☰

ssh 身份验证不允许公钥

tag-icon • tag-icon ssh rhel6
ssh 身份验证不允许公钥

我在一台测试服务器上遇到了 SSH 身份验证问题。我已sshd_config正确配置，但身份验证方法仅显示密码验证。

[root@[client] ~]# ssh -v [server]  
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010  
debug1: Reading configuration data /etc/ssh/ssh_config  
debug1: Applying options for *  
debug1: Connecting to [server] [xxx.xx.xx.xxx] port 22.  
debug1: Connection established.  
debug1: permanently_set_uid: 0/0  
debug1: identity file /root/.ssh/identity type -1  
debug1: identity file /root/.ssh/identity-cert type -1  
debug1: identity file /root/.ssh/id_rsa type 1  
debug1: identity file /root/.ssh/id_rsa-cert type -1  
debug1: identity file /root/.ssh/id_dsa type -1  
debug1: identity file /root/.ssh/id_dsa-cert type -1  
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.6  
debug1: match: OpenSSH_4.6 pat OpenSSH_4*  
debug1: Enabling compatibility mode for protocol 2.0  
debug1: Local version string SSH-2.0-OpenSSH_5.3  
debug1: SSH2_MSG_KEXINIT sent  
debug1: SSH2_MSG_KEXINIT received  
debug1: kex: server->client aes128-ctr hmac-md5 none  
debug1: kex: client->server aes128-ctr hmac-md5 none  
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent  
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP  
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent  
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY  
debug1: Host '[server]' is known and matches the RSA host key.  
debug1: Found key in /root/.ssh/known_hosts:5  
debug1: ssh_rsa_verify: signature correct  
debug1: SSH2_MSG_NEWKEYS sent  
debug1: expecting SSH2_MSG_NEWKEYS  
debug1: SSH2_MSG_NEWKEYS received  
debug1: SSH2_MSG_SERVICE_REQUEST sent  
debug1: SSH2_MSG_SERVICE_ACCEPT received  
debug1: **Authentications that can continue: password,**  
debug1: Next authentication method: password  
root@[server] password:

我的期望是：

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password because I have set this on my sshd_config:

sshd_config我的文件中的一些相关行：

PermitRootLogin yes  
PermitRootLogin without-password  
RSAAuthentication yes  
PubkeyAuthentication yes

我不知道这是防火墙问题还是服务器端问题

我的sshd_config文件：

ListenAddress 199.xx.xx.xx 
Protocol 2 
SyslogFacility AUTHPRIV 
PermitRootLogin yes 
PermitRootLogin without-password 
RSAAuthentication yes 
PubkeyAuthentication yes 
AuthorizedKeysFile .ssh/authorized_keys 
PasswordAuthentication yes 
ChallengeResponseAuthentication no 
GSSAPIAuthentication yes 
GSSAPICleanupCredentials yes 
UsePAM yes

此外，还有一些相关的权限：

drwx------.  2 root root     4096 Sep  1 09:12 .ssh  
-rw-r--r--.  1 root root      235 Aug 12 16:00 .ssh/authorized_keys

甚至尝试强制使用公钥认证但仍然是用户密码作为认证

ssh -2 -vvv -o PubkeyAuthentication=yes -o RSAAuthentication=yes -o   PasswordAuthentication=yes -o PreferredAuthentications=publickey [server]  




debug3: Wrote 64 bytes for a total of 1277  
debug1: Authentications that can continue: password,  
debug3: start over, passed a different list password,  
debug3: preferred publickey  
debug1: No more authentication methods to try.




var/log/secure  
Sep  3 10:43:09 crewtest sshd[47353]: Connection closed by xx.xx.xx.xx

答案1

看起来您正在运行 CentOS 或 RHEL（根据您的安全文件是/var/log/secure，如问题评论中所示）。默认情况下，CentOS 下的 OpenSSH 对~/.ssh目录和authorized_keys文件的权限要求非常严格。

将模式设置为开启.ssh/authorized_keys（600）-rw-------并再次尝试连接。

 chmod 600 .ssh/authorized_keys

答案2

我不确定，但我认为你的 sshd_config 中的 AuthorizedKeysFile 选项是错误的。

尝试将其更改为：

AuthorizedKeysFile ~/.ssh/authorized_keys

相关内容