<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">Close...very close.<br><br>It was the SELinux attributes on the
authorized keys. <br><br><br>My kickstart post install drops the
/root/.ssh/authorized_keys files onto the boxes so we can run some
management tools against the box later from the kickstart server.<br><br><br>And
after the <span class="yshortcuts" id="lw_1288633881_0">file copy</span>
during the kickstart, the SELinux attributes on the file were wrong.<br><br><br>SELinux
is still new to me. After getting all the stern talking to's by the
redhat people and hard sell at Summit in Boston this year, my goal for
our RHEL6 build is to FINALLY turn on SELinux in our default install for
my company.<br><br><br>Here is the solution in case someone else runs
into this issue and does the 'I know this, its the permissions', but
then that does not fix it. Here is what I
did.<br><br><br>Before:<br>--------------------------------------------------<br>#
ls -Z *<br>-rw-------. root root system_u:object_r:admin_home_t:s0
authorized_keys<br>-rw-------. root root
unconfined_u:object_r:admin_home_t:s0 authorized_keys2<br><br><br>Fix:<br>--------------------------------------------------<br>#
restorecon -R -v /root/.ssh or ~/.ssh<br>restorecon reset /root/.ssh
context
system_u:object_r:admin_home_t:s0->system_u:object_r:home_ssh_t:s0<br>restorecon
reset /root/.ssh/authorized_keys2 context
unconfined_u:object_r:admin_home_t:s0->system_u:object_r:home_ssh_t:s0<br>restorecon
reset /root/.ssh/authorized_keys context
system_u:object_r:admin_home_t:s0->system_u:object_r:home_ssh_t:s0<br>restorecon
reset /root/.ssh context
system_u:object_r:ssh_home_t:s0->system_u:object_r:home_ssh_t:s0<br>restorecon
reset /root/.ssh/authorized_keys2 context
system_u:object_r:ssh_home_t:s0->system_u:object_r:home_ssh_t:s0<br>restorecon
reset /root/.ssh/authorized_keys context
system_u:object_r:ssh_home_t:s0->system_u:object_r:home_ssh_t:s0<br><br>After:<br>-------------------------------------------------<br>[root@uskysvldv0341
~/.ssh] # ls -Z *<br>-rw-------. root root
system_u:object_r:ssh_home_t:s0 authorized_keys<br>-rw-------. root
root system_u:object_r:ssh_home_t:s0 authorized_keys2<br><br><br><br>And
now it works. <br><br>You know, I would really suggest we make an
addition to the man page for sshd or something to note that the selinux
labels on the authorized_keys files generate the same errors out of sshd
as does the old problem of them having the wrong permissions.<br><br><br>Thanks!<br><br><br><br>--- On <b>Mon, 11/1/10, Edward Rudd <i><erudd@netfor.com></i></b> wrote:<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>From: Edward Rudd <erudd@netfor.com><br>Subject: Re: [rhelv6-beta-list] SSH via key from RHEL5 to RHEL6?<br>To: "Don Hoover" <dxh@yahoo.com><br>Cc: rhelv6-beta-list@redhat.com<br>Date: Monday, November 1, 2010, 1:21 PM<br><br><div id="yiv1048840077"><div>This is usually the most common problem. </div><div><br><div><div>On Nov 1, 2010, at 13:02 , Don Hoover wrote:</div><br class="yiv1048840077Apple-interchange-newline"><blockquote type="cite"><div>Ok..for some reason I have not having any luck using a ssh key to ssh as root from a RHEL5 box to a RHEL6 system.<br><br>Is there any gotchas?<font class="yiv1048840077Apple-style-span" color="#000000"><font
class="yiv1048840077Apple-style-span" color="#144fae"><br></font></font></div></blockquote><div><br></div>Did you check the file permissions on the .ssh and .ssh/authorized_keys?<div><br></div><div>Make sure they are not readable by "other" or "group"</div><div><br></div><div><div>ls -ld .ssh/</div><div>drwx------. 2 root root 4096 Oct 19 07:55 .ssh/</div></div><div><div>ls -ld .ssh/authorized_keys </div><div>-rw-------. 1 root root 1776 Oct 19 07:55 .ssh/authorized_keys</div></div><div><br></div><blockquote type="cite"><div>I even generated a new ssh key on the RHEL6 box, copied the id_rsa file to the RHEL5 box, and added the public to the RHEL6 authorized_keys file and still the RHEL6 box will not allow the key.<br></div></blockquote><div><br></div><div>You should probable NOT put the private key on the server you are sshing INTO. the private key should really be only on the client.</div></div><div><div><br></div><br
class="yiv1048840077Apple-interchange-newline">
</div>
<br></div></div></blockquote></td></tr></table>