Irtsgbr

I have a digital ocean droplet that currently allows me to login directly via the root user via SSH as the relevant keys have been added to the authorized_keys file.

ssh root@master // this works fine and i'm logged in as root

The problem comes when I try to login as a normal non-root user - I have the following output below when I run the following command:

Note I have added the relevant keys for 'bobby' to both the root authorized_keys file & the users authorized_keys file but am unable to login - any ideas?

Note - this is on a Centos server - it keeps returning the error
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

ssh bobby@master -vT

OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to master [123.456.789.111] port 22.
debug1: Connection established.
debug1: identity file /home/bobby/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to master:22 as 'bobby'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:TLaJd7HJk3UVeqzrBgrQq6FfT1P20ZYAO918vRgU9Xg
debug1: Host 'master' is known and matches the ECDSA host key.
debug1: Found key in /home/bobby/.ssh/known_hosts:17
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:1vSLjFQBt1RFnBAwsTqBRE6RWQM0lDyqBdIRblVhkk8 /home/bobby/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Trying private key: /home/bobby/.ssh/id_dsa
debug1: Trying private key: /home/bobby/.ssh/id_ecdsa
debug1: Trying private key: /home/bobby/.ssh/id_ed25519
debug1: No more authentication methods to try.
bobby@master: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

In general: you can only debug so much from the client side; check the logs on the remote server too.

Typically sshd wil log why it refused access in /var/log/secure. (Fairly typical are ownership and permission problems on the ~/.ssh/authorized_keys.)

Offering public key: RSA SHA256:1vSLjFQBt1RFnBAwsTqBRE6RWQM0lDyqBdIRblVhkk8 /home/bobby/.ssh/id_rsa

Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
d

That says it all. You have only enabled publickey authentication. Make sure you have valid authorized_keys for user since your rsa is rejected.

authorized_keys should be owned by user and chmod 700

As root on your Linux box, check to see the file "/etc/ssh/sshd_config" for a line of "AllowUsers".

Add there the users you want to be able to SSH and then run "service sshd restart".

Also, you may want to add that user to the SUDO'ers.