(这是 ssh 的问题,而不是 gitolite 的问题)
我已经在我的家庭服务器(ubuntu 12.04 服务器,open-ssh)上配置了 gitolite。我想要一个特殊的身份文件来管理存储库,因此我需要使用两个不同的身份密钥通过 ssh 访问我自己的主机。
这是我的 .ssh/config 文件的内容:
Host gitadmin.gammu.com
User git
IdentityFile /home/alvaro/.ssh/id_gitolite_mantra
Host git.gammu.com
User git
IdentityFile /home/alvaro/.ssh/id_alvaro_mantra
这是我的主机文件的内容:
# Git
127.0.0.1 gitadmin.gammu.com
127.0.0.1 git.gammu.com
所以我应该能够通过这种方式与 gitolite 通信以使用“普通”帐户进行访问:
$ssh git.gammu.com
并使用管理帐户进行访问:
$ssh gitadmin.gammu.com
当我尝试使用普通帐户访问时,一切正常:
alvaro@mantra:~/.ssh$ ssh git.gammu.com
PTY allocation request failed on channel 0
hello alvaro, this is gitolite 2.2-1 (Debian) running on git 1.7.9.5
the gitolite config gives you the following access:
@R_ @W_ testing
Connection to git.gammu.com closed.
当我对管理帐户执行相同操作时:
alvaro@mantra:~$ ssh gitadmin.gammu.com
PTY allocation request failed on channel 0
hello alvaro, this is gitolite 2.2-1 (Debian) running on git 1.7.9.5
the gitolite config gives you the following access:
@R_ @W_ testing
Connection to gitadmin.gammu.com closed.
它应该显示管理存储库。如果我使用详细选项启动 ssh:
ssh -vvv gitadmin.gammu.com
...
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/alvaro/.ssh/id_alvaro_mantra (0x7f7cb6c0fbc0)
debug2: key: /home/alvaro/.ssh/id_gitolite_mantra (0x7f7cb6c044d0)
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/alvaro/.ssh/id_alvaro_mantra
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
...
它提供了密钥 id_alvaro_mantra,但它不应该!!
当我使用 -i 选项指定密钥时也会发生同样的情况:
ssh -i /home/alvaro/.ssh/id_gitolite_mantra -vvv gitadmin.gammu.com
...
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/alvaro/.ssh/id_alvaro_mantra (0x7fa365237f90)
debug2: key: /home/alvaro/.ssh/id_gitolite_mantra (0x7fa365230550)
debug2: key: /home/alvaro/.ssh/id_gitolite_mantra (0x7fa365231050)
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/alvaro/.ssh/id_alvaro_mantra
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 36:b1:43:36:af:4f:00:e5:e1:39:50:7e:07:80:14:26
debug3: sign_and_send_pubkey: RSA 36:b1:43:36:af:4f:00:e5:e1:39:50:7e:07:80:14:26
debug1: Authentication succeeded (publickey).
...
发生了什么事?我遗失了一些东西,但我找不到是什么。
这些是我的主目录的内容:
-rw-rw-r-- 1 alvaro alvaro 395 nov 14 18:00 authorized_keys
-rw-rw-r-- 1 alvaro alvaro 326 nov 21 10:21 config
-rw------- 1 alvaro alvaro 137 nov 20 20:26 environment
-rw------- 1 alvaro alvaro 1766 nov 20 21:41 id_alvaromaceda.es
-rw-r--r-- 1 alvaro alvaro 404 nov 20 21:41 id_alvaromaceda.es.pub
-rw------- 1 alvaro alvaro 1766 nov 14 17:59 id_alvaro_mantra
-rw-r--r-- 1 alvaro alvaro 395 nov 14 17:59 id_alvaro_mantra.pub
-rw------- 1 alvaro alvaro 771 nov 14 18:03 id_developer_mantra
-rw------- 1 alvaro alvaro 1679 nov 20 12:37 id_dos_pruebasgit
-rw-r--r-- 1 alvaro alvaro 395 nov 20 12:37 id_dos_pruebasgit.pub
-rw------- 1 alvaro alvaro 1679 nov 20 12:46 id_gitolite_mantra
-rw-r--r-- 1 alvaro alvaro 397 nov 20 12:46 id_gitolite_mantra.pub
-rw------- 1 alvaro alvaro 1675 nov 20 21:44 id_gitpruebas.es
-rw-r--r-- 1 alvaro alvaro 408 nov 20 21:44 id_gitpruebas.es.pub
-rw------- 1 alvaro alvaro 1679 nov 20 12:34 id_uno_pruebasgit
-rw-r--r-- 1 alvaro alvaro 395 nov 20 12:34 id_uno_pruebasgit.pub
-rw-r--r-- 1 alvaro alvaro 2434 nov 21 10:11 known_hosts
还有一堆其他的密钥没有提供……为什么只提供 id_alvaro_mantra 而不提供其他密钥?我不明白。
我需要一些帮助,不知道去哪里找......
答案1
根据手册页,这是预期的行为ssh_config
:
IdentityFile
Specifies a file from which the user's DSA, ECDSA or DSA authentica‐
tion identity is read. The default is ~/.ssh/identity for protocol
version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for
protocol version 2. Additionally, any identities represented by the
authentication agent will be used for authentication.
[...]
It is possible to have multiple identity files specified in configu‐
ration files; all these identities will be tried in sequence. Mul‐
tiple IdentityFile directives will add to the list of identities
tried (this behaviour differs from that of other configuration
directives).
基本上,指定IdentityFile
s 只是将密钥添加到 SSH 代理已向客户端呈现的当前列表中。
尝试在文件底部使用此方法覆盖此行为.ssh/config
:
Host *
IdentitiesOnly yes
答案2
对于我来说,解决方案是使用以下命令将密钥添加到 ssh 密钥列表中:
ssh-add ~/.ssh/id_name_of_my_rsa_key
这样在连接服务器时就可以提供。添加 ssh 后,它会自动识别正确的。
编辑:
但最近我认为更好的解决方案和更持久的方法是转到~/.ssh/config
并添加IdentitiesOnly yes
您的配置文件,如下所示:
Host github.com
HostName github.com
User git
IdentityFile ~/.ssh/id_rsa
IdentitiesOnly yes