Questions[public-key-encryption](server)

After generating the private and public key for a RHEL Client and storing the public key in the authorized_keys folder of the RHEL 7 Server, I disabled the Root Login in the Server by going to /etc/ssh/sshd_config and setting PermitRootLogin to no. After that I restarted the sshd service.

Now when I am trying to do ssh from client to server it says

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)

Why I am getting this message?

When manually building a certificate you often do something like this, appending an intermediate certificate to your own (and sometimes the root CA):

# Concatenate intermediate certificate and root certificate
cat ${CERTNAME}.single.pem DigiCertSHA2ExtendedValidationServerCA.pem DigiCertHighAssuranceEVRootCA.pem > ${CERTNAME}.pem

I recently appended an intermediate certificate to a certificate that was issued by another CA, and of course, Chrome warned me that it could not validate the certificate. I wonder how I can know this ahead of time, using for instance openssl or keytool to ensure that I only concatenate certificates to the chain that make sense.

When making a "human readable dump" of an intermediate Buypass certificate I get this:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:78:1c:6d:5e:34:ce:1f:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NO, O = Buypass AS-983163327, CN = Buypass Class 2 Root CA
        Validity
            Not Before: Mar 25 12:17:10 2019 GMT
            Not After : Oct 26 09:16:17 2030 GMT
        Subject: C = NO, O = Buypass AS-983163327, CN = Buypass Class 2 CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9c:ab:67:c6:96:4b:0d:0f:91:d2:ec:ca:cc:33:
                    2b:f3:72:fc:0e:7f:b9:4e:84:a9:0f:7d:73:aa:26:
...

(using openssl x509 -in my-cert.pem -noout -text)

The Subject field in this intermediate certificate is the same as the Issuer field in my own certificate, so I guess I could extract this and grep it, but although that will probably be sufficient in 99% of the cases, it does not strike me as correct :) Is there some kind of signature I can use to verify "ancestry" between the two?

I'm trying to automate logins to GitHub using a private key, so that I can do "git pull/add/commit/push" from a BASH script. If I put this in ~/.ssh/config, it works:

Hostname github.com
User git
IdentityFile ~/.ssh/mygitkey.pem

Unfortunately, this causes all SSH connections to be routed to Github.com, which I don't want.

So I tried this:

Host GitHub
   Hostname github.com
   User git
   IdentityFile ~/.ssh/mygitkey.pem

But this causes the "user" and "identityFile" options to be ignored when connecting to GitHub.

I'm the 1/2 time IT person for a small company. We run a MS environment using a Server 2003 Domain Controller, MS Storage Server 2003, and Exchange 2003.

It finally occurred to them that I as an admin can pretty much see everything including sensitive personnel data.

I need a simple (average employee here is 55+) way to be able to store, share and email files between top level execs that is not viewable by someone with Domain Admin credentials. Ideally the solution would:

1. Allow me to save files to an encrypted folder
2. Allow me to send an encrypted file to another staff member and allow them to open it.
3. Allow some form of key backup so when the forget their key or get hit by a bus the key is recoverable.

Any suggestions on how to do this in a manner that is simple for the end user to work with?

I am trying to sftp into an a server hosted by someone else.

To make sure this worked I did the standard sftp [email protected] i was promted with the password and that worked fine.

I am setting up a cron script to send a file once a week so have given them our public key which they claim to have added to their authorized_keys file.

I now try sftp [email protected] again and I am still prompted for a password, but now the password doesn't work...

Connecting to [email protected]...
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
Permission denied (publickey,password).
Couldn't read packet: Connection reset by peer

I did notice however that if I simply pressed enter (no password) it logged me in fine...

So here are my questions:

1. Is there a way to check what privatekey/pulbickey pair my sftp connection is using?
2. Is it possible to specify what key pair to use?
3. If all is setup correctly (using correct key pair and added to authorized files) why am I being asked to enter a blank password?

Thanks for your help in advance!

UPDATE I have just run sftp -vvv [email protected]

....
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /root/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug2: input_userauth_pk_ok: SHA1 fp 45:1b:e7:b6:33:41:1c:bb:0f:e3:c1:0f:1b:b0:d5:e4:28:a3:3f:0e
debug3: sign_and_send_pubkey
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

It seems to suggest that it tries to use the public key... What am I missing?