☰

ssh-copy-id成功，但仍提示輸入密碼

tag-icon • tag-icon ssh password authentication sshd
ssh-copy-id成功，但仍提示輸入密碼
  1. 我ssh-copy-id root@c199以前也成功過。
  2. ssh root@c199我可以在沒有密碼提示的情況下登入
  3. 我想由另一個用戶自動登入ufo （遠端機器有這個用戶）

  4. ssh-copy-id ufo@c199 要求我輸入密碼，

    /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
ufo@c199's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'ufo@c199'"
and check to make sure that only the key(s) you wanted were added.

  5. 但登入ssh ufo@c199仍提示輸入密碼。

我嘗試透過 ssh 登入 msys2（在 Windows 上）上的遠端 centos ，我發現有很多相同的行，例如

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCs7RTfvn83Rxdmvgfh+F4kUlM5FzIUb9rRHaqq11xKIW1gztn/+G4tr+OWl4o6GTW2Z361hIi
ugy8DPtMATN66nTTDUYO0sSvw2BrQfDY4iIENdLpkkHO8KQVGpQE+8tDkaZfD6EQLVtl0uvDE3D77tfcnBLODXgZPQsUSlssMi+pxDbSVjjKgrP
hM1G/L9OTrEHKWDhF+ZBgY1RuLl7ZEdoATbhJaK4FFb9hNn/2CSibVfLts8HJGYQXIQRX/RBzaDZp47sKZvq302ewkkVorNY+c9mmoze6mi8Ip2
zEQOMi6S9zM/yRiD0XZrbmzYfNkoXA03WTmMR/DynVvX2nV /c/Users/xxxx/.ssh/id_rsa

在centos中/home/ufo/.ssh/authorized_keys，

我已將 .ssh 使用者的資料夾權限變更為 700 ，將authorized_keys 檔案變更為 644 。

相同的 ssh 金鑰，ssh root@c199無提示登錄，但ssh ufo@c199提示輸入密碼..

更新

ssh ufo@c199 -vv輸出：

....
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:zmCg5vHhBAMd5P4ei82+KsVg072KXbC63C44P0w3zbU
debug1: Host 'c199' is known and matches the ECDSA host key.
debug1: Found key in /c/Users/xxxxx/.ssh/known_hosts:35
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /c/Users/xxxxx/.ssh/id_rsa (0x60006bec0), agent
debug2: key: /c/Users/xxxxx/.ssh/id_dsa (0x0)
debug2: key: /c/Users/xxxxx/.ssh/id_ecdsa (0x0)
debug2: key: /c/Users/xxxxx/.ssh/id_ed25519 (0x0)
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /c/Users/xxxxx/.ssh/id_rsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /c/Users/xxxxx/.ssh/id_dsa
debug1: Trying private key: /c/Users/xxxxx/.ssh/id_ecdsa
debug1: Trying private key: /c/Users/xxxxx/.ssh/id_ed25519
debug2: we did not send a packet, disable method
debug1: Next authentication method: password

答案1

謝謝https://unix.stackexchange.com/a/55481/106419，它告訴我如何調試 ssh。

啟用 ssh 調試看看會發生什麼

systemctl stop sshd
/usr/sbin/sshd -d -p 22

我發現：

Authentication refused: bad ownership or modes for directory /home/ufo

所有的人只告訴：

  • /home/ufo/.ssh所有權正確 700
  • /home/ufo/.ssh/authorized_keys所有權正確 600/644

但 sshd 仍然檢查用戶主資料夾！沒有人提到這一點！

sudo chmod 700 /home/ufo解決這個問題。

概括：

您需要確保：

  • /home/ufo所有權為 700
  • /home/ufo/.ssh所有權為 700
  • /home/ufo/.ssh/authorized_keys 所有權為 600

將 ufo 更改為您的主資料夾名稱

答案2

我必須將以下內容添加到我的sshd_config文件中：

PubkeyAcceptedKeyTypes=+ssh-dss

然後重新啟動sshd。

答案3

顯然您沒有在用戶 ufo 的authorized_keys 檔案中新增條目......或 ~ufo/.ssh 檔案/目錄的權限錯誤。

答案4

這是另一種解決方案，以防您無法按照 millican 在答案中的建議存取或修改 sshd_config 。解決方案是使用 ED25519 演算法建立新的 SSH 金鑰：

ssh-keygen -t ed25519 -C "[email protected]"

正如所解釋的這裡。這解決了我的問題，該問題是由於 RSA SHA-1 雜湊演算法已被棄用而引起的。

相關內容