Strange behavior on SSH public key login

Question

I'm really stuck here. I've been trying to ssh into my ec2 server from local with a public key but it is not working. -> I get permission Denied (public key).

The set up is as follows: Local: generated public key pair and copied contents of id_rsa.pub. Remote: ssh-ed into my EC2 server with the PEM file and pasted id_rsa.pub contents into new line of authorized keys file in .ssh folder.

Should work right? I noticed a common mistake is permissions, but mine seem to be set correctly:

Remote Permissions:

drwx------ 2 ec2-user ec2-user  4096 Jul 23 04:00 .ssh

and in .ssh:

-rw-r--r-- 1 ec2-user ec2-user  404 Jul 24 03:19 id_rsa.pub
-rw------- 1 ec2-user ec2-user 1679 Jul 24 03:19 id_rsa
-rw------- 1 ec2-user ec2-user  529 Jul 26 20:53 authorized_keys

Local:

drwx------    10 robvanhaaren  staff    340 Jul 26 18:43 .ssh

and in .ssh:

-rw-r--r--  1 robvanhaaren  staff   404 Jul 26 21:28 id_rsa.pub
-rw-------  1 robvanhaaren  staff  1766 Jul 26 21:28 id_rsa
-rw-r--r--  1 robvanhaaren  staff  5987 Jul 26 21:29 known_hosts

But when I run:

Robs-MacBook-Air-2:.ssh robvanhaaren$ ssh ec2-54-85-62-99.compute-1.amazonaws.com -l ec2-user -v

it returns:

OpenSSH_5.9p1, OpenSSL 0.9.8y 5 Feb 2013
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to ec2-54-85-62-99.compute-1.amazonaws.com [54.85.62.99] port 22.
debug1: Connection established.
debug1: identity file /Users/robvanhaaren/.ssh/id_rsa type 1
debug1: identity file /Users/robvanhaaren/.ssh/id_rsa-cert type -1
debug1: identity file /Users/robvanhaaren/.ssh/id_dsa type -1
debug1: identity file /Users/robvanhaaren/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 7a:d3:6c:7f:64:5d:b1:7b:2e:bb:73:0c:ce:0c:17:77
debug1: Host 'ec2-54-85-62-99.compute-1.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /Users/robvanhaaren/.ssh/known_hosts:15
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/robvanhaaren/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /Users/robvanhaaren/.ssh/id_dsa
debug1: No more authentication methods to try.
Permission denied (publickey).

The strange thing is that I CAN log in with public key to the server from my other ec2 server. So the problem seems to be on my local machine, not the remote.

Please help!

Answer 1

SSH issues can be a hassle. I always start with the following. I have the commands saved in a cheat sheet so I never have to fear typo's.

chmod 700 ~/.ssh && chmod 600 ~/.ssh/* \
&& chmod 644 ~/.ssh/authorized_keys \
&& chown -r <username>:<username> /home/<username>/.ssh \
&& chown -r <username>:<username> /home/<username>/.ssh/*

If that doesn't work, I'd remove authorized_keys and re create it (mind the ownership & permissions), making sure to copy the contents from notepad, or another proper text editor. Wordpad and other fat editors can mess keys up. You can also remove the remote host's entry from the known_hosts file. I remember having to do that once for something.

Answer 2

Make sure you check /var/log/auth.log as stated in the comment. Almost always you will find your answer there.

I have these permissions set for my servers and locally:

Server

drwx------ remoteuser group ~/.ssh
-rw------- remoteuser group ~/.ssh/authorized_keys

Locally

drwx------ user group ~/.ssh
-rw------- user group ~/.ssh/id_rsa
-rw----r-- user group ~/.ssh/id_rsa.pub