Google Cloud Engine Permission denied (publickey, gssapi-keyex, gssapi-with-mic)

Question

I can not connect via ssh, I could connect for almost 24 hours. Suddenly ssh stops working. I had many users, and I also added a new user (tomcat) to this virtual machine.

I get the message below when I try to pass ssh to my instance:

 "Permission denied (publickey,gssapi-keyex,gssapi-with-mic)." 

I finished uninstalling ~ / .ssh / google_compute_engine *

Removed 'sshKeys' metadata from Cloud Engine console

Tried gcutil ssh again, this created a new ~/.ssh/google_compute_engine as well as sshKeys metadata .

But still, I get this error.

Answer 1

I had the same problem and debugged it for about 16 hours. However, that I found a solution, I would like you to have a stake in my odyssey.

I ran GitLab on the Google Compute Engine, declared as a one-click installation.

Well, finally, when I tried to clone a private repository, I received an error message:

 Permission denied (publickey,gssapi-keyex,gssapi-with-mic). 

I was looking for a private / public key pair and I did not find anything unusual.

---

Then I thought that there might be something wrong with sshd on the server since I received a debug message:

 debug1: ssh_rsa_verify: signature correct [...] debug1: Roaming not allowed by server 

So, I checked a lot of different sshd , but nothing fixed the problem.

---

Finally, I started server-side debugging and found an error:

 sshd[7364]: debug1: Could not open authorized keys '/var/opt/gitlab/.ssh/authorized_keys': Permission denied 

Finally, it was a road to happiness. Since the file existed and sshd knew which file it should load. However, somehow there was a problem with the resolution .

So, I checked if the files in the remote .ssh folder were in chmod . I did not find anything unusual.

---

And here is the solution:

SELinux had a problem with the location of the .ssh folder and was not ready to grant ssh daemon permission. Executing a command

restorecon -Rv /var/opt/gitlab/.ssh/

or

semanage fcontext -a -t ssh_home_t "/var/opt/gitlab/.ssh/authorized_keys"

One of the two teams solved the problem. I will be glad if anyone can check which of both of them!

Therefore, you do not need to deactivate SELinux !

Answer 2

This is really a comment on @sxleixer 's correct solution, but I need formatting.

• The semanage tool is not installed by default. Approach him with

   sudo yum -y install policycoreutils-python 

• Allow custom ssh_home_t

   sudo semanage fcontext -a -t ssh_home_t "/var/opt/gitlab/.ssh/authorized_keys" 

• Restart sshd or do a full restart with

   sudo shutdown -r now 

• Verify that everything works locally

   ssh-keygen -t rsa -C " [e-mail] " cat ~/.ssh/id_rsa.pub # Copy-paste the key to the 'My SSH Keys' section under the 'SSH' tab in your user profile ssh -T git@localhost # Should now output "Welcome to GitLab" 

This fixes a one-click installation of GitLab in the Google Compute Engine.

There is really no good reason to disable SELinux.

Answer 3

In this situation, it is likely that the .ssh/authorized_keys file for your primary user is not configured correctly. The file may have incorrect data, but I suspect that you really need to fix the permissions. Try the following:

 gcutil ssh --ssh_user=anotheruser <yourinstance> sudo su - <youruser> chmod 700 .ssh chmod 600 .ssh/authorized_keys 

And then try logging in as a user again.

Answer 4

Disable selinux.

 setenforce 0 

Also set SELINUX to the permission file in / etc / selinux / config.

Then go to this answer: fooobar.com/questions/802565 / ...

Answer 5

Decision:

1. change the permission of the private key to 0600 for instance 1
2. ssh -i /home/user/.ssh/id_rsa user2@instance-2

Answer 6

I tried all of the above and still get this error message.

This is with the new CentOS 8 VM. I have no problems with CentOS 7 VM, it just works and continues to work, but it seems that the problem is in CentOS 8.

I have provided complete information & logs here (this may be a different problem than here, but this is the same error message):

https://stackoverflow.com/questions/58430955/ssh-stops-working-on-centos-8-gce-vm-permission-denied-publickey-gssapi-keyex

Something is really wrong with GCE, it looks like this has been on / off for the last 5+ years, this page has more than 13,000 views.