我有點被困在這裡了..
我正在嘗試停用 root 的所有 SSH 登入功能。無需密碼登入。沒有基於密鑰的登入。沒有什麼。我有一個用戶“andrew”，他只能使用私鑰透過 SSH 存取我的伺服器。
這是我到目前為止所做的：
(on my laptop) ssh-keygen -b 4096 -t rsa
(on my laptop) cat id_rsa.pub | ssh [email protected] "cat >> /home/andrew/.ssh/authorized_keys"
(on my server) Modified /etc/ssh/sshd_config in the following ways:
- PermitRootLogin no
- PasswordAuthentication no
- AuthorizedKeysFile /home/%h/.ssh/authorized_keys
(on my server) reload ssh
當我嘗試從筆記型電腦連接到伺服器時，我收到以下資訊（錯誤即將結束）：
andrew@andrew-asus ~/.ssh $ ssh -vvv -i id_rsa [email protected]
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to server.com [XXXXXXXXX] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "id_rsa" as a RSA1 public key
debug1: identity file id_rsa type 1
debug1: identity file id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "server.com" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup [email protected]
debug1: kex: server->client aes128-ctr [email protected] none
debug2: mac_setup: setup [email protected]
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 50:4a:6c:d9:62:82:c6:59:32:55:b9:43:09:8d:7b:07
debug3: load_hostkeys: loading entries for host "server.com" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "XXXXXXXX" from file "/home/andrew/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/andrew/.ssh/known_hosts:3
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'server.com' is known and matches the ECDSA host key.
debug1: Found key in /home/andrew/.ssh/known_hosts:2
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: id_rsa (0x7f7c55f5cda0), explicit
debug2: key: andrew@andrew-asus (0x7f7c55f61950),
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: andrew@andrew-asus
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
這是我在電腦上運行的連接命令：
(inside the ~/.ssh dir) ssh -vvv -i id_rsa [email protected]
我嘗試過使用 ssh-copy-id。我嘗試重新建立我的金鑰對。刪除伺服器上的“authorized_keys”條目。刪除筆記型電腦上的「known_hosts」條目。我迷路了。
以下是伺服器上 sshd_config 檔案的完整副本：
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile /home/%h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
感謝任何可以幫助我的人。
編輯：這是當 sshd 在調試登入模式下運行時我的 auth.log 檔案的輸出。看起來它找不到我的“authorized_keys”檔案。
May 21 22:29:47 server sshd[13613]: debug1: Bind to port 22 on 0.0.0.0.
May 21 22:29:47 server sshd[13613]: Server listening on 0.0.0.0 port 22.
May 21 22:29:47 server sshd[13613]: debug1: Bind to port 22 on ::.
May 21 22:29:47 server sshd[13613]: Server listening on :: port 22.
May 21 22:29:50 server sshd[13613]: debug1: Forked child 13615.
May 21 22:29:50 server sshd[13615]: Set /proc/self/oom_score_adj to 0
May 21 22:29:50 server sshd[13615]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
May 21 22:29:50 server sshd[13615]: debug1: inetd sockets after dupping: 3, 3
May 21 22:29:50 server sshd[13615]: Connection from XXXXXXXXXX port 4446 on XXXXXXXX port 22
May 21 22:29:50 server sshd[13615]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 22:29:50 server sshd[13615]: debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
May 21 22:29:50 server sshd[13615]: debug1: Enabling compatibility mode for protocol 2.0
May 21 22:29:50 server sshd[13615]: debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 22:29:50 server sshd[13615]: debug1: permanently_set_uid: 104/65534 [preauth]
May 21 22:29:50 server sshd[13615]: debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_KEXINIT sent [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_KEXINIT received [preauth]
May 21 22:29:50 server sshd[13615]: debug1: kex: client->server aes128-ctr [email protected] none [preauth]
May 21 22:29:50 server sshd[13615]: debug1: kex: server->client aes128-ctr [email protected] none [preauth]
May 21 22:29:50 server sshd[13615]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
May 21 22:29:50 server sshd[13615]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
May 21 22:29:50 server sshd[13615]: debug1: SSH2_MSG_NEWKEYS received [preauth]
May 21 22:29:50 server sshd[13615]: debug1: KEX done [preauth]
May 21 22:29:51 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method none [preauth]
May 21 22:29:51 server sshd[13615]: debug1: attempt 0 failures 0 [preauth]
May 21 22:29:51 server sshd[13615]: debug1: PAM: initializing for "andrew"
May 21 22:29:51 server sshd[13615]: debug1: PAM: setting PAM_RHOST to "XXXXXXXXXX"
May 21 22:29:51 server sshd[13615]: debug1: PAM: setting PAM_TTY to "ssh"
May 21 22:29:51 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 22:29:51 server sshd[13615]: debug1: attempt 1 failures 0 [preauth]
May 21 22:29:51 server sshd[13615]: debug1: test whether pkalg/pkblob are acceptable [preauth]
May 21 22:29:51 server sshd[13615]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 22:29:51 server sshd[13615]: debug1: trying public key file /home//home/andrew/.ssh/authorized_keys
May 21 22:29:51 server sshd[13615]: debug1: Could not open authorized keys '/home//home/andrew/.ssh/authorized_keys': No such file or directory
May 21 22:29:51 server sshd[13615]: debug1: restore_uid: 0/0
May 21 22:29:51 server sshd[13615]: Failed publickey for andrew from XXXXXXXXX port 4446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 22:29:54 server sshd[13615]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 22:29:54 server sshd[13615]: debug1: attempt 2 failures 1 [preauth]
May 21 22:29:54 server sshd[13615]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 22:29:54 server sshd[13615]: debug1: trying public key file /home//home/andrew/.ssh/authorized_keys
May 21 22:29:54 server sshd[13615]: debug1: Could not open authorized keys '/home//home/andrew/.ssh/authorized_keys': No such file or directory
May 21 22:29:54 server sshd[13615]: debug1: restore_uid: 0/0
May 21 22:29:54 server sshd[13615]: Failed publickey for andrew from XXXXXXXX port 4446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 22:29:54 server sshd[13615]: Connection closed by XXXXXXXXX [preauth]
May 21 22:29:54 server sshd[13615]: debug1: do_cleanup [preauth]
May 21 22:29:54 server sshd[13615]: debug1: monitor_read_log: child log fd closed
May 21 22:29:54 server sshd[13615]: debug1: do_cleanup
May 21 22:29:54 server sshd[13615]: debug1: PAM: cleanup
May 21 22:29:54 server sshd[13615]: debug1: Killing privsep child 13616
May 21 22:30:01 server sshd[13613]: Received signal 15; terminating.
編輯#2：看起來像是對「authorized_keys」檔案具有權限的東西。 sshd 現在可以找到它，但無法打開它。這是日誌：
May 21 23:06:58 server sshd[3880]: debug1: Forked child 3975.
May 21 23:06:58 server sshd[3975]: Set /proc/self/oom_score_adj to 0
May 21 23:06:58 server sshd[3975]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
May 21 23:06:58 server sshd[3975]: debug1: inetd sockets after dupping: 3, 3
May 21 23:06:58 server sshd[3975]: Connection from XXXXXXXXX port 53446 on 96.126.115.73 port 22
May 21 23:06:58 server sshd[3975]: debug1: Client protocol version 2.0; client software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 23:06:58 server sshd[3975]: debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
May 21 23:06:58 server sshd[3975]: debug1: Enabling compatibility mode for protocol 2.0
May 21 23:06:58 server sshd[3975]: debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
May 21 23:06:58 server sshd[3975]: debug1: permanently_set_uid: 104/65534 [preauth]
May 21 23:06:58 server sshd[3975]: debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_KEXINIT sent [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_KEXINIT received [preauth]
May 21 23:06:58 server sshd[3975]: debug1: kex: client->server aes128-ctr [email protected] none [preauth]
May 21 23:06:58 server sshd[3975]: debug1: kex: server->client aes128-ctr [email protected] none [preauth]
May 21 23:06:58 server sshd[3975]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
May 21 23:06:58 server sshd[3975]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
May 21 23:06:58 server sshd[3975]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
May 21 23:06:59 server sshd[3975]: debug1: SSH2_MSG_NEWKEYS received [preauth]
May 21 23:06:59 server sshd[3975]: debug1: KEX done [preauth]
May 21 23:06:59 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method none [preauth]
May 21 23:06:59 server sshd[3975]: debug1: attempt 0 failures 0 [preauth]
May 21 23:07:02 server sshd[3975]: debug1: PAM: initializing for "andrew"
May 21 23:07:02 server sshd[3975]: debug1: PAM: setting PAM_RHOST to "XXXXXX"
May 21 23:07:02 server sshd[3975]: debug1: PAM: setting PAM_TTY to "ssh"
May 21 23:07:02 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 23:07:02 server sshd[3975]: debug1: attempt 1 failures 0 [preauth]
May 21 23:07:02 server sshd[3975]: debug1: test whether pkalg/pkblob are acceptable [preauth]
May 21 23:07:02 server sshd[3975]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 23:07:02 server sshd[3975]: debug1: trying public key file /home/andrew/.ssh/authorized_keys
May 21 23:07:02 server sshd[3975]: debug1: Could not open authorized keys '/home/andrew/.ssh/authorized_keys': Permission denied
May 21 23:07:02 server sshd[3975]: debug1: restore_uid: 0/0
May 21 23:07:02 server sshd[3975]: Failed publickey for andrew from XXXXXXX port 53446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 23:07:06 server sshd[3975]: debug1: userauth-request for user andrew service ssh-connection method publickey [preauth]
May 21 23:07:06 server sshd[3975]: debug1: attempt 2 failures 1 [preauth]
May 21 23:07:06 server sshd[3975]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
May 21 23:07:06 server sshd[3975]: debug1: trying public key file /home/andrew/.ssh/authorized_keys
May 21 23:07:06 server sshd[3975]: debug1: Could not open authorized keys '/home/andrew/.ssh/authorized_keys': Permission denied
May 21 23:07:06 server sshd[3975]: debug1: restore_uid: 0/0
May 21 23:07:06 server sshd[3975]: Failed publickey for andrew from XXXXXXX port 53446 ssh2: RSA 33:63:b9:9d:a2:19:b4:24:9b:88:31:6b:b4:9f:15:f5
May 21 23:07:07 server sshd[3975]: Connection closed by XXXXXXXXXX [preauth]
May 21 23:07:07 server sshd[3975]: debug1: do_cleanup [preauth]
May 21 23:07:07 server sshd[3975]: debug1: monitor_read_log: child log fd closed
May 21 23:07:07 server sshd[3975]: debug1: do_cleanup
May 21 23:07:07 server sshd[3975]: debug1: PAM: cleanup
May 21 23:07:07 server sshd[3975]: debug1: Killing privsep child 3976
答案1
看起來您的authorized_keys 檔案無效。您在以 root 身分連接到伺服器時執行了 cat 命令，因此該檔案將由 root 帳戶擁有，而不是 andrew。你需要
chown andrew /home/andrew/.ssh/authorized_keys
另外，為了將來的參考，您最好包括（並查看）打開調試輸出的伺服器的 SSHD 日誌輸出。
[編輯]
該行：
AuthorizedKeysFile /home/%h/.ssh/authorized_keys
也是錯誤的。 %h 已包含主目錄的完整路徑，因此您實際上指定了 /home/home/username/.ssh。
您確實不應該修改此設定。當您註解掉該行時獲得的預設值很好並且已經完成了您想要的操作。或者，如果您想明確指定，請使用
AuthorizedKeysFile %h/.ssh/authorized_keys
或者
AuthorizedKeysFile /home/%u/.ssh/authorized_keys
答案2
請記住 sshd 使用 StrictMode 強制執行的預設權限。參見第二個答案在這篇文章中 以獲得更詳細的解釋。
答案3
問題解決了，感謝我的同事。這是我必須做的：
chown 的/home/andrew/.ssh目錄andrew
chmod 該/home/andrew/.ssh目錄如下：
drwx------ 2 andrew root 4.0K May 21 18:03 .ssh
/home/andrew/.ssh/authorized_keys將目錄中的檔案chmod/home/andrew/.ssh為以下內容：
-rw-r--r-- 1 andrew root 745 May 21 22:21 authorized_keys
訣竅是授予其他使用者對該authorized_keys文件的讀取權限。
感謝所有幫助我解決這個問題的人！