Error: User modify failed. Cannot modify user on this node: Authentication by SSH key failed!

24 admin June 18, 2024 Common Errors & Troubleshooting 9275

How to solve the error occured while modifying Ezeelogin gateway user?

Synopsis: Provide step by step instructions to troubleshoot and resolve the error encountered while modifying Ezeelogin gateway user.

Step 1: Check if the ezeelogin installed server is missing its public key in the /root/.ssh/authorized_keys file. If the key is missing, run the following command to add it:

root@gateway ~]# cat /usr/local/etc/ezlogin/id_clkey.pub >> /root/.ssh/authorized_keys

Step 1.a: Run below command to check if the key is back in the file.

root@gateway ~]# cat /root/.ssh/authorized_keys

Run the following command to check if you have enabled the recommended sshd settings in /etc/ssh/sshd_config

port 22
permitrootlogin yes
pubkeyauthentication yes
passwordauthentication yes
gatewayports no
allowtcpforwarding yes
pubkeyacceptedalgorithms [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa

Step 2: Ensure that the port on which sshd is listening on the Ezeelogin gateway server is specified as the gateway port in Ezeelogin GUI under Settings -> General -> Miscellaneous -> Gateway SSH Port.
Step 3: Make sure PubkeyAuthentication is set to 'YES' in your sshd_config (sshd configuration) file. In Centos/RHEL/Fedora/Ubuntu it would be:

root@gateway ~]# vi /etc/ssh/sshd_config

#set PubkeyAuthentication to yes

PubkeyAuthentication yes

root@gateway ~]# service sshd restart

Step 4: Ensure that root login is permitted on the gateway server. You can check this by running the command:

ssh root@localhost

Step 4.a: If it does not log you in, edit /etc/ssh/sshd_config and set PermitRootLogin to yes.

root@gateway ~]# vi /etc/ssh/sshd_config

#Add the following lines to the end of /etc/ssh/sshd_config to allow root login from localhost only

Match Address 127.0.0.1

PermitRootLogin yes

root@gateway ~]# service sshd restart

Step 4.b: After making the changes, ensure that you can log in as root by using the following command and entering the password:

ssh root@localhost

Step 5: Ensure that the web user (such as apache or nobody) that the web server (Apache/Nginx) runs has read access to the keys in the directory /usr/local/etc/ezlogin by granting read privileges with the following command:

chmod o+r /usr/local/etc/ezlogin/id_clkey
chmod o+r /usr/local/etc/ezlogin/id_clkey.pub
or
usermod -G <current_groupname_of_id_clkey_files> <webserver_user>

Step 6: Find out which key type is used by the server by running the below command.

root@gateway ~]# ssh-keygen -l -f /usr/local/etc/ezlogin/id_key.pub

4096 SHA256:n4lmX53/gwkKB4+nSQ30hZXxXK+DRG1LPc7N1KN/1Ag ezlogin (RSA)

Step 6.a: Open /etc/ssh/sshd_config file and append below line to enable RSA key type.

root@gateway ~]# vim /etc/ssh/sshd_config

PubkeyAcceptedKeyTypes +ssh-rsa

root@gateway ~]# systemctl restart sshd

Step 7: Check the log file /var/log/secure

root@gateway ~]# tail -f /var/log/secure

Refer below article if you get "userauth_pubkey: signature algorithm ssh-rsa not in PubkeyAcceptedAlgorithms"

https://www.ezeelogin.com/kb/article/userauth_pubkey-signature-algorithm-ssh-rsa-not-in-pubkeyacceptedalgorithms-518.html

Related Articles