[solved ] ssh public key authentication for dropbear

[droopMember]

Hello,

I can’t get working ssh with public key authentication with usual ~/.ssh/authorized_keys or /etc/dropbear/authorized_keys file
it would be useful to automate some tasks
Can you briefly tell me if it is not possible with this dropbear integration , or how can I do that ?

Droop

[GodrigosMember]

WoW, exactly what I was going to ask about!!

Bump!

Rodrigo.

[tomlohaveModerator]

Hello, I’m not sure that’s supported by dropbear.
But we have regular openssh-server package.
You can try with it (maybe forcing it at install time with “-force-overwrite” cause it may share files with dropbear)

[GodrigosMember]

Well I tried that, but it seems that dropbear is still handling the ssh connections. Even after adding the proper keys to .ssh/authorized_keys and changing the configurations of etc/ssh/ssh_config (considering that openssh-server was “active”), I still have no key verification and I’m still asked for a password. Just letting you know, no big deal, can live with that.
Though, to be honest, I am not sure if it was all I should have done, I may have missed some steps to make it work.

Thanks very much for the attention.

Rodrigo.

[tomlohaveModerator]

I should have some time to test it this afternoon
I will let you know

[tomlohaveModerator]

Ok, I tested it, with success using both openssh-server and dropbear

for openssh-server, it needs a little of work, so leave it right now.

for dropbear :

 
ssh-copy-id root@ip-of-geexbox       # copy id to geexbox
ssh root@ip-of-geexbox               # log in
cp /root/.ssh/authorized_keys /etc/dropbear/authorized_keys    # copy file

then deconnect and try to reconnect
it should work without password

[tomlohaveModerator]

can you test this package : http://download.openbricks.org/test/dropbear_2015.70-1_armv7.opk

it should work out of the box, ie :
ssh-copy-id root@ip-of-geexbox is all what you need to do

[GodrigosMember]

Hi Tom.
I have tried the new version of the dropbear package updating my actual by using the command
opkg install http://download.openbricks.org/test/dropbear_2015.70-1_armv7.opk
The update seemed ok, no warnings or errors (rebooted after update).
Even then, nothing have changed, no key verification and password asked. After that, I tried to do the other previous steps described above (basically, copy the authorized_keys file).
Neither options worked for me. Sorry, it seems very straightforward and I am feeling a little dumb here. ?
My installed build is geexbox-devel-20151122-r5dd238c.cuboxi, I did a fresh install to remove openssh-server, to make sure it wouldn’t interfere.
Again, thanks very much for the effort.

Rodrigo.

[tomlohaveModerator]

hum
can you chmod 700 /root ?

chmod 700 /root

I see a problem about that (in debug logs) testing openssh-server part
Wonder if it’s not the same for dropbear.

[GodrigosMember]

I did so. No chances…

[tomlohaveModerator]

ok, I was able to reproduce the problem, silly problem with perms

please do :

chown root:root -R /root

Cheers !

[GodrigosMember]

Ok. Sorry but. Password still been asked. But now RSA key seems to be verified. But later comes “Next method that can continue: Password”, and then password is asked.
Should I restard from scratch. Reinstall Geexbox, and try again. I can do that this weekend.

Rodrigo.

[GodrigosMember]

Ok, call me crazy if you wish! Yesterday, even after rebooting, it wasn’t working. Today, after letting if off for the night, everything is ok. No password needed.

Thank you very much Tom.

Regards.

Rodrigo.

[GodrigosMember]

A last curiosity question, once my needs with this topic are fulfilled. How could I disable password authentication for dropbear? I searched for configuration files in every folder I could imagine, but no luck.

Thanks once more.

Rodrigo.

[tomlohaveModerator]

That’s with command line

dropbear --help
Invalid option --
Dropbear server v2015.70 https://matt.ucc.asn.au/dropbear/dropbear.html
Usage: dropbear [options]
-b bannerfile   Display the contents of bannerfile before user login
                (default: none)
-r keyfile  Specify hostkeys (repeatable)
                defaults: 
                dss /etc/dropbear/dropbear_dss_host_key
                rsa /etc/dropbear/dropbear_rsa_host_key
                ecdsa /etc/dropbear/dropbear_ecdsa_host_key
-R              Create hostkeys as required
-F              Don't fork into background
-E              Log to stderr rather than syslog
-m              Don't display the motd on login
-w              Disallow root logins
-s              Disable password logins
-g              Disable password logins for root
-B              Allow blank password logins
-j              Disable local port forwarding
-k              Disable remote port forwarding
-a              Allow connections to forwarded ports from any host
-p [address:]port
                Listen on specified tcp port (and optionally address),
                up to 10 can be specified
                (default port is 22 if none specified)
-P PidFile      Create pid file PidFile
                (default /var/run/dropbear.pid)
-i              Start for inetd
-W  (default 24576, larger may be faster, max 1MB)
-K   (0 is never, default 0, in seconds)
-I   (0 is never, default 0, in seconds)
-V    Version

edit /lib/systemd/system/[email protected] and add the ‘-g’ switch
then reload daemon with
systemctl daemon-reload

[Author]

Posts