fedora-infrastructure

#11898 SSH into homedir on fedorapeople.org: Login does not work
Closed: Fixed by andreashaerter. Opened by andreashaerter.

Closed: Fixed
Reopen Issue

I followed the instructions:

  1. My account (created in 2011) is still existing and up2date: https://accounts.fedoraproject.org/user/andreashaerter/
  2. I was granted access to at least one group: magazine-editors
  3. On https://accounts.fedoraproject.org/user/andreashaerter/settings/keys/ I checked my key:
    • It was still registered and valid. I tried to SSH login with my old SSH key (RSA 4096 bit from 2011) and it did not work.
    • I therefore added a new one (ED25519), waited for hours and it did not work.
    • I added both (as last resort), waited a few hours and it did not work (no matter which Identity file I provided)

So I am running out of ideas.

As the output shows, my SSH client is sending the correct pubkey and the client and server successfully negotiated algorithms: 

debug1: Authenticating to fedorapeople.org:22 as 'andreashaerter'
debug1: kex: algorithm: curve25519-sha256@libssh.org
[...]
debug1: kex: host key algorithm: ssh-ed25519-cert-v01@openssh.com
debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256@libssh.org need=32 dh_need=32
debug1: kex: curve25519-sha256@libssh.org need=32 dh_need=32
[...]
debug1: Server host certificate: ssh-ed25519-cert-v01@openssh.com SHA256:DTUrA3w9TcKunUSLEPoFK4uAqrdHKdIv7QoiPQjF1b4, serial 1686791904 ID "people02.fedoraproject.org" CA ssh-rsa SHA256:IPuhCSNXqj4m2eq6UKYE1jHFglLgLCbBzINft+OxUMA valid from 2023-06-15T02:18:24 to 2024-06-13T03:18:24
debug2: Server host certificate hostname: fedorapeople.org
debug2: Server host certificate hostname: people02.fedoraproject.org
debug3: record_hostkey: found key type ED25519 in file /home/user/.ssh/known_hosts:43
[...]
debug1: Host 'fedorapeople.org' is known and matches the ED25519 host key.
debug1: Found key in /home/user/.ssh/known_hosts:43
[...]
debug1: Will attempt key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug2: pubkey_prepare: done
[...]
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: sign_and_send_pubkey: using publickey with ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: send packet: type 50
Connection closed by 152.19.134.199 port 22

Could somebody maybe look at server-side why my login gets denied?

Reasoning: Even though a new planet is in the works, I want to share content on the current planet. To do I have to create a file in my homedir at fedorapeople.org.

I asked on Discourse and was pointed here to open an issue.

Cheers,
Andreas

Everything looks right on your account.

I adjusted one thing on the server end, can you try again now?

Hi @kevin, thanks for looking at the issue.

I tried again but still the same effect via IPv6 as well as Ipv4

[...]
debug1: Offering public key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: sign_and_send_pubkey: using publickey with ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: send packet: type 50
Connection closed by 2600:2701:4000:5211:dead:beef:a7:9474 port 22

debug1: Offering public key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: sign_and_send_pubkey: using publickey with ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: send packet: type 50
Connection closed by 152.19.134.199 port 22

Also with the old but still registered RSA key:

debug1: Server accepts key: /home/user/.ssh/fedorapeople_andreashaerter RSA SHA256:4d8gYNIOyJVQXlSLjvEfen/RnTN6o1VRplNXqUIq0sQ explicit agent
debug3: sign_and_send_pubkey: using publickey with RSA SHA256:4d8gYNIOyJVQXlSLjvEfen/RnTN6o1VRplNXqUIq0sQ
debug3: sign_and_send_pubkey: signing using rsa-sha2-256 SHA256:4d8gYNIOyJVQXlSLjvEfen/RnTN6o1VRplNXqUIq0sQ
debug3: send packet: type 50
Connection closed by 152.19.134.199 port 22

Even though I have no problem with all kind of other SSH connections, but to exclude any side effect with my defaults:

Sane without my global SSH config by giving an non-existing -F config file:

user@fedora:~$ ssh -F none -i ~/.ssh/fedoraproject_andreashaerter andreashaerter@fedorapeople.org -vvv
OpenSSH_9.3p1, OpenSSL 3.1.1 30 May 2023
[...]
debug1: Next authentication method: publickey
debug1: Offering public key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: sign_and_send_pubkey: using publickey with ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: send packet: type 50
Connection closed by 152.19.134.199 port 22

More info:

$ uname -a
Linux fedora 6.8.7-200.fc39.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Apr 17 19:35:11 UTC 2024 x86_64 GNU/Linux
$ ssh -V
OpenSSH_9.3p1, OpenSSL 3.1.1 30 May 2023
$ cat /etc/redhat-release 
Fedora release 39 (Thirty Nine)

One additional thing: 2FA with OTP is enabled for my FAS account. I guess this should not affect SSH access, but as I have no idea what might be wrong.... :D

no, otp shouldn't affect ssh.

Can you try again now? I saw something with your account that might have been causing this and fixed it...

Sadly not:

[...]
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug3: sign_and_send_pubkey: using publickey with ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g
debug3: send packet: type 50
Connection closed by 152.19.134.199 port 22

Just an update: If I send a wrong user (foo) or public key, I got the expected output:

debug1: No more authentication methods to try.
foo@fedorapeople.org: Permission denied (publickey).

So the server seems to really accept my authentication but it dies later in the process:

debug1: Next authentication method: publickey
debug1: Offering public key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
debug1: Server accepts key: /home/user/.ssh/fedoraproject_andreashaerter ED25519 SHA256:PWpG87Z7XFgZjPDbd7ytZsGkv77tIpGFnQxke8UGt7g explicit agent
Connection closed by 152.19.134.199 port 22

If it helps: It is no problem to completely nuke my homedir and/or all user related config on fedorapeople.org.
Edited by andreashaerter

ok. I think I figured it out.

Can you try again now?

Hi @kevin,

thank you so much, it works now:

$ ssh fedorapeople.org_andreashaerter 
================================== ATTENTION ==================================
        This is a PRIVATE computer system, unauthorized access is
        strictly prohibited.
[...]
[andreashaerter@people02 ~][PROD]$ ll
total 0
drwxrwxr-x. 2 andreashaerter andreashaerter 46 Jun 23  2011 public_html
[andreashaerter@people02 ~][PROD]$ pwd
/home/fedora/andreashaerter
[andreashaerter@people02 ~][PROD]$ date
Sun Apr 28 17:44:16 UTC 2024
[andreashaerter@people02 ~][PROD]$ touch foo
[andreashaerter@people02 ~][PROD]$ ll
total 0
-rw-rw-r--. 1 andreashaerter andreashaerter  0 Apr 28 17:44 foo
drwxrwxr-x. 2 andreashaerter andreashaerter 46 Jun 23  2011 public_html
[andreashaerter@people02 ~][PROD]$ rm foo
[andreashaerter@people02 ~][PROD]$ ll
total 0
drwxrwxr-x. 2 andreashaerter andreashaerter 46 Jun 23  2011 public_html

Metadata Update from @andreashaerter:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Great!

So the problem seemed to be that the magazine-editors group wasn't including you in the fedora-contributors group.

So, I added you to another group (wikiedit).

I'll investigate what could be going on with that group....
Metadata
None
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.