How to ssh to localhost without password?

Question

EDIT: Putting exactly what was done

I need to SSH localhost without password, the usual way of doing it (with public keys) do not work.

user@PC:~$ rm -rf .ssh/*
user@PC:~$ ssh-keygen -t rsa > /dev/null 
Enter file in which to save the key (/home/user/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
user@PC:~$ ls .ssh/
id_rsa  id_rsa.pub
user@PC:~$ ssh-copy-id -i localhost 
The authenticity of host 'localhost (::1)' can't be established.
RSA key fingerprint is f7:87:b5:4e:31:a1:72:11:8e:5f:d2:61:bd:b3:40:1a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (RSA) to the list of known hosts.
user@localhost's password: 
Now try logging into the machine, with "ssh 'localhost'", and check in:

  .ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

user@PC:~$ ssh-agent $SHELL
user@PC:~$ ssh-add -L
The agent has no identities.
user@PC:~$ ssh-add 
Identity added: /home/user/.ssh/id_rsa (/home/user/.ssh/id_rsa)
user@PC:~$ ssh-add -L
ssh-rsa ...MY KEY HERE

user@PC:~$ ssh-copy-id -i localhost 
user@localhost's password: 
Now try logging into the machine, with "ssh 'localhost'", and check in:

  .ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

user@PC:~$ ssh localhost echo 'testing'
user@localhost's password: 

user@PC:~$

So as you can see in the last command it is still asking the password! How can I fix that? Ubuntu-10.04, OpenSSH_5.3p1

EDIT2:

Adding some info about the sshd

user@PC:~$ cat /etc/ssh/sshd_config | grep Authentication
# Authentication:
RSAAuthentication yes
PubkeyAuthentication yes
RhostsRSAAuthentication no
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
ChallengeResponseAuthentication no
# PasswordAuthentication yes

EDIT3: Ading result from $ssh -vv localhost

$ssh -vv localhost
...
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/identity
debug1: Offering public key: /home/user/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/user/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
user@localhost's password:

Cross posted on Super User: https://superuser.com/questions/336226/how-to-ssh-to-localhost-without-password — Flux, Aug 16 '19 at 01:38

score 195 · Accepted Answer · edited Sep 15 '17 at 10:03

195

I did following 3 steps to create the password less login

1. ssh-keygen -t rsa
Press enter for each line 
2. cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
3. chmod og-wx ~/.ssh/authorized_keys

edited Sep 15 '17 at 10:03

KayV

12,987
11
98
148

answered May 20 '13 at 14:28

user2402070

1,966
1
12
3

2

I could passwordless ssh without using step 3? When would I need to do step 3? – notapatch Mar 06 '14 at 12:07
2

@Rich: that's just to protect against what [@shipr mentions in his answer below](http://stackoverflow.com/a/10744443/98528). If your `~/.ssh/authorized_keys` was already existing and had correct permissions, (3.) is not needed, but also does no harm. – akavel Apr 16 '15 at 17:21
2

in addition to appending `id_rsa.pub` to `authorized_keys` (which didn't exist before this on my *Mac*) I've also appended it to `known_hosts`. Still I'm being asked for *password* – y2k-shubham Jan 23 '18 at 08:47
OK I got it. For those who are perplexed (like me) because they already have a previously generated *rsa key pair*, just append the contents of the existing `id_rsa.pub` file to `~/.ssh/authorized_keys` (don't generate a new one). If the `authorized_keys` file doesn't exist, don't sweat, it will be automatically created (you probably knew that already) but more importantly appending it to `~/.ssh/known_hosts` file on `Mac` won't help. If you're using `ZSH` on `iTerm`, you would probably require restarting the *terminal*. – y2k-shubham Jan 23 '18 at 09:03
Works like a charm for macbook with macOS Mojave... +1 – Romeo Sierra May 26 '20 at 07:11
Does not work for me. Password is still required when logging in `ssh localhost` – nick Dec 22 '20 at 14:14
using ubuntu 22.04 faced this issue. after 3rd cmd ssh working fine – Rajadurai M Sep 29 '22 at 13:35
all I had to do was ssh-copy-id localhost and it worked – Max Nov 27 '22 at 06:33

score 21 · Answer 2 · answered May 24 '12 at 20:00

21

Another possible answer: the authorized_keys file may exist and be readable. But if it is group- or world-writable, it will still prompt for the password. The answer to THAT problem is

chmod og-wx ~/.ssh/authorized_keys

answered May 24 '12 at 20:00

shipr

2,809
1
24
32

score 21 · Answer 3 · answered Sep 16 '11 at 11:17

21

Have discovered the problem.

Running the server with debuging:

$sshd -Dd

I found it was not able to read the auth_key

$chmod 750 $HOME

Fixed it.

answered Sep 16 '11 at 11:17

canesin

1,967
2
18
30

3

Why don't you guys use symbolic chmod mode? It is not 90's any more, is it? – Maxim Egorushkin Oct 27 '11 at 13:25
9

Because symbolic mode is confusing. I have no idea what 750 would be off the top of my head. something like 'u=rwx,g=rx,o=' Whatever it is, it's not easier than 750! Btw, 755 perms work just fine as well. – Ian Kelling Feb 04 '15 at 00:47
1

Very useful. I used `/usr/sbin/sshd -ddddD` and got the following message `Authentication refused: bad ownership or modes for directory /home/...` – Leonardo Jan 21 '16 at 20:27
found it was this as well. Thankyou :) Home directory fixed it. Had similar debug messages about bad ownership. I would see the debug log after I ran `ssh -v localhost`. error was `bad ownership or modes for directory $HOME`. I had done the steps above from other uses before. – Joyoyoyoyoyo Jan 14 '19 at 19:53

score 11 · Answer 4 · answered Feb 08 '17 at 05:22

11

Two simple steps:

ssh-keygen -t rsa <Press enter for each line>
ssh-copy-id localhost

Enter password and you're done.

answered Feb 08 '17 at 05:22

Rohit Patwa

1,092
1
9
12

score 6 · Answer 5 · answered May 11 '15 at 13:47

Do the following steps

ssh-keygen -t rsa -C "your_email@example.com"
# Creates a new ssh key, using the provided email as a label
# Generating public/private rsa key pair.

Use the default file and empty passphrase (Simply press enter in the next 2 steps)

# start the ssh-agent in the background
eval "$(ssh-agent -s)"
# Agent pid 59566
ssh-add

Copy the contents of ~/.ssh/id_rsa.pub to ~/.ssh/authorized_keys

Ensure following are the permissions

 ls -l .ssh/
 total 20
-rw-r--r--. 1 swati swati  399 May  5 14:53 authorized_keys
-rw-r--r--. 1 swati swati  761 Jan 12 15:59 config
-rw-------. 1 swati swati 1671 Jan 12 15:44 id_rsa
-rw-r--r--. 1 swati swati  399 Jan 12 15:44 id_rsa.pub
-rw-r--r--. 1 swati swati  410 Jan 12 15:46 known_hosts

Also, ensure the permissions for .ssh directory are. This is also important

drwx------.   2 swati swati    4096 May  5 14:56 .ssh

score 2 · Answer 6 · answered Sep 19 '18 at 07:09

On Centos 7

SOLUTION

1 create rsa key
2 vim /etc/ssh/ssh_config
3
#   IdentityFile ~/.ssh/identity
uncoment this line > IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa

Note *I did this after copying the key and some of the other answers before this one. But I am pretty sure this is all you have to do but if not I would append the rsa key to authorized_keys and also run the

ssh-copy-id to username@localhost

score 1 · Answer 7 · answered Mar 01 '17 at 13:01

The correct and safe way of doing it is to copy the keys as has been said here.

In other cases, sshpass can be handy.

sshpass -p raspberry ssh pi@192.168.0.145

Keep in mind that this is not safe at all. Even though it is not a good idea to use it in secure environments, it can be useful for scripting, automated testing...

this can be combined with

ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no pi@192.168.0.145

to avoid confirmation questions that prevent scripting from happening.

Again, only use this in development systems where different machines share an IP and security is not important.

https://ownyourbits.com/2017/02/22/easy-passwordless-ssh-with-sshh/

score 1 · Answer 8 · answered Sep 07 '17 at 05:29

1

as the accepted answer do, if you encount a problem of

    Agent admitted failure to sign using the key.

you need to

    ssh-add

answered Sep 07 '17 at 05:29

J.stack

25
4

score 1 · Answer 9 · answered Nov 19 '17 at 08:48

I faced the same issue even after following all the recommendations, but found out that the issue was with gnome-keyring interference.

Solution:

Go Search , look for “Startup Applications”
If you see “SSH Key Agent”, uncheck the box
Reboot the machine and connect to localhost.

score 1 · Answer 10 · answered Sep 07 '18 at 08:06

I solved ssh login problem this way.

I generate the key pairs on my server side and then scp back the private key to my windows 10 computer and now I can login without password.

Previously I used key pairs generated by my window 10 laptop and there was no luck at all.

score 1 · Answer 11 · answered Jan 02 '20 at 04:42

I encountered the same problem when running unit tests on Docker container(golang:1.13-alpine).

After sshd -Dd and ssh -vv root@localhost debugging, I found the reason:

User root not allowed because account is locked

So, we should unlock the account by passwd -u or set a password.

score 1 · Answer 12 · answered Sep 28 '21 at 16:50

One thing to doublecheck if you have a known good configuration for ssh is that your /etc/hosts.allow includes a reference to localhost, since the source IP for a localhost connection would be coming from 127.0.0.1 rather than your network IP. I was stumped on this for some time, but after adding the following to /etc/hosts.allow my configuration immediately worked.

ALL: 127.0.0.1/32

I figured I would add this since none of the other answers mentioned it and this was the top hit from my search for the same error.

score 0 · Answer 13 · answered Jun 28 '20 at 20:48

0

I fixed my problem setting the AllowUsers on sshd_config file.

Running the server with debuging:

$sshd -Dd

I found it was not allowed the my user

$sudo vi /etc/ssh/sshd_config

Add a row with after #Authentication:

AllowUsers myUser

answered Jun 28 '20 at 20:48

Rafael Leonhardt

404
5
15

score 0 · Answer 14 · answered Dec 17 '21 at 16:29

RHEL8

In my case after successful keys configuration it still did not work. I found following error in /var/log/secure:

pam_access(sshd:account): access denied for user `username' from `::1'

So I had to edit:

/etc/security/access.conf

And add there '::1' to allowed hosts by adding a line:

+:<username>:LOCAL ::1

It immediately started to work, even without restart of sshd service.

How to ssh to localhost without password?

14 Answers14

Linked