☰

除非是 root 用户，否则无法通过 SSH 进入 Centos 服务器

tag-icon • tag-icon centos ssh authentication unix ssh-keys
除非是 root 用户，否则无法通过 SSH 进入 Centos 服务器

我有一个数字海洋水滴，目前允许我通过 SSH 直接通过 root 用户登录，因为相关密钥已添加到文件中authorized_keys。

ssh root@master // this works fine and i'm logged in as root

当我尝试以普通非 root 用户身份登录时出现了问题 - 当我运行以下命令时出现以下输出：

注意：我已将“bobby”的相关密钥添加到根 authorized_keys 文件和用户authorized_keys文件中，但无法登录 - 有什么想法吗？

注意-这是在 Centos 服务器上-它不断返回错误 Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

ssh bobby@master -vT

OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to master [123.456.789.111] port 22.
debug1: Connection established.
debug1: identity file /home/bobby/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/bobby/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to master:22 as 'bobby'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:TLaJd7HJk3UVeqzrBgrQq6FfT1P20ZYAO918vRgU9Xg
debug1: Host 'master' is known and matches the ECDSA host key.
debug1: Found key in /home/bobby/.ssh/known_hosts:17
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:1vSLjFQBt1RFnBAwsTqBRE6RWQM0lDyqBdIRblVhkk8 /home/bobby/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Trying private key: /home/bobby/.ssh/id_dsa
debug1: Trying private key: /home/bobby/.ssh/id_ecdsa
debug1: Trying private key: /home/bobby/.ssh/id_ed25519
debug1: No more authentication methods to try.
bobby@master: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

答案1

一般来说：您只能从客户端进行这么多调试；也请检查远程服务器上的日志。

通常，sshd 会记录拒绝访问的原因/var/log/secure。（相当典型的是所有权和权限问题 ~/.ssh/authorized_keys。）

答案2

提供公钥：RSA SHA256：1vSLjFQBt1RFnBAwsTqBRE6RWQM0lDyqBdIRblVhkk8 /home/bobby/.ssh/id_rsa

可以继续的身份验证：publickey、gssapi-keyex、gssapi-with-mic d

这就说明了一切。您仅启用了公钥身份验证。确保您拥有有效的用户授权密钥，因为您的 rsa 被拒绝了。

authorized_keys 应该由用户拥有并 chmod 700

答案3

以 Linux 机器上的 root 身份，检查文件“/etc/ssh/sshd_config”中是否有一行“AllowUsers”。

在那里添加您希望能够使用 SSH 的用户，然后运行“service sshd restart”。

此外，您可能希望将该用户添加到 SUDO'ers。

相关内容