Permission denied (publickey)

[skhrg]

Hi, when I attempt to ssh to unlock my system, I get Permission denied (publickey)

But once the system in booted I am able to ssh in with the same key. I was concerned that maybe my authorized_keys file wasn't getting loaded properly but

# lsinitrd | grep authorized_keys                                        
-rw-------   1 root     root          554 Mar 16 11:15 root/.ssh/authorized_keys

would lead me to believe that that's not the problem.

[gsauthof]

Try to debug this issue by looking at the ssh log messages from early boot (e.g. with journalctl -b) and/or unpack the generated initramfs archive and inspect the included authorized_keys to check whether it matches your expectations/what you have under /root/.ssh. Also check the permissions of the /root and /root/.ssh directories in the initramfs archive.

[skhrg]

The correct key is in my initramfs archive.
The permissions in the archive for /root are:

drwxr-xr-x.  3 root    root        4096 May 28 09:07 root

And for /root/.ssh:

drwx------.  2 root    root    4096 May 28 09:07 .ssh

Which seem fine.

[gsauthof]

Is the sshd logging any errors during early-boot?

[skhrg]

Not beyond the warning about UsePAM no

[gsauthof]

You can also compare the ssh -v output when you get the Permission denied (publickey) error vs. when the login works. Perhaps you see some difference in what keys are offered or something like that.

[saibotk]

Actually I am currently experiencing the exact same problem.
I am testing this on a fresh Fedora 32 Server installation, if this might help.

[saibotk]

Okay so at least on fedora 32, when you did not create a root user password (just your own user and made him member of the wheel group), you cannot login via ssh, as the user account is locked. See https://unix.stackexchange.com/questions/193066/how-to-unlock-account-for-public-key-ssh-authorization-but-not-for-password-aut

Edit: Maybe adding a notice to the README would be helpful?

[gsauthof]

@saibotk this sounds similar to issue #19 - can you confirm?

I'll add something to the README.

[saibotk]

Thank you 👍