就像这家伙，当我尝试添加 ssh 密钥时，我开始收到一条错误消息：
Supplied fingerprint does not match current metadata fingerprint
当我尝试将密钥添加到
- 特定虚拟机实例的详细信息（使用 Web 界面）
- 共享元数据（使用 Web 界面）
我也不知道Permission denied (publickey).是否可以使用username@instance或username_mycomp_com@instance登录。我和我所有的同事都无法再使用 ssh web 登录，这意味着我们已经被锁定在自己的服务器之外了！
我只能将此归因于运行gcloud compute os-login ssh-keys add命令，它的影响似乎比它所说的还要大。
可能影响此问题的其他命令
gcloud compute ssh
$ gcloud compute ssh dev-mycomp-no
WARNING: The public SSH key file for gcloud does not exist.
WARNING: The private SSH key file for gcloud does not exist.
WARNING: You do not have an SSH key for gcloud.
WARNING: SSH keygen will be executed to generate a key.
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/carlerik/.ssh/google_compute_engine.
Your public key has been saved in /home/carlerik/.ssh/google_compute_engine.pub.
The key fingerprint is:
SHA256:cicl5t/5mDmIocrkDopK2C6Rf9OvT7FhKAh9GEMPFd8 carlerik@ubuntu
The key's randomart image is:
+---[RSA 2048]----+
| .=.o. |
| . * . . |
|. o o . E . |
| . o + o |
| .. . o S . |
|+. . +.B . . |
|.+o .. .oo..o |
|+o.=o o.. . .= |
|=..o=o.+o +.. |
+----[SHA256]-----+
No zone specified. Using zone [europe-west1-b] for instance: [dev-mycomp-no].
WARNING: Using OS Login user [carlerik_mycomp_com] instead of default user [carlerik]
Warning: Permanently added 'compute.7727415340568554709' (ECDSA) to the list of known hosts.
[email protected]: Permission denied (publickey).
ERROR: (gcloud.compute.ssh) [/usr/bin/ssh] exited with return code [255].
gcloud compute os-login ssh-keys add
gcloud compute os-login ssh-keys add --key-file ~/.ssh/id_rsa.pub | stack-overflow
loginProfile:
name: '111200762294302015941'
posixAccounts:
- accountId: charged-foo-162409
gid: '438632669'
homeDirectory: /home/myuser_mycomp_com
operatingSystemType: LINUX
primary: true
uid: '438632669'
username: myuser_mycomp_com
sshPublicKeys:
f7fd01c562d4edb7292eada91dfb2213ef2344f9db605eedc65ac08cea39327e:
fingerprint: f7fd01c562d4edb7292eada91dfb2213ef2344f9db605eedc65ac08cea39327e
key: |
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtB10ag2fipH7Cnls3gZvl5eBJx0OvQaLu7hndL5sif3m4CTGmrN/MuP0lei0Rt23cBy5Ey2DqAjmizCAhdc3jSQm0pXisKG92Juo2HxiJw+eMUucoPhjbEy35sKKrru2//5uPpK5IEeVEve3bIXCAQUQgyOESmHBgXmKSCz0jQXEvcV8GxxkdXK7/UQVSe5wtxzPHOoP+foobar+bjHXnQkiqk5oDeP3ewPorrvxbOeOcqk0b1qrAQYSXHqXv6lENfWIceIz1EsZlRsIV i9-mycomp
gcloud compute instances add-metadata the-instance --metadata enable-oslogin=TRUE
在指南中看到这个。假设这将使额外的登录方式。现在回想起来，我根本不知道这有什么用。
调试信息
$ gcloud compute os-login describe-profile
name: '111200762294302015941'
posixAccounts:
- gid: '726506529'
homeDirectory: /home/myuser_mycomp_com
operatingSystemType: LINUX
primary: true
uid: '726506529'
username: myuser_mycomp_com
- accountId: foo-mission-162409
gid: '438632669'
homeDirectory: /home/myuser_mycomp_com
operatingSystemType: LINUX
primary: true
uid: '438632669'
username: myuser_mycomp_com
sshPublicKeys:
3573aef91758f9706a884bffc95502ea5f31bbfab7a33d58be8abd9a84f53808:
fingerprint: 3573aef91758f9706a884bffc95502ea5f31bbfab7a33d58be8abd9a84f53808
key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCaISFI0hCDMK5SIqIBlsboBQTBCoW98bvjUjoCDn9S4kXSOtVvwNeXc/Kb+9lXqKR8CbtYgOZySPqI+5VADdAIcfot2S65Fq5qOQ1IH7Uo29nzvhyjfRbckAs3gaTF6uzxEA0THqyAZ1oGIyK3vDI8W/Ofczi08oIYWpMmWA8dQNQuKRujloDuFElpjZEjbEyfkn/e7iSm1VxZ8aLEw7M3/BsJLmtwxa+tYyTAfKx63NRFbSWf873GLOyAKCnE5ls27ftlTjDJMISI3RZd1KMdyg+6KAwN7YsCTwJXarNXr9v2GcY8lrpC7dQ/lGK1nBsPa0kOSYKQzJ0LIDxfOan
myuser@ubuntu
答案1
禁用 os-login 后我可以再次登录：
gcloud compute instances add-metadata dev-diffia-no --metadata enable-oslogin=FALSE
答案2
我在启用 OS Login 时遇到了类似的问题，我的密钥被旧的 debian jessie 实例拒绝。
症状如下：
Permission denied (publickey)命令行上出现以下错误消息Using OS Login user，Received malformed response from server模块日志中的错误消息nss_oslogin。
解决方案是从适当的存储库更新以下软件包：
- google-compute-engine
- google-compute-engine-oslogin
- python-google-计算引擎
- python3-google-计算引擎
前：
# dpkg -l | grep google
ii google-cloud-packages-archive-keyring 1.2-1 all Contains GPG signing key for Google Cloud Packages
ii google-cloud-sdk 253.0.0-0 all Utilities for the Google Cloud Platform
ii google-compute-engine 2.5.2-4 all google-compute-engine transitional package
ii google-compute-engine-init-jessie 2.1.3-0.1503598199 amd64 Google Compute Engine Linux initialization scripts
ii google-compute-engine-jessie 2.5.2-0.1502923259 all Google Compute Engine
ii google-compute-engine-oslogin 1.0.2-1+deb8 amd64 Google Compute Engine OS Login
ii google-config-jessie 2.1.2-0.1484936429 amd64 Google Compute Engine Linux guest configuration
后：
# dpkg -l | grep google
ii google-cloud-packages-archive-keyring 1.2-1 all Contains GPG signing key for Google Cloud Packages
ii google-cloud-sdk 253.0.0-0 all Utilities for the Google Cloud Platform
ii google-compute-engine 2.8.16-1 all Google Compute Engine guest environment.
ii google-compute-engine-oslogin 1.4.3-1+deb8 amd64 Google Compute Engine OS Login
rc google-config-jessie 2.1.2-0.1484936429 amd64 Google Compute Engine Linux guest configuration
ii python-google-compute-engine 2.8.16-1 all Google Compute Engine python library for Python 2.x.
ii python3-google-compute-engine 2.8.16-1 all Google Compute Engine python library for Python 3.x.
为了连接到此实例以执行更新，您需要通过设置enable-oslogin=FALSE实例的元数据来暂时禁用 OS Login如@oligofren 的回答所述。
然后确保它存在于/etc/apt/sources.list.d/google-cloud.list（可能还有其他行）：
deb http://packages.cloud.google.com/apt google-compute-engine-jessie-stable main
并执行更新：
# sudo apt install --reinstall google-compute-engine google-compute-engine-oslogin python-google-compute-engine python3-google-compute-engine
然后您可以为该实例重新启用 OS Login。