknown key type '-----END' debug3: key_read: missing keytype debug1: identity file /root/.ssh/id_rsa type 1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug2: fd 5 setting O_NONBLOCK debug2: fd 4 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug3: Wrote 792 bytes for a total of 813 debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a> debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a> debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug3: Wrote 24 bytes for a total of 837 debug2: dh_gen_key: priv key bits set: 131/256 debug2: bits set: 521/1024 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug3: Wrote 144 bytes for a total of 981 debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts debug3: check_host_in_hostfile: filename /var/lib/sss/pubconf/known_hosts debug3: key_read: type mismatch debug3: check_host_in_hostfile: match line 3 debug1: Host '<a href="http://myipaclient1.mydomain.com">myipaclient1.mydomain.com</a>' is known and matches the RSA host key. debug1: Found key in /var/lib/sss/pubconf/known_hosts:3 debug2: bits set: 510/1024 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: Wrote 16 bytes for a total of 997 debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug3: Wrote 48 bytes for a total of 1045 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /root/.ssh/id_rsa (0x7f1de9428d60) debug2: key: /root/.ssh/id_dsa ((nil)) debug3: Wrote 64 bytes for a total of 1109 debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,password debug3: start over, passed a different list gssapi-keyex,gssapi-with-mic,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup gssapi-keyex debug3: remaining preferred: gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-keyex debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug2: we did not send a packet, disable method debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_0' not found debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_0' not found debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information Credentials cache file '/tmp/krb5cc_0' not found debug2: we did not send a packet, disable method debug3: authmethod_lookup password debug3: remaining preferred: ,keyboard-interactive,password debug3: authmethod_is_enabled password debug1: Next authentication method: password #### </div><div>I have the impression that when it does not work, it does not even try to use the authentication publickey. </div><div>When it works : #### debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password </div><div>#### </div><div> </div><div>When it does not work : #### debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,password #### </div><div> </div><div>May you help me please ? </div><div>I don't really know what to do here. </div><div>Ah here are the authconfig files in both cases : </div><div>Before (when passwordless works): #### CACHECREDENTIALS=yes FORCELEGACY=no FORCESMARTCARD=no IPADOMAINJOINED=no IPAV2NONTP=no PASSWDALGORITHM=md5 USECRACKLIB=yes USEDB=no USEFPRINTD=no USEHESIOD=no USEIPAV2=no USEKERBEROS=no USELDAPAUTH=no USELDAP=no USELOCAUTHORIZE=yes USEMKHOMEDIR=no USENIS=no USEPAMACCESS=no USEPASSWDQC=no USESHADOW=yes USESMARTCARD=no USESSSDAUTH=no USESSSD=no USESYSNETAUTH=no USEWINBINDAUTH=no USEWINBIND=no #### </div><div> </div><div>After (when passwordless does not work) #### CACHECREDENTIALS=yes FORCELEGACY=no FORCESMARTCARD=no IPADOMAINJOINED=no IPAV2NONTP=no PASSWDALGORITHM=md5 USECRACKLIB=yes USEDB=no USEFPRINTD=no USEHESIOD=no USEIPAV2=no USEKERBEROS=no USELDAPAUTH=no USELDAP=no USELOCAUTHORIZE=yes USEMKHOMEDIR=yes USENIS=no USEPAMACCESS=no USEPASSWDQC=no USESHADOW=yes USESMARTCARD=no USESSSDAUTH=yes USESSSD=yes USESYSNETAUTH=no USEWINBINDAUTH=no USEWINBIND=no #### </div><div> </div><div>Best regards. </div><div>Bahan </div></div></div></div>