![SSH 公钥登录的奇怪行为](https://linux22.com/image/1417049/SSH%20%E5%85%AC%E9%92%A5%E7%99%BB%E5%BD%95%E7%9A%84%E5%A5%87%E6%80%AA%E8%A1%8C%E4%B8%BA.png)
我真的被困在这里了。我一直试图使用公钥从本地 ssh 进入我的 ec2 服务器,但没有成功。-> 我收到权限被拒绝(公钥)的提示。
设置如下:本地:生成公钥对并复制 id_rsa.pub 的内容。远程:使用 PEM 文件通过 ssh 进入我的 EC2 服务器,并将 id_rsa.pub 内容粘贴到 .ssh 文件夹中授权密钥文件的新行中。
应该可以正常工作吧?我注意到一个常见的错误是权限,但我的设置似乎正确:
远程权限:
drwx------ 2 ec2-user ec2-user 4096 Jul 23 04:00 .ssh
在.ssh中:
-rw-r--r-- 1 ec2-user ec2-user 404 Jul 24 03:19 id_rsa.pub
-rw------- 1 ec2-user ec2-user 1679 Jul 24 03:19 id_rsa
-rw------- 1 ec2-user ec2-user 529 Jul 26 20:53 authorized_keys
当地的:
drwx------ 10 robvanhaaren staff 340 Jul 26 18:43 .ssh
在.ssh中:
-rw-r--r-- 1 robvanhaaren staff 404 Jul 26 21:28 id_rsa.pub
-rw------- 1 robvanhaaren staff 1766 Jul 26 21:28 id_rsa
-rw-r--r-- 1 robvanhaaren staff 5987 Jul 26 21:29 known_hosts
但是当我跑步时:
Robs-MacBook-Air-2:.ssh robvanhaaren$ ssh ec2-54-85-62-99.compute-1.amazonaws.com -l ec2-user -v
它返回:
OpenSSH_5.9p1, OpenSSL 0.9.8y 5 Feb 2013
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to ec2-54-85-62-99.compute-1.amazonaws.com [54.85.62.99] port 22.
debug1: Connection established.
debug1: identity file /Users/robvanhaaren/.ssh/id_rsa type 1
debug1: identity file /Users/robvanhaaren/.ssh/id_rsa-cert type -1
debug1: identity file /Users/robvanhaaren/.ssh/id_dsa type -1
debug1: identity file /Users/robvanhaaren/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 7a:d3:6c:7f:64:5d:b1:7b:2e:bb:73:0c:ce:0c:17:77
debug1: Host 'ec2-54-85-62-99.compute-1.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /Users/robvanhaaren/.ssh/known_hosts:15
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/robvanhaaren/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /Users/robvanhaaren/.ssh/id_dsa
debug1: No more authentication methods to try.
Permission denied (publickey).
奇怪的是,我可以使用公钥从我的其他 ec2 服务器登录到该服务器。所以问题似乎出在我的本地机器上,而不是遥控器。
请帮忙!
答案1
SSH 问题可能很麻烦。我总是从以下内容开始。我将命令保存在备忘单中,这样我就不必担心输入错误。
chmod 700 ~/.ssh && chmod 600 ~/.ssh/* \
&& chmod 644 ~/.ssh/authorized_keys \
&& chown -r <username>:<username> /home/<username>/.ssh \
&& chown -r <username>:<username> /home/<username>/.ssh/*
如果这不起作用,我会删除 authorized_keys 并重新创建它(注意所有权和权限),确保从记事本或其他合适的文本编辑器复制内容。写字板和其他胖编辑器可能会弄乱密钥。您还可以从 known_hosts 文件中删除远程主机的条目。我记得曾经为了某事这样做过一次。
答案2
确保/var/log/auth.log
按照评论中所述进行检查。你几乎总能在那里找到答案。
我为我的服务器和本地设置了以下权限:
服务器
drwx------ remoteuser group ~/.ssh
-rw------- remoteuser group ~/.ssh/authorized_keys
本地
drwx------ user group ~/.ssh
-rw------- user group ~/.ssh/id_rsa
-rw----r-- user group ~/.ssh/id_rsa.pub