☰

我如何让 sshd 告诉我公钥认证失败的原因？

tag-icon • tag-icon ssh logging authentication public-key
我如何让 sshd 告诉我公钥认证失败的原因？

我使用 OpenSSH 6.9p1（在 Lubuntu 上）作为我的 SSH 服务器。当尝试连接到它时（使用 Cygwin 中的 SSH 客户端），尽管我已经正确生成了密钥、将它们放在服务器上的授权密钥文件中、检查了权限等，但我仍然被恢复到密码验证。

于是我查看了一下/var/log/auth.log服务器说了什么。我发现了以下内容：

Nov  1 09:50:10 er-thinkpad sshd[16148]: Accepted password for joeuser from 192.168.2.6 port 53325 ssh2
Nov  1 09:50:10 er-thinkpad sshd[16148]: pam_unix(sshd:session): session opened for user joeuser by (uid=0)
Nov  1 09:50:10 er-thinkpad systemd-logind[590]: New session 497 of user joeuser.

... 在第一行之前没有任何关于公钥认证失败的信息。好吧，也许我们可以增加详细程度。所以我将 改为并重LogLevel试。现在我得到：INFOVERBOSE

Nov  1 09:53:12 er-thinkpad sshd[16269]: Connection from 192.168.2.6 port 53349 on 192.168.2.2 port 22
Nov  1 09:53:12 er-thinkpad sshd[16269]: Failed publickey for joeuser from 192.168.2.6 port 53349 ssh2: RSA SHA256:removedthis
Nov  1 09:53:12 er-thinkpad sshd[16269]: Failed publickey for joeuser from 192.168.2.6 port 53349 ssh2: ECDSA SHA256:removedthis
Nov  1 09:53:15 er-thinkpad sshd[16269]: Accepted password for joeuser from 192.168.2.6 port 53349 ssh2
Nov  1 09:53:15 er-thinkpad sshd[16269]: pam_unix(sshd:session): session opened for user joeuser by (uid=0)
Nov  1 09:53:15 er-thinkpad systemd-logind[590]: New session 499 of user joeuser.
Nov  1 09:53:15 er-thinkpad sshd[16269]: User child is on pid 16271
Nov  1 09:53:15 er-thinkpad sshd[16271]: Starting session: shell on pts/5 for joeuser from 192.168.2.6 port 53349

太棒了，虽然失败了，但是为什么失败了吗？我怎样才能让 sshd 告诉我这个情况？

PS——请注意，这是客户端看到的内容：

debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/joeuser/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Skipping ssh-dss key /home/joeuser/.ssh/id_dsa for not in PubkeyAcceptedKeyTypes
debug1: Offering ECDSA public key: /home/joeuser/.ssh/id_ecdsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/joeuser/.ssh/id_ed25519
debug1: Next authentication method: password

答案1

在服务器端，将日志级别设置为DEBUG3。在客户端，使用选项进行连接（该选项在客户端也-vvv适用）。DEBUG3

相关内容