#362 F34 GCP - Permission denied (publickey,gssapi-keyex,gssapi-with-mic) with Compute engine metadata ssh keys
Opened 3 years ago by benvdh3. Modified 3 years ago

Today I did a lot of testing with the Fedora-34-GCP-Cloud-Base image, even though my virtual machine boots, I am not able to gain access to it, as sshd keeps rejecting my key with the following error:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Steps to reproduce

  1. Download the Fedora image here: https://fedora.mirror.wearetriple.com/linux/releases/34/Cloud/x86_64/images/Fedora-Cloud-Base-GCP-34-1.2.x86_64.tar.gz
  2. Create a storage bucket in the Google Cloud project where you want to store the image
  3. Upload the image to the storage bucket
  4. Create a new Google Compute Engine image using the gcloud command:
    gcloud compute images create "fedora-34" --source-uri=gs://my-bucket/Fedora-Cloud-Base-GCP-34-1.2.x86_64.tar.gz --guest-os-features=UEFI_COMPATIBLE
  5. Generate an SSH keypair for the VM (in my case I used aan ecdsa keypair):
    ssh-keygen -t ecdsa
  6. Create a new VM in the project where you created the VM image. The VM should use our custom fedora-34 image, and the public key should be added in the Security > SSH keys section. Optionally: add serial-port-enable=TRUE to the VMs metadata to be able to record output from the first boot.
  7. When the machine is ready, try to connect using the username that Google extracted from your ssh public key using the regular ssh command:
    ssh ben@1.2.3.4
  8. Observe the VM throws the following error (if the firewall is correctly setup too):
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

Observed behaviour: SSH throws an error.

Expected behaviour: I get logged in to the machine.

Other things I have tried


After a little digging, I found that if your SSH key ends with fedora@something, then you can log in as the fedora user without issues. However, if I supply an SSH key withmajor@something, then I can't log in as fedora or major with my SSH key. Both SSH keys are making it to the system via metadata, but only the fedora key is read and deployed by cloud-init.

Log in to comment on this ticket.

Metadata