![基于 SSH 密钥的身份验证间歇性工作](https://linux22.com/image/609483/%E5%9F%BA%E4%BA%8E%20SSH%20%E5%AF%86%E9%92%A5%E7%9A%84%E8%BA%AB%E4%BB%BD%E9%AA%8C%E8%AF%81%E9%97%B4%E6%AD%87%E6%80%A7%E5%B7%A5%E4%BD%9C.png)
我们有一个运行 jenkins 的开发服务器,其中有各种作业,运行通过 SSH(使用基于密钥的身份验证)连接到我们的实时服务器的 shell 脚本。
这似乎不太可靠。
如果我通过以“jenkins”用户身份登录到开发服务器,然后通过 SSH 连接到实时服务器来自行测试 SSH 连接,则身份验证将有效并且无需输入密码即可登录。
如果我手动运行其中一个詹金斯作业,它大多数时候都会有效(虽然今天早上有一个作业失败了,促使我写了这张票)但如果我自动执行该作业以在夜间运行,它大多数时候都会失败(我认为它曾经成功过一次)。
每次失败的点都在 SSH 连接上:
> ssh -T nepton@xxx
> Permission denied, please try again.
> Permission denied, please try again.
> Permission denied (publickey,password).
任何帮助都将不胜感激,因为我完全陷入困境,而且 Linux 绝对不是我的专业领域。
附加信息:
- 我在 Dev 上生成了公钥(以“jenkins”用户身份登录),使用方法如下: ssh-keygen -t rsa
- 我使用以下命令将密钥复制到实时服务器:ssh-copy-id -i ~/.ssh/id_rsa.pub nepton@xxx
Dev 上的 /var/lib/jenkins/.ssh/ 的权限是:
drwx------ 2 jenkins jenkins 4096 Apr 4 13:31 .
drwxr-xr-x 13 jenkins jenkins 4096 Apr 4 13:38 ..
-rw------- 1 jenkins jenkins 1679 Apr 4 13:31 id_rsa
-rw-r--r-- 1 jenkins jenkins 400 Apr 4 13:31 id_rsa.pub
-rw-r--r-- 1 jenkins jenkins 1338 Apr 4 13:33 known_hosts
Live 服务器上 /home/nepton/.ssh/ 的权限为:
drwx------ 2 nepton nepton 4096 Mar 20 17:37 .
drwx------ 4 nepton nepton 4096 Apr 2 10:52 ..
-rw------- 1 nepton nepton 2005 Apr 8 10:23 authorized_keys
-rw-r--r-- 1 nepton nepton 1106 Apr 1 10:39 known_hosts
- 我在两台服务器上运行着 Ubuntu 的最新 LTS 版本和标准 SSH 包。
调试信息
ssh -v -T -i /var/lib/jenkins/.ssh/id_rsa nepton@xxx
OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to xxx [xx.xxx.xx.xxx] port 22.
debug1: Connection established.
debug1: identity file /var/lib/jenkins/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /var/lib/jenkins/.ssh/id_rsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA xxx
debug1: Host 'xxx' is known and matches the ECDSA host key.
debug1: Found key in /var/lib/jenkins/.ssh/known_hosts:7
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /var/lib/jenkins/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).
Build step 'Execute shell' marked build as failure
答案1
正如您在评论中所说,它没有使用您想要的键。您可以像这样指出正确的键:
ssh -T -i /path/to/real/id_rsa nepton@xxx
答案2
我遇到了同样的问题,并找到了可能与此相关的解决方案。如果您尝试通过 SSH 连接到的系统位于负载平衡器(或类似设备)后面,则可能有时您的 SSH 可以成功,但如果正在进行负载平衡的机器没有共享主目录(或者至少没有您的 .ssh 信息,例如公钥),有时它会失败。
从您的角度来看,您似乎正在登录到单个主机,但实际上它间歇性地是一个不同的实际主机,这可以解释这种奇怪的行为。