This is quick post summarizing issues encountered while setting up ssh equivalence on EC2 instance. I was setting up RHEL7 EC2 instances and followed below procedure to setup ssh equivalence
- Generate rsa key-pair using ssh-keygen -t rsa on both hosts
- Copy the public keys to the remote server in authorized_keys file
- Modify file permission to 600
But when I tried to perform ssh to remote host , it failed with following error.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
I verified directory (.ssh) and file permissions were correct. Then, I checked for SELinux context using ls – Z option.
-bash-4.2$ ls -lZ * -rw-r--r--. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 authorized_keys -rw-------. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 id_rsa -rw-r--r--. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 id_rsa.pub -rw-r--r--. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 known_hosts
As per above output, these files are running with postgresql_db_t type context. I used getenforce to verify that SELinux was in enforcing mode on this host. It can also be verified by viewing contents of /etc/selinux/config .
# cat /etc/selinux/config # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=enforcing # SELINUXTYPE= can take one of three two values: # targeted - Targeted processes are protected, # minimum - Modification of targeted policy. Only selected processes are protected. # mls - Multi Level Security protection. SELINUXTYPE=targeted
I decided to use restorecon command to restores SELinux security context for files and directories to their default values .
-bash-4.2$ restorecon -Rv /var/lib/pgsql/.ssh/ restorecon reset /var/lib/pgsql/.ssh context unconfined_u:object_r:postgresql_db_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /var/lib/pgsql/.ssh/id_rsa context unconfined_u:object_r:postgresql_db_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /var/lib/pgsql/.ssh/id_rsa.pub context unconfined_u:object_r:postgresql_db_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /var/lib/pgsql/.ssh/authorized_keys context unconfined_u:object_r:postgresql_db_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /var/lib/pgsql/.ssh/known_hosts context unconfined_u:object_r:postgresql_db_t:s0->unconfined_u:object_r:ssh_home_t:s0 -bash-4.2$ ls -lZ * -rw-r--r--. postgres postgres unconfined_u:object_r:ssh_home_t:s0 authorized_keys -rw-------. postgres postgres unconfined_u:object_r:ssh_home_t:s0 id_rsa -rw-r--r--. postgres postgres unconfined_u:object_r:ssh_home_t:s0 id_rsa.pub -rw-r--r--. postgres postgres unconfined_u:object_r:ssh_home_t:s0 known_hosts
As you can see, restorecon restored permission by changing type from postgresql_db_t to ssh_home_t. I performed ssh again and it worked !
Recent Comments