# Permission denied (publickey,gssapi-keyex,gssapi-with-mic) **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [November 27, 2023, 5:11pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006 "2023-11-27T17:11:08Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 27, 2023, 5:11pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/1 "2023-11-27T17:11:08Z")
Hi i m just trying to authenticate the remote machine with ssh user from ad authentication, but it returns error as Permission denied (publickey,gssapi-keyex,gssapi-with-mic).its not asking for password. when i try to debug the same with below commad, it shows below output we have already setup PasswordAuthentication yes in /etc/ssh/sshd\_config ssh -v -i id\_rsa.pub -f -N -D 0.0.0.0:1080 user1@xxx.xxx.xx.xx debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/user1/.ssh/id\_rsa debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic debug1: Trying private key: /home/user1/.ssh/id\_dsa debug1: Trying private key: /home/user1/.ssh/id\_ecdsa debug1: Trying private key: /home/user1/.ssh/id\_ed2523\* debug1: No more authentication methods to try. Permission denied (publickey,gssapi-keyex,gssapi-with-mic). ---
**Author:** ![lumarel](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/lumarel/32/909_2.png) [@lumarel](https://forums.rockylinux.org/u/lumarel)\ **Post date:** [November 27, 2023, 5:30pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/2 "2023-11-27T17:30:32Z")
Hey there! I suspect that your `MaxAuthTries` is set to 3, because it tries your 3 present priv/pubkeys and then fails 🤔 ([ref](https://www.man7.org/linux/man-pages/man5/sshd_config.5.html)) You can mitigate that either by increasing that (not so good option), or you you extend your ssh client config, so it will always use basic auth for this connection (i.e. by setting `PreferredAuthentications`) ([ref](https://www.man7.org/linux/man-pages/man5/ssh_config.5.html)) I hope this helps! ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 27, 2023, 6:15pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/3 "2023-11-27T18:15:27Z")
hi Lumarel thanks for reply. i am not sure what is needed to be done at my side. also i can see below error on systemctl status sssd , can you please suggest Nov 27 10:00:31 server-1 sssd[4033234]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 27 10:00:31 server-1 sssd[4033234]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 27 10:00:31 server-1 sssd[4033238]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 27 10:00:31 server-1 sssd[4033238]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 27 10:00:31 server-1 sssd[4033244]: ; TSIG error with server: tsig verify failure ---
**Author:** ![lumarel](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/lumarel/32/909_2.png) [@lumarel](https://forums.rockylinux.org/u/lumarel)\ **Post date:** [November 27, 2023, 6:57pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/4 "2023-11-27T18:57:27Z")
Okay, did you verify that your configuration in SSSD works? If not depending on your configuration, can you do a `id ` or `id \` this should resolve the id and groups of the provided user. If that works your IdP config should be fine enough to work for login. Reading some documentation these errors could be due to a dyndns misconfiguration on the IdP side ([ref](https://access.redhat.com/solutions/5529661)), so not relevant for the functionality. As said above best would be to setup your in the config file or directly provide the option. Btw why are you providing an ssh pub key to ssh in the identity property, even though you want to do password auth? So for minimum configuration (hence no ssh client config file) it would be a `ssh -o PreferredAuthentications=password user1@xxx.xxx.xx.xx` ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 28, 2023, 2:17am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/5 "2023-11-28T02:17:54Z")
> [@lumarel](#): > > PreferredAuthentications=password if i try ssh -v -o PreferredAuthentications=password user1@xxx.xxx.xx.xx i get below output OpenSSH\_7.2p2 Ubuntu-4ubuntu2.8, OpenSSL 1.0.2g 1 Mar 2016 debug1: Reading configuration data /etc/ssh/ssh\_config debug1: /etc/ssh/ssh\_config line 19: Applying options for \* debug1: Connecting to xxxxxx [xx.xxx.xxx.xx] port 22. debug1: Connection established. debug1: permanently\_set\_uid: 0/0 debug1: identity file /root/.ssh/id\_rsa type 1 debug1: key\_load\_public: No such file or directory debug1: identity file /root/.ssh/id\_rsa-cert type -1 debug1: key\_load\_public: No such file or directory debug1: identity file /root/.ssh/id\_dsa type -1 debug1: key\_load\_public: No such file or directory debug1: identity file /root/.ssh/id\_dsa-cert type -1 debug1: key\_load\_public: No such file or directory debug1: identity file /root/.ssh/id\_ecdsa type -1 debug1: key\_load\_public: No such file or directory debug1: identity file /root/.ssh/id\_ecdsa-cert type -1 debug1: key\_load\_public: No such file or directory debug1: identity file /root/.ssh/id\_ed25519 type -1 debug1: key\_load\_public: No such file or directory debug1: identity file /root/.ssh/id\_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH\_7.2p2 Ubuntu-4ubuntu2.8 debug1: Remote protocol version 2.0, remote software version OpenSSH\_8.7 debug1: match: OpenSSH\_8.7 pat OpenSSH\* compat 0x04000000 debug1: Authenticating to xxxxxx:22 as ‘user1’ debug1: SSH2\_MSG\_KEXINIT sent debug1: SSH2\_MSG\_KEXINIT received debug1: kex: algorithm: [curve25519-sha256@libssh.org](mailto:curve25519-sha256@libssh.org) debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server-\>client cipher: [chacha20-poly1305@openssh.com](mailto:chacha20-poly1305@openssh.com) MAC: compression: none debug1: kex: client-\>server cipher: [chacha20-poly1305@openssh.com](mailto:chacha20-poly1305@openssh.com) MAC: compression: none debug1: expecting SSH2\_MSG\_KEX\_ECDH\_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:BMD+N+geLlHsprIkFrl2DRJyMcGaacT+GM8nLABJtOs debug1: Host ‘xxxxxx’ is known and matches the ECDSA host key. debug1: Found key in /root/.ssh/known\_hosts:951 debug1: rekey after 134217728 blocks debug1: SSH2\_MSG\_NEWKEYS sent debug1: expecting SSH2\_MSG\_NEWKEYS debug1: SSH2\_MSG\_NEWKEYS received debug1: rekey after 134217728 blocks debug1: SSH2\_MSG\_EXT\_INFO received debug1: kex\_input\_ext\_info: server-sig-algs=\<[ssh-ed25519,sk-ssh-ed25519@openssh.com](mailto:ssh-ed25519,sk-ssh-ed25519@openssh.com),ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com\> debug1: SSH2\_MSG\_SERVICE\_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic debug1: No more authentication methods to try. Permission denied (publickey,gssapi-keyex,gssapi-with-mic). ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 28, 2023, 2:20am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/6 "2023-11-28T02:20:47Z")
if i try the same for user2 who is a local user of remote machine, then its working fine .but when i try to connect ad joined user , its returning error. below is the log for reference when local user of remote server is attempted to ssh ssh -v -o PreferredAuthentications=password user2@xxx.xxx.xx.xx debug1: Found key in /root/.ssh/known\_hosts:951 debug1: rekey after 134217728 blocks debug1: SSH2\_MSG\_NEWKEYS sent debug1: expecting SSH2\_MSG\_NEWKEYS debug1: SSH2\_MSG\_NEWKEYS received debug1: rekey after 134217728 blocks debug1: SSH2\_MSG\_EXT\_INFO received debug1: kex\_input\_ext\_info: server-sig-algs=\<[ssh-ed25519,sk-ssh-ed25519@openssh.com](mailto:ssh-ed25519,sk-ssh-ed25519@openssh.com),ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com\> debug1: SSH2\_MSG\_SERVICE\_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: password ---
**Author:** ![FrankCox](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/frankcox/32/1572_2.png) [@FrankCox](https://forums.rockylinux.org/u/FrankCox)\ **Post date:** [November 28, 2023, 7:35am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/7 "2023-11-28T07:35:41Z")
You’re attempting a ssh login as the root user. Which is a bad idea. But if you insist, you need to change PermitRootLogin no to PermitRootLogin yes ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 29, 2023, 5:35am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/8 "2023-11-29T05:35:15Z")
i able to login with local linux users, but getting error when i tried to login with ad joined users. ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 29, 2023, 6:03am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/9 "2023-11-29T06:03:09Z")
systemctl status sssd showing below error,c an this be cause for this? Nov 28 21:49:23 serv1 sssd\_nss[2425987]: Starting up Nov 28 21:49:23 serv1 sssd\_pam[2425988]: Starting up Nov 28 21:49:23 serv1 sssd\_pac[2425989]: Starting up Nov 28 21:49:23 serv1 systemd[1]: Started System Security Services Daemon. Nov 28 21:49:42 serv1 sssd[2429434]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 28 21:49:42 serv1 sssd[2429434]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 28 21:49:42 serv1 sssd[2429488]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 28 21:49:42 serv1 sssd[2429488]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server no\> Nov 28 21:49:42 serv1 sssd[2429531]: ; TSIG error with server: tsig verify failure Nov 28 21:49:42 serv1 sssd[2429531]: update failed: SERVFAIL ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [November 29, 2023, 7:50am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/10 "2023-11-29T07:50:32Z")
The issue won’t be within sshd, the issue is going to be within sssd. Based on the logs you’ve provided, this can come down to a few things: - There is missing DNS records (especially reverse DNS for the DC or the host you’ve joined) - dynamic DNS is not allowed - Your system’s FQDN / server name does NOT match what’s actually in AD You can try the following: - `rm -rf /var/lib/sss/db/* ; systemctl restart sssd` - This clears the cache and starts at a clean slate. Do this and try again. - Set `dyndns_updates = false` under the `[domain/...` section in `/etc/sssd/sssd.conf` and run `systemctl restart sssd` - If any of the above does not work: `realm leave DOMAIN` and then `realm join DOMAIN` and try again. Beyond this, I would highly recommend troubleshooting/debugging sssd. I would read this guide: [Troubleshooting Basics - sssd.io](https://sssd.io/troubleshooting/basics.html) - This guide will get you through basic troubleshooting to try to drill down if any of the above does not work for you. ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 29, 2023, 7:54am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/11 "2023-11-29T07:54:50Z")
thanks for the reply ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [November 29, 2023, 8:12am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/12 "2023-11-29T08:12:19Z")
> [@rr.manoj](#): > > we have already setup PasswordAuthentication yes in /etc/ssh/sshd\_config Note on that, since you seem to have el9 (based on “remote software version OpenSSH\_8.0”). The el9 version fo sshd starts `/etc/ssh/sshd_config` with: ```plaintext Include /etc/ssh/sshd_config.d/*.conf ``` If your `PasswordAuthentication yes` is _afher_ the include and if any of the `/etc/ssh/sshd_config.d/*.conf` sets `PasswordAuthentication` then that overrides your setting because sshd does use _first_ occurrence for each option. The preferred way to modify sshd config in el9 is thus to add a `*.conf` file into `/etc/ssh/sshd_config.d/` that is lexicographically first (by its name). * * * Do you have any other method to access the system than ssh? That is, can the AD accounts use password at all? I.e. you probably want to test/debug (the sssd) with more than just ssh. ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 29, 2023, 8:15am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/13 "2023-11-29T08:15:28Z")
thanks for the reply ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 30, 2023, 5:30pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/14 "2023-11-30T17:30:11Z")
hi Jlehtone this works for me , thanks. i have now new issue here related to same rocky linux9 , please check if you can suggest. one of our user is trying to connect to sftp , is not able to connect , when i check /var/log/secure i can see below error in log. localhost sshd: Unable to negotiate with xxx.xx.xxx.xx port xxxx: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth] localhost sshd[1875696]: Unable to negotiate with xx.xx.xxx.xx port xxxx: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [November 30, 2023, 6:19pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/15 "2023-11-30T18:19:01Z")
el9 does not support SHA1 in its default security policy: [Chapter 3. Using system-wide cryptographic policies Red Hat Enterprise Linux 9 | Red Hat Customer Portal](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#doc-wrapper) It is still possible to enable the support: [Chapter 3. Using system-wide cryptographic policies Red Hat Enterprise Linux 9 | Red Hat Customer Portal](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#proc_re-enabling-sha-1_using-the-system-wide-cryptographic-policies) but one should rather work on updating the other, ancient, party. ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [November 30, 2023, 7:06pm UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/16 "2023-11-30T19:06:10Z")
thanks for the reply/ if rocky linux is on openssh 8.\* and end user is using openssh 7.\* , what is the best way we can solved this issue ? ---
**Author:** ![rr.manoj](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@rr.manoj](https://forums.rockylinux.org/u/rr.manoj)\ **Post date:** [December 1, 2023, 7:41am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/17 "2023-12-01T07:41:31Z")
thanks for the reply and valuable information in the provided URL. i am just gone through this the site [OpenSSH: Legacy Options](https://www.openssh.com/legacy.html) as per site i can imagine below 3 solutions, can you please suggest me ? solution 1- ssh -oHostKeyAlgorithms=+ssh-dss user@legacyhost ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 user@legacyhost or suggestion2: end user should upgrade to latest openssh version 8 or laterm, if openssh upgrade is not possible, can we ask end user to use any latest winscp software which normally dont face any issue while connecting to rocky9 ssh/sftp or solution3 : we at our side , need to update the cyrpto-policies update-crypto-policies --show (it shows default) update-crypto-policies --set LEGACY OR update-crypto-policies --set DEFAULT:SHA1\*\* reboot OR if end user is using OpenSSH\_7.2 , what we should suggest them? if user is having openssh-7.2 version , what we can ask client to do at his side ? in above mentioned solutions, is solution1 and solution3 both needs to apply together , or it can work independently ? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [January 30, 2024, 7:41am UTC](https://forums.rockylinux.org/t/permission-denied-publickey-gssapi-keyex-gssapi-with-mic/12006/18 "2024-01-30T07:41:38Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.