☰

为什么我在 chmod 600 之后收到权限被拒绝（公钥）的信息？

tag-icon • tag-icon macos ssh ubuntu-12.04 ssh-keys
为什么我在 chmod 600 之后收到权限被拒绝（公钥）的信息？

我有

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/Users/Cody/.ssh/blue_gum.pub' are too open.

我做到了

chmod 600 ~/.ssh/blue_gum.pub

现在我得到弹出窗口（使用 mac os x mavericks）输入 SSH 密钥的密码，我没有密码所以我留空，然后我得到

Permission denied (publickey).

使用以下命令将密钥复制到服务器上的 authroized_keys 文件中

scp ~/.ssh/blue_gum.pub [email protected]:~/.ssh/authorized_keys

在 scp 到服务器之前我也尝试过 chmod 600，但出现了同样的情况。

我确保客户端和服务器上的 .ssh 具有 700 个权限，并且其中的所有文件都有 600 个权限。问题仍然存在。我将尝试下面描述的故障排除方法。如果有帮助的话，这是我的 sshd_config：

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
IgnoreUserKnownHosts no
PasswordAuthentication no

答案1

这是 OpenSSH 迄今为止最棘手的问题。再加上错误消息必然是隐秘的，调试更像是巫术，而不是正常的 IT 实践。无论如何：

  1. 确保两台服务器上的 .ssh 内的所有文件和客户端有权限600。

  2. 确保两台服务器上的目录 .ssh 都具有 700 的权限和客户。

如果问题仍然存在，请在服务器上终止 openssh，然后使用命令（以 sudo 形式发出）重新启动它

   killall sshd && /usr/sbin/sshd -Dd

这将启用服务器上的调试输出，然后尝试使用以下命令从客户端进行连接

  ssh me@my_remote_machine -vvv

这使得冗长输出。希望这两个输出的组合能够解决您的问题。

相关内容