![无法使用 PublicKeys 通过 ssh 连接到我的 vps](https://linux22.com/image/1201018/%E6%97%A0%E6%B3%95%E4%BD%BF%E7%94%A8%20PublicKeys%20%E9%80%9A%E8%BF%87%20ssh%20%E8%BF%9E%E6%8E%A5%E5%88%B0%E6%88%91%E7%9A%84%20vps.png)
我是系统管理新手,正在尝试设置(/保护)我的第一个 VPS。据我所知,使用密钥比使用密码“更安全”,所以我在这里尝试这样做。
在写这篇文章之前我尝试过一些事情:
- 我尝试在我的 VPS 服务器上生成密钥
ssh-keygen -t rsa -b 4096
- 后来我
cp /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys id_rsa.pub
- 然后,我复制了私钥的内容
cat /root/.ssh/id_rsa
并将其导入 BitVise。
我也尝试了另一种方法,我在 BitVise 上生成密钥,然后按相反顺序执行了完全相同的过程。将公钥复制到我的 SSH 服务器上。
最后,我尝试使用 PuTTY,认为这可能是 BitVise 的问题,但不是,仍然被拒绝......
我尝试过的更多事情:
- 恢复并尝试使用密钥以 root 身份登录,但没有成功
PermitRootLogin
。yes
- 将公钥复制
/root/.ssh/authorized_keys/id_rsa.pub
到我的用户主目录/home/user/.ssh/authorized_keys/id_rsa.pub
,无法使用我的密钥和我的帐户登录
每次我更改配置文件时,我都会reboot
或sudo systemctl restart ssh
和sudo systemctl restart sshd
附加信息:
- 我在做上述事情之前就跑步
apt update
了apt upgrade
- 我可以使用密码登录,但不能使用密钥登录......
- 我仔细检查了一下,我的
id_rsa.pub
位于@/root/.ssh/authorized_keys
,内容也在那里
Ubuntu 版本:Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-174-generic x86_64)
这是我的/etc/ssh/sshd_config
:
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
#Include /etc/ssh/sshd_config.d/*.conf
Port XXXXX
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
# Ciphers and keying
#RekeyLimit default none
# Logging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
LoginGraceTime 2m
StrictModes yes
MaxAuthTries 6
MaxSessions 10
PubkeyAuthentication yes
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
# override default of no subsystems
Subsystem sftp /usr/lib/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server
PermitRootLogin no
答案1
authorized_keys
是文件不是目录。
将文件内容复制id_rsa.pub
到authorized_keys
文件在远程服务器上,目标用户主.ssh
空间的文件夹中。如果authorized_keys
远程服务器上存在目录,则删除该目录及其内容,然后创建一个文件并开始将公钥附加到文件的新行中。
注意不建议root
直接使用账户甚至通过 SSH。建议您创建一个具有sudo
权限的新用户,或者使用安装时创建的用户帐户,而不是root
与您的服务器交互的帐户。