yet again another SSH authentication issue topic

[Lost_Ones]

Hello All gurus of the SSH authentication.

I have been fine in the past with authentication. I am longer been able to authenticate when I ssh to the TN box or authenticate my RSYNC via my key. There were 2 changes that I have made. Change 1) upgraded from to 13.0-U5.1 from I believe was U2. 2) I stopped using SMB and CIFS and moved to just NFS as I want to retain my file structure. I suspect the later as I had made several changes to permissions. Access is from the LAN and not remote.

I had read several good suggestions of what to try, but I still have an issues (ha, don't we all :) ).

In the auth.logs I can see:
Authentication refused: bad ownership or modes for file /mnt/NAS_Drive_01/Backup/Familyroom/.ssh/
authorized_keys.

I can confirm that if I 'cat' that folder, the key does match what is in the GUI as well as the client machine's public key.

My dir's permissions settings:
drwxr-xr-x. Via CLI ls -l, he Gui seemed to not match.

I have stripped ACLs from the pool, set the Access mode to 755, and reset the user and the group and applied excursively. Under SSH settings I have removed password authentication and restarted the service ( and the VM as well )

I can view all dirs/files that are shared via NFS in the pool, I just cant authenticate via SSH or RSYNC.


Any additional check to try is much appreciated

Regards and thank you for your time

additional neat stuff:
jc@Living-room:~$ ssh -vv jc@192.168.50.155
OpenSSH_8.9p1 Ubuntu-3ubuntu0.1, OpenSSL 3.0.2 15 Mar 2022
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 192.168.50.155 is address
debug1: Connecting to 192.168.50.155 [192.168.50.155] port 22.
debug1: Connection established.
debug1: identity file /home/jc/.ssh/id_rsa type 0
debug1: identity file /home/jc/.ssh/id_rsa-cert type -1
debug1: identity file /home/jc/.ssh/id_ecdsa type -1
debug1: identity file /home/jc/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/jc/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/jc/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/jc/.ssh/id_ed25519 type -1
debug1: identity file /home/jc/.ssh/id_ed25519-cert type -1
debug1: identity file /home/jc/.ssh/id_ed25519_sk type -1
debug1: identity file /home/jc/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/jc/.ssh/id_xmss type -1
debug1: identity file /home/jc/.ssh/id_xmss-cert type -1
debug1: identity file /home/jc/.ssh/id_dsa type -1
debug1: identity file /home/jc/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.8-hpn14v15
debug1: compat_banner: match: OpenSSH_8.8-hpn14v15 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.50.155:22 as 'jc'
debug1: load_hostkeys: fopen /home/jc/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,sntrup761x25519-sha512@openssh.com,diffie-he
llman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01
@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519
,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.co
m,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.co
m,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-
hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,none
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,none
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.co
m,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.co
m,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:TkHsbCQ6cDeT35nNEQe+PB1BhoNQgAw24lR26LcqgKI
debug1: load_hostkeys: fopen /home/jc/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '192.168.50.155' is known and matches the ED25519 host key.
debug1: Found key in /home/jc/.ssh/known_hosts:3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: ssh_fetch_identitylist: agent contains no identities
debug1: Will attempt key: /home/jc/.ssh/id_rsa RSA SHA256:A989zQwpweT9a8Rk1gLfNn4mQsOGhKzWBAh8AliJYU0
debug1: Will attempt key: /home/jc/.ssh/id_ecdsa
debug1: Will attempt key: /home/jc/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/jc/.ssh/id_ed25519
debug1: Will attempt key: /home/jc/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/jc/.ssh/id_xmss
debug1: Will attempt key: /home/jc/.ssh/id_dsa
debug2: pubkey_prepare: done
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-
sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/jc/.ssh/id_rsa RSA SHA256:A989zQwpweT9a8Rk1gLfNn4mQsOGhKzWBAh8AliJYU0
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/jc/.ssh/id_ecdsa
debug1: Trying private key: /home/jc/.ssh/id_ecdsa_sk
debug1: Trying private key: /home/jc/.ssh/id_ed25519
debug1: Trying private key: /home/jc/.ssh/id_ed25519_sk
debug1: Trying private key: /home/jc/.ssh/id_xmss
debug1: Trying private key: /home/jc/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
jc@192.168.50.155: Permission denied (publickey).

 

[winnielinnie]

My dir's permissions settings:
drwxr-xr-x. Via CLI ls -l, he Gui seemed to not match.

In the auth.logs I can see:
Authentication refused: bad ownership or modes for file /mnt/NAS_Drive_01/Backup/Familyroom/.ssh/
authorized_keys.

The .ssh directory must have a particular ownership and permission.

Ownership: the user (naturally)
Permission: 700

According to your post, your .ssh directory has 755 permission.

This should correct it:

Code:

chmod 700 /mnt/NAS_Drive_01/Backup/Familyroom/.ssh

Likewise, you need to change the permission for the authorized_keys file to 600:

Code:

chmod 600 /mnt/NAS_Drive_01/Backup/Familyroom/.ssh/authorized_keys

* This only concerns specifically the .ssh directory and the authorized_keys file.

All other directories, you can set the permissions as you like (for the most part.)

 

[Lost_Ones]

The .ssh directory must have a particular ownership and permission.

Ownership: the user (naturally)
Permission: 700

According to your post, your .ssh directory has 755 permission.

This should correct it:

Code:

chmod 700 /mnt/NAS_Drive_01/Backup/Familyroom/.ssh

* This only concerns specifically the .ssh

All other directories, you can set the permissions as you like (for the most part.)

Good point. TO clearify, my home folder is set to 755, and my .ssh folder is now set to 700, sadly no change on authentiocation. I still get the same authentication denied public key message. I also can confirm that on the client, 700 is set on the .ssh dir, and 600 on the files.

 

[Lost_Ones]

Good point. TO clearify, my home folder is set to 755, and my .ssh folder is now set to 700, sadly no change on authentiocation. I still get the same authentication denied public key message. I also can confirm that on the client, 700 is set on the .ssh dir, and 600 on the files

Good point. TO clearify, my home folder is set to 755, and my .ssh folder is now set to 700, sadly no change on authentiocation. I still get the same authentication denied public key message. I also can confirm that on the client, 700 is set on the .ssh dir, and 600 on the files.

Wait, after the changes, I had restarted and I can authenticate. This is great. So for sure, I needed to have the 700 .ssh and the 600 on the keys on both the client and the server side. Much appreciated.

 

[winnielinnie]

Much appreciated.

The TrueNAS Forum TOS policy was updated on June 1, 2023. I advise you to read it as soon as possible:

Hey, everyone! President of TrueNAS here with another important update!

Starting June 1 of this year, any help received on the TrueNAS community forums must be reimbursed with reasonable pay. A minimum payment of $25 USD (€23 Euro) is to be transferred to the recipient.

We understand many new users and veterans alike may have criticisms of this new policy. We hear you and are looking into alternative solutions. In the meantime, this policy will be strictly enforced.

If you have any questions, suggestions, or grievances, please file a bug report at ixsystems.atlassian.net.

Thank you,
- President of TrueNAS

I don't make the rules.

Anyways, I accept Venmo, Cashapp, Paypal, or *physical gold coins.

* preferred option