public_key variable not working about docker-openssh-server

[aptalca]

Public key works here.

Post the command you used to create the container, and post a log (feel free to partially redact sensitive info)

[bf8392]

I used this command (docker copose), and created ssh keys with putty (windows). I then pasted the public key to the env variable:

openssh-server:
image: linuxserver/openssh-server
container_name: openssh-server
hostname: openssh-server
network_mode: host
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/London
- PUBLIC_KEY=ssh-rsa AAAA.....
- SUDO_ACCESS=true
- PASSWORD_ACCESS=false
- USER_NAME=someuser
volumes:
- /path/to/appdata/config:/config
ports:
- 2222:2222
restart: unless-stopped

when i try to connect, the server doesnt accept the private key...when i set it to password, everything works fine...

these are the logs:

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 01-envfile: executing...
[cont-init.d] 01-envfile: exited 0.
[cont-init.d] 10-adduser: executing...

---

      _         ()
     | |  ___   _    __
     | | / __| | |  /  \
     | | \__ \ | | | () |
     |_| |___/ |_|  \__/

Brought to you by linuxserver.io
We gratefully accept donations at:
https://www.linuxserver.io/donate/

GID/UID

User uid: 1000
User gid: 1000

[cont-init.d] 10-adduser: exited 0.
[cont-init.d] 50-config: executing...
User name is set to maintainer
Sudo is enabled without password.
ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519
User/password ssh access is disabled.
Public key from env variable added
[cont-init.d] 50-config: exited 0.
[cont-init.d] 99-custom-files: executing...
[custom-init] no custom files found exiting...
[cont-init.d] 99-custom-files: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.

PS: I use it to ssh from the container into the host (by installing openssh-client thats why sudo is on). Thats why network_mode host is set...

[aptalca]

Try this while the container is running to confirm the key was added successfully: docker exec -it openssh-server cat /config/.ssh/authorized_keys

[tobbenb]

If I remember correctly, you need to convert keys made by putty for use on Linux.

[bf8392]

thats the output of the command:
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAACBvun3X/WBKTRlUPl3DjV2UmkUeMy1YtmWalaGM9+DvqQ==

dont worry this key is never gonna be used (only 256 bit)

is this the correct format?

[thelamer]

put the key in quotes

[bf8392]

tried...doesn't work =( dont know what im doing wrong =(

[bf8392]

I think I found the error! This is the ssh config file:

$ docker exec -it openssh-server cat /etc/ssh/sshd_config
#       $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile      .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no

#AllowAgentForwarding yes
# Feel free to re-enable these if your use case requires them.
AllowTcpForwarding no
GatewayPorts no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
PidFile /config/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem       sftp    /usr/lib/ssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

I thing the following two options are missing:

RSAAuthentication yes
PubkeyAuthentication yes

could this be? reffering to https://unix.stackexchange.com/questions/102502/meaning-of-connection-closed-by-xxx-preauth-in-sshd-logs

[bf8392]

output of openssh.log:

Server listening on 0.0.0.0 port 2222.
Server listening on :: port 2222.
Connection closed by authenticating user someuser 192.168.100.110 port 50530 [preauth]
Connection closed by authenticating user someuser 192.168.100.110 port 50536 [preauth]

[aptalca]

Either post it on pastebin or wrap it in code block: https://help.github.com/en/github/writing-on-github/creating-and-highlighting-code-blocks

[bf8392]

I'm sorry for this...looking for this function for really long! thank you =) I just started to post on github more frequent =)

[bf8392]

@aptalca I updated the comment with the function thanks again =)

[aptalca]

rsaauthentication is no longer a valid option in later versions. It is on by default.
pubkeyauthentication is commented out, but it doesn't matter since the default value is yes

Try with bridge networking to see if that causes the issue.

Make sure that your keys are valid and that you are using them the proper way. You can try the keys on the host and see if they work. And make sure that the output of docker exec -it openssh-server cat /config/.ssh/authorized_keys matches your public key exactly

[bf8392]

from the host i get permission denied...no idea whats wrong...converted putty key everything seems fine...everything works when i set password_auth to yes and do not use the public key file...

[aptalca]

Something's wrong with your keys then. Create them on a linux machine, follow these instructions: https://www.ssh.com/ssh/keygen#creating-an-ssh-key-pair-for-user-authentication

[bf8392]

I switched from the variable to the file...this works without problems...didn't get it to work with the variable...maybe I'm doing something else wrong...thanks for the help!