Page 1 of 1

SSH into a Synology NAS using a key

Posted: Friday 23 June 2017 15:13
by moumout31
Hello,

After several researches on Google, I try to connect through ssh from my Raspberry (with Domoticz) to my Synology NAS with a key to log without entering a password.
What I've done unitl now allow me to connect from Putty to my NAS without password (with key created thanks to Puttygen) -> Thus, I conclude that on NAS side, everything is correctly configured.

However when I try to connect to my NAS from my Raspberry through ssh, it still ask me the password, as you can see below :

Code: Select all

pi@raspberrypi:~ $ ssh -p 52 [email protected] -vvv
OpenSSH_6.7p1 Raspbian-5+deb8u3, OpenSSL 1.0.1t  3 May 2016
debug1: Reading configuration data /home/pi/.ssh/config
debug1: /home/pi/.ssh/config line 1: Applying options for 192.168.1.11
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.1.11 [192.168.1.11] port 52.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/pi/.ssh/nas_priv_key type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/pi/.ssh/nas_priv_key-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7p1 Raspbian-5+deb8u3
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.8p1-hpn14                                                                                                                                                             v6
debug1: match: OpenSSH_6.8p1-hpn14v6 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: put_host_port: [192.168.1.11]:52
debug3: load_hostkeys: loading entries for host "[192.168.1.11]:52" from file "/                                                                                                                                                             home/pi/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/pi/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@open                                                                                                                                                             ssh.com,[email protected],ecdsa-sha2-nistp521-cert-v01@op                                                                                                                                                             enssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-                                                                                                                                                             sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hel                                                                                                                                                             lman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],ecdsa-sha2-n                                                                                                                                                             [email protected],[email protected],ecdsa-sha2                                                                                                                                                             -nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected]                                                                                                                                                             om,[email protected],[email protected],ssh-rsa-cert-v00@op                                                                                                                                                             enssh.com,[email protected],ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected]                                                                                                                                                             om,[email protected],[email protected],arcfour256,arcfour128,ae                                                                                                                                                             s128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndae                                                                                                                                                             [email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected]                                                                                                                                                             om,[email protected],[email protected],arcfour256,arcfour128,ae                                                                                                                                                             s128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndae                                                                                                                                                             [email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],hmac                                                                                                                                                             [email protected],[email protected],[email protected]                                                                                                                                                             m,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1                                                                                                                                                             ,[email protected],[email protected],hmac-sha1-96-etm@openss                                                                                                                                                             h.com,[email protected],hmac-md5,hmac-ripemd160,hmac-ripemd160@openssh                                                                                                                                                             .com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],hmac                                                                                                                                                             [email protected],[email protected],[email protected]                                                                                                                                                             m,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1                                                                                                                                                             ,[email protected],[email protected],hmac-sha1-96-etm@openss                                                                                                                                                             h.com,[email protected],hmac-md5,hmac-ripemd160,hmac-ripemd160@openssh                                                                                                                                                             .com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-                                                                                                                                                             sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hel                                                                                                                                                             lman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: [email protected],[email protected],hmac                                                                                                                                                             [email protected],[email protected],[email protected]                                                                                                                                                             m,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],hmac                                                                                                                                                             [email protected],[email protected],[email protected]                                                                                                                                                             m,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup [email protected]
debug1: kex: server->client aes128-cbc [email protected] none
debug2: mac_setup: setup [email protected]
debug1: kex: client->server aes128-cbc [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 2f:5a:34:b1:2e:c4:d1:7e:1f:cc:81:b2:08:b6:59:25
debug3: put_host_port: [192.168.1.11]:52
debug3: put_host_port: [192.168.1.11]:52
debug3: load_hostkeys: loading entries for host "[192.168.1.11]:52" from file "/                                                                                                                                                             home/pi/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/pi/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "[192.168.1.11]:52" from file "/                                                                                                                                                             home/pi/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/pi/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug1: Host '[192.168.1.11]:52' is known and matches the ECDSA host key.
debug1: Found key in /home/pi/.ssh/known_hosts:2
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/pi/.ssh/nas_priv_key ((nil)), explicit
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/pi/.ssh/nas_priv_key
debug3: sign_and_send_pubkey: RSA 3f:58:d3:03:7f:09:32:35:00:21:8e:87:51:34:38:a6
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
[email protected]'s password:
Do you know what I can do to resolve this problem please ?

If you need more log or information, I will give it.

Thanks in advance for your help. :D

Baptiste

Re: SSH into a Synology NAS using a key

Posted: Friday 23 June 2017 15:50
by EddyG
With Puttygen you generated 2 keys on your windows machine.
You have to generate 2 keys (private and public) on the Raspberry too.
Append the public key from the raspberry to the file in .ssh dir on the Synology.
Thats all. Google for more (scripting) info.

Re: SSH into a Synology NAS using a key

Posted: Saturday 24 June 2017 22:30
by moumout31
EddyG wrote:With Puttygen you generated 2 keys on your windows machine.
You have to generate 2 keys (private and public) on the Raspberry too.
Append the public key from the raspberry to the file in .ssh dir on the Synology.
Thats all. Google for more (scripting) info.
Thanks for your answer.
I'm not sure that I really understand what I have to do.

Until now, I've created a key with Puttygen.
Then I've pasted in the authorised_keys on my Synology NAS the public key indicated in Puttygen.
On the Raspberry (with Domoticz) I'v copied the private key and the public key (without extension on them), I've modified the config file writing :

Code: Select all

Host 192.168.1.11
  IdentityFile ~/.ssh/nas_priv_key
I'v only written the private key, not the public key, is it correct ?
In all these previous steps, I also correctly modified permissions on different files.

You told me that I have to generate 2 keys (private and public) on the Raspberry too.
You mean that it's different from what I've already done ?
You mean that I don't have to use Puttygen, but I must generate keys directly on my Raspberry ?


Thanks a lot for your help ! :)

Baptiste