Reinstall SSH then cannot login root account

Question

I'm using Vultr VPS to create ubuntu server but after installing Install SSH Key I cannot login by ssh anymore. It shows : Permission denied, please try again.

The password key is total correct.

I'm using MacOS. I created id_rsa.pub and copied key to Vultr reinstall ssh. I have used id_rsa.pub key for bitbucket service also.

So which is the reason I cannot login with root by using ssh anymore?

Thank you so much.

I update ssh log

ssh -v root@149.28.145.90
OpenSSH_9.0p1, LibreSSL 3.3.6
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to 149.28.145.90 [149.28.145.90] port 22.
debug1: Connection established.
debug1: identity file /Users/macOS/.ssh/id_rsa type 0
debug1: identity file /Users/macOS/.ssh/id_rsa-cert type -1
debug1: identity file /Users/macOS/.ssh/id_ecdsa type -1
debug1: identity file /Users/macOS/.ssh/id_ecdsa-cert type -1
debug1: identity file /Users/macOS/.ssh/id_ecdsa_sk type -1
debug1: identity file /Users/macOS/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /Users/macOS/.ssh/id_ed25519 type -1
debug1: identity file /Users/macOS/.ssh/id_ed25519-cert type -1
debug1: identity file /Users/macOS/.ssh/id_ed25519_sk type -1
debug1: identity file /Users/macOS/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /Users/macOS/.ssh/id_xmss type -1
debug1: identity file /Users/macOS/.ssh/id_xmss-cert type -1
debug1: identity file /Users/macOS/.ssh/id_dsa type -1
debug1: identity file /Users/macOS/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.0
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.7
debug1: compat_banner: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.7 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 149.28.145.90:22 as 'root'
debug1: load_hostkeys: fopen /Users/macOS/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:/xz7YYBmz0xghGR0TZEwSmr6z9kwBk1T15YwBeRaSv4
debug1: load_hostkeys: fopen /Users/macOS/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '149.28.145.90' is known and matches the ED25519 host key.
debug1: Found key in /Users/macOS/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: ssh_fetch_identitylist: agent contains no identities
debug1: Will attempt key: /Users/macOS/.ssh/id_rsa RSA SHA256:+o1B9zpeliVSvqKYfstJb2WRGW55345340z6rXUSEvWnn0fX1+G0
debug1: Will attempt key: /Users/macOS/.ssh/id_ecdsa 
debug1: Will attempt key: /Users/macOS/.ssh/id_ecdsa_sk 
debug1: Will attempt key: /Users/macOS/.ssh/id_ed25519 
debug1: Will attempt key: /Users/macOS/.ssh/id_ed25519_sk 
debug1: Will attempt key: /Users/macOS/.ssh/id_xmss 
debug1: Will attempt key: /Users/macOS/.ssh/id_dsa 
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /Users/macOS/.ssh/id_rsa RSA SHA256:+o1B9zpeliVSvqKYtJb25445WRGW0z6344rXUSEvWnn0fX1+G0
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/macOS/.ssh/id_ecdsa
debug1: Trying private key: /Users/macOS/.ssh/id_ecdsa_sk
debug1: Trying private key: /Users/macOS/.ssh/id_ed25519
debug1: Trying private key: /Users/macOS/.ssh/id_ed25519_sk
debug1: Trying private key: /Users/macOS/.ssh/id_xmss
debug1: Trying private key: /Users/macOS/.ssh/id_dsa

Here is ssh config

PermitRootLogin yes
Include /etc/ssh/sshd_config.d/*.conf
PubkeyAuthentication yes
PasswordAuthentication yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp internal-sftp
AllowGroups admin

Please add the logging that is show when doing ssh -v root@yourSSHhost — Luuk, Jul 21 '23 at 15:09
@Luuk: debug1: Authentications that can continue: publickey,password. I used both ssh key password and root password but it has same result — Hai Tien, Jul 21 '23 at 15:34
@Luuk yes. I alread restart server. I'm contacting to Vultr staff for the helps. — Hai Tien, Jul 21 '23 at 15:48
Where did you copy the id_rsa.pub key to? It would need to be appended to the authorized_keys file of the target user (in this case, root) which is usually /root/.ssh/authorized_keys (but might be elsewhere, depending on the server's sshd_config) — steeldriver, Jul 21 '23 at 16:18
When more help is needed you config might be helpful, Please add the output of: grep -v '^#' /etc/ssh/sshd_config | grep . — Luuk, Jul 22 '23 at 07:53
@steeldriver yes. I checked and it was appended to the authorized_keys — Hai Tien, Jul 22 '23 at 08:39
Because of the Include line the contents of /etc/ssh/sshd_config.d/*.conf would also be needed, so can you change that to the output of: grep -rv '^#' ssh_config sshd_config.d/*.conf | grep -v ':$' — Luuk, Jul 22 '23 at 09:13
I compared your config with mine. The only thing I can think of is that root is not a member of the group admin. — Luuk, Jul 22 '23 at 12:11
@Luuk wow you are right. AllowGroups admin will prevent root login. thank you so much. Problem is solved. — Hai Tien, Jul 22 '23 at 16:01

score 1 · Accepted Answer · answered Jul 21 '23 at 16:10

1

After Offering you should see the following, unless the key is wrong/old/invalid:

...
debug1: Offering public key: C:\\Users\\Luuk/.ssh/id_rsa RSA SHA256:4vcibbzSvFvASY6Yc**obscured**704
debug1: Server accepts key: C:\\Users\\Luuk/.ssh/id_rsa RSA SHA256:4vcibbzSvFvASY6Yc**obscured**704
debug1: Authentication succeeded (publickey).
...

answered Jul 21 '23 at 16:10

Luuk

276
2
9

thank you. actually I'm still unable to find out the reason of this issue. – Hai Tien Jul 22 '23 at 06:07

Reinstall SSH then cannot login root account

1 Answers1