从 Linux 原生桌面，我能够从我们的 gitlab repo 克隆一个项目，如下所示：
git clone [email protected]:namespace/project.git
以上没有问题：具体来说，我没有被要求输入[email protected]密码。
我需要切换到 Windows 10 Linux 子系统 (WSL)；当我尝试相同的项目克隆时，我是提示输入[email protected]密码，但我没有。
问题：为什么在一个环境中提示我输入密码，而在另一个环境中却没有？
我尝试过的方法：
1. 由于我在 Linux 原生环境中拥有 ssh 密钥，因此我在 WSL 中创建了它们：
$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:16ba121a04d5ad3b885f09af5+c6c08b68766ce43d9 user@JFNM38J2
The key's randomart image is:
+---[RSA 2048]----+
| |
| |
| |
| |
| |
| |
| |
| |
| |
+----[SHA256]-----+
- 因为回答这个问题之后，我在 WSL 中启动了 sshd：
$ sudo /etc/init.d/ssh start
* Starting OpenBSD Secure Shell server sshd
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Could not load host key: /etc/ssh/ssh_host_ed25519_key
[ OK ]
- 我尝试比较两个环境中的输出。 引人注目的是，在 Linux 原生环境中，有一个在 WSL 环境中没有的“ ”注释。但我真的不明白为什么，或者更重要的是，我还能做些什么来设置 WSL 环境，以便它像 Linux 原生环境一样跳过密码。
ssh -vT [email protected]Server accepts key...[email protected]
$ # This is the Linux-native environment
$ uname -a
Linux linuxbox 5.4.8-200.fc31.x86_64 #1 SMP Mon Jan 6 16:44:18 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
$ ssh -vT [email protected]
OpenSSH_8.1p1, OpenSSL 1.1.1d FIPS 10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug1: Connecting to git.company.com [10.138.1.176] port 22.
debug1: Connection established.
debug1: identity file /home/user/.ssh/id_rsa type 0
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: identity file /home/user/.ssh/id_xmss type -1
debug1: identity file /home/user/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.1
debug1: match: OpenSSH_8.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to git.company.com:22 as 'git'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:+a3ohHfIsc5Bi99RHkwQQTZfMO0IdC5vj3Dxk6XpR9J
debug1: Host 'git.company.com' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:59
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 4294967296 blocks
debug1: Will attempt key: /home/user/.ssh/id_rsa RSA SHA256:Cf6Ann313zL2As5qABJe85JKJV3L3pGERP+VRCYIaAg agent
debug1: Will attempt key: /home/user/.ssh/id_dsa
debug1: Will attempt key: /home/user/.ssh/id_ecdsa
debug1: Will attempt key: /home/user/.ssh/id_ed25519
debug1: Will attempt key: /home/user/.ssh/id_xmss
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: KCM:)
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: KCM:)
debug1: Next authentication method: publickey
debug1: Offering public key: /home/user/.ssh/id_rsa RSA SHA256:Cf6Ann313zL2As5qABJe85JKJV3L3pGERP+VRCYIaAg agent
debug1: Server accepts key: /home/user/.ssh/id_rsa RSA SHA256:Cf6Ann313zL2As5qABJe85JKJV3L3pGERP+VRCYIaAg agent
debug1: Authentication succeeded (publickey).
Authenticated to git.company.com ([10.138.1.176]:22).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug1: Remote: /var/opt/gitlab/.ssh/authorized_keys:1121: key options: command user-rc
debug1: Remote: /var/opt/gitlab/.ssh/authorized_keys:1121: key options: command user-rc
debug1: Sending environment.
debug1: Sending env XMODIFIERS = @im=ibus
debug1: Sending env LANG = en_US.UTF-8
Welcome to GitLab, @user!
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype [email protected] reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2828, received 2880 bytes, in 0.1 seconds
Bytes per second: sent 43777.7, received 44582.6
debug1: Exit status 0
。
$ # This is the WSL environment
$ uname -a
Linux windowsbox 4.4.0-43-Microsoft #1-Microsoft Wed Dec 31 14:42:53 PST 2014 x86_64 x86_64 x86_64 GNU/Linux
$ ssh -vT [email protected]
OpenSSH_7.6p1 Ubuntu-4, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to git.company.com [199.21.163.250] port 22.
debug1: Connection established.
debug1: identity file /home/user/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.1
debug1: match: OpenSSH_8.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to git.company.com:22 as 'git'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:+a3ohHfIsc5Bi99RHkwQQTZfMO0IdC5vj3Dxk6XpR9J
debug1: Host 'git.company.com' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nis
tp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:EfQKfAR2alQK13JaqZ8AVMP7B+hqDEC9CGsOfqOHhL0 /home/user/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Trying private key: /home/user/.ssh/id_dsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Trying private key: /home/user/.ssh/id_ed25519
debug1: Next authentication method: password
[email protected]'s password:
有人能解释一下这两个环境中发生了什么吗？为什么一个环境可以在[email protected]:namespace/project.git没有用户输入密码的情况下克隆，而另一个环境却不能？
答案1
在 Linux 桌面中，您使用证书而不是密码进行连接。几个月前，您可能按照那里的说明配置了对 GitLab 的访问权限 (https://docs.gitlab.com/ee/ssh/) 使用 ssh-gen 生成密钥对，然后从 GitLab 网站上复制公钥。您可以通过执行以下任一操作来检查此操作，cat ~/.ssh/id_rsa.pub并将其与 GitLab 配置文件的安全设置中名为 SSH Key 的字段进行比较。
现在在新环境中，您生成了一个新的密钥对，该密钥对与 GitLab 设置中的密钥对不匹配，因此它要求输入密码。我在评论中建议的是通常将密钥对复制到您的 WSL 环境中。这是一种常见的行为~/.ssh/id_rsa，~/.ssh/id_rsa.pub特别是如果您经常在 WSL 和 Windows 工具之间切换。在这种情况下，您可以将凭据复制到 Windows 主目录中的 .ssh 文件夹。您还可以创建一个新密钥并将其添加到 GitLab。
希望能帮助到你
问候
答案2
您的 Git 服务器可能是 GitLab 实例，它使用默认的 OpenSSH 服务进行 SSH 操作。当您推送到实例时，您需要有一个可用的 SSH 密钥，但由于 OpenSSH 配置为支持密码，如果您没有有效的 SSH 密钥，系统将提示您输入密码。
但是，由于这是一个服务帐户，因此该帐户实际上没有有效的密码（密码哈希设置为与任何有效哈希都不匹配的无效值），如果您没有密钥，您将无法登录。其他托管平台（例如 GitHub）不使用系统 OpenSSH，而是会直接拒绝任何未提供有效公钥的连接。
由于一个环境 (WSL) 中的 SSH 密钥不同且服务器未知，因此服务器拒绝了它并返回到下一个身份验证方法。您只需将现有密钥（中的密钥~/.ssh/id_rsa.pub）添加到 GitLab 中的用户帐户，然后您就可以访问服务器了。