Fixing SSH Key Authentication for AD User After RHEL Migration

Introduction

After a recent RHEL migration, we encountered an issue where SSH key-based authentication failed for the AD user ansible, which is used by Jenkins for automation.

This post documents the root cause, troubleshooting, and final resolution.

Issue

While attempting SSH login using a private key:

ssh -i ~/ansible-key-rsa ansible@10.xxx.xxx.xx

Instead of key-based login, the system prompted for a password:

ansible@10.xxx.xxx.xx's password:

Root Cause

The issue was introduced after the RHEL migration.

👉 The ansible user is an AD/LDAP (domain) user, not a local Linux user.

After migration:

• The home directory /home/ansiblewas missing
• The **.ssh/authorized_keys file was not present**
• SSH key authentication had nothing to validate against

As a result:

• SSH fell back to password authentication

Investigation

We verified the user:

id ansible

Confirmed:

• It belongs to domain users
• It is resolved via AD (SSSD)

Checked home directory:

ls -ld /home/ansible

Observed:

• Directory either missing or improperly initialized
• .ssh directory missing or incorrect

Resolution Steps

1. Create Home SSH Structure

mkdir -p /home/ansible/.ssh

2. Set Correct Permissions

chmod 700 /home/ansible
chmod 700 /home/ansible/.ssh

3. Fix Ownership (Important for AD user)

chown ansible:"domain users" /home/ansible
chown -R ansible:"domain users" /home/ansible/.ssh

4. Add Public Key

vi /home/ansible/.ssh/authorized_keys

Paste the public key.

5. Secure the Key File

chmod 600 /home/ansible/.ssh/authorized_keys

Final Expected State

/home/ansible            -> drwx------ (700)
/home/ansible/.ssh       -> drwx------ (700)
/home/ansible/.ssh/authorized_keys -> -rw------- (600)

Ownership:

ansible:domain users

Key Learnings

• AD users do not automatically recreate SSH configurations after OS migration
• SSH key authentication depends entirely on:
• Home directory
• .ssh directory
• authorized_keys file
• Missing any of the above → authentication fails silently
• Permissions and ownership must be exact

Impact

• Jenkins jobs using ansible failed SSH authentication
• Automation pipelines were blocked

Conclusion

The issue was not with SSH itself, but with missing user-level configuration after RHEL migration.

Once the home directory and authorized_keys were properly restored, SSH key authentication worked as expected.

Recommendation

After any OS migration:

• Validate service users (especially AD users)
• Ensure:
• Home directories exist
• SSH keys are restored
• Permissions are correct

This avoids unexpected failures in automation tools like Jenkins and Ansible.

A simple missing .ssh directory can break an entire automation pipeline—always verify user environments post-migration.