![使用 RSA 密钥对 ssh 连接进行故障排除](https://linux22.com/image/144171/%E4%BD%BF%E7%94%A8%20RSA%20%E5%AF%86%E9%92%A5%E5%AF%B9%20ssh%20%E8%BF%9E%E6%8E%A5%E8%BF%9B%E8%A1%8C%E6%95%85%E9%9A%9C%E6%8E%92%E9%99%A4%20.png)
这是我在日志中看到的内容
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:f0cjkIUOI7TIxdOW905CdEHDgxNbj1vfXthE2LCz0rk /home/dmytrocx75/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /home/dmytrocx75/.ssh/id_dsa
debug1: Trying private key: /home/dmytrocx75/.ssh/id_ecdsa
debug1: Trying private key: /home/dmytrocx75/.ssh/id_ed25519
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
dmytrocx75@asus's password:
虽然我遵循了这里描述的程序https://help.ubuntu.com/community/SSH/OpenSSH/Keys#Troubleshooting
这是服务器的/var/log/secure
说法
Nov 5 18:15:28 Asus sshd[5414]: Authentication refused: bad ownership or modes for file /etc/ssh/dmytrocx75/authorized_keys
Nov 5 18:15:28 Asus sshd[5414]: Failed publickey for root from 192.168.1.3 port 49982 ssh2: RSA SHA256:f0cjkIUOI7TIxdOW905CdEHDgxNbj1vfXthE2LCz0rk
答案1
客户端已成功提供 RSA 密钥,但服务器端未接受。您需要查看服务器的日志(通常为/var/log/secure
或/var/log/auth.log
)以查看密钥被拒绝的原因。
拒绝原因不会向客户端透露,此时尚未经过身份验证,并且可能是恶意的。如果您无法访问服务器的日志,则需要联系服务器系统的管理员,请他们为您检查日志。
sshd
忽略私钥的常见原因是不安全的权限:
- 服务器上的主目录只能由您自己写入(权限
drwxr-xr-x
或更少) - 你
~/.ssh
在服务器上的目录只能由你自己访问,并且绝对不能被其他人写入(推荐权限drwx------
,sshd允许的最大权限是drwxr-xr-x
) - 你
~/.ssh/authorized_keys
在服务器上的文件应该只能由你自己访问,并且绝对不能被其他人写入(推荐权限-rw-------
,sshd允许的最大权限是-rw-r--r--
)
如果不遵循这些约束,sshd
则假定authorized_keys 文件已被系统上的其他用户篡改(因为不安全的权限可能允许这种情况发生),并将拒绝所有密钥身份验证尝试。这将导致sshd
记录一条消息:
sshd[<PID>]: Authentication refused: bad ownership or modes for file <pathname>