公钥authentication在端口22上失败，但在备用端口上成功

我能够用密码login到我的服务器，但不能用我的公钥。 我正在Rackspace.com服务器上运行CentOS版本6.3（Final）

我将我的本地〜/ .ssh / id_rsa.pub添加到远程服务器的〜/ .ssh / authorized_keys，远程权限似乎没有问题。

$ ll -d . drwxr-x---. 15 fort apache 4096 Feb 22 16:07 . $ ll -d .ssh drwx------. 2 fort apache 4096 Feb 17 19:40 .ssh $ ll -d .ssh/authorized_keys -rw-------. 1 fort fort 2034 Feb 18 06:06 .ssh/authorized_keys 

我检查了服务器正在接受公钥authentication：

 $ ssh -o PreferredAuthentications=none fort@fort Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive). 

用-vvv连接显示失败

• RDP和pinging工作正常，但其他应用程序无法连接
• 债券在主要的失败之后无法启动备份网卡
• Ubuntu 14.04 + libvirt KVM，3个物理nic，3个外部ip，3个子网+内部networking如何？
• 在一个子网上使用绑定接口的主机，为虚拟机设置具有不同公有子网的网桥
• 与主机处于同一个vlan时，KVM访客networking不工作

 $ ssh -vvv -o PreferredAuthentications=publickey fort@fort OpenSSH_7.3p1, LibreSSL 2.4.1 debug1: Reading configuration data /Users/kim/.ssh/config ... debug1: Connecting to cedar.greencitypartnerships.org [108.166.125.240] port 22. debug1: Connection established. ... debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive debug3: preferred publickey debug3: authmethod_lookup publickey debug3: remaining preferred: debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: /Users/kim/.ssh/id_rsa debug3: send_pubkey_test debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 51 ... debug1: No more authentication methods to try. Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive). $ 

这是我在服务器上加载/ var / log / secure时看到的全部内容

 # tail -f /var/log/secure ... Feb 24 06:12:16 fort sshd[3064]: Connection closed by 97.113.252.17 

这是我得到的另一个服务器 – 我可以login到

 # tail -f /var/log/secure ... Feb 23 22:14:12 cedar sshd[2187]: Accepted publickey for cedar from 192.168.56.1 port 53004 ssh2 Feb 23 22:14:12 cedar sshd[2187]: pam_unix(sshd:session): session opened for user cedar by (uid=0) 

然后我尝试在服务器本身上创build一个公钥，将其添加到服务器的〜/ .ssh / authorized_keys中。 我得到了同样的失败

 $ ssh -o PreferredAuthentications=publickey localhost Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive). 

和

 # tail -f /var/log/secure ... Feb 24 06:30:37 fort sshd[3841]: Connection closed by ::1 

接下来，我尝试在另一个端口上以debugging模式运行sshd。 我可以在这个时间login。

  # /usr/sbin/sshd -d -p 27 

和在同一台服务器上…

 $ ssh -p 27 -o PreferredAuthentications=publickey localhost Last login: Fri Feb 24 06:34:37 2017 from 97-113-252-17.tukw.qwest.net Environment: LANG=en_US.UTF-8 USER=fort ... $ 

为了确认sshd没有开始工作，因为我在debugging模式下运行，我正常启动了它。 再次，我能够成功login。

 # /usr/sbin/sshd -p 27 # 

和

 $ ssh -p 27 -o PreferredAuthentications=publickey localhost Last login: Fri Feb 24 06:39:30 2017 from localhost [fort@fort ~]$ 

和

 # tail -f /var/log/secure ... Feb 24 06:46:58 fort sshd[4595]: Server listening on 0.0.0.0 port 27. Feb 24 06:46:58 fort sshd[4595]: Server listening on :: port 27. Feb 24 06:48:13 fort sshd[4629]: Accepted publickey for fort from ::1 port 51302 ssh2 Feb 24 06:48:13 fort sshd[4629]: pam_unix(sshd:session): session opened for user fort by (uid=0) 

我将LogLevel更改为DEBUG，并在端口22和27上重新启动了sshd。

以下是端口22连接失败的地方：

 debug1: trying public key file /home/fort/.ssh/authorized_keys debug1: restore_uid: 0/0 debug1: temporarily_use_uid: 502/502 (e=0/0) debug1: trying public key file /home/fort/.ssh/authorized_keys2 debug1: restore_uid: 0/0 Failed publickey for fort from ::1 port 44994 ssh2 

这是端口27连接成功的地方

 debug1: trying public key file /home/fort/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: matching key found: file /home/fort/.ssh/authorized_keys, line 6 Found matching RSA key: 8f:87:0e:15:b5:88:49:04:b7:34:79:9d:7e:c2:8d:fa 

什么可能允许我使用公共密钥身份validation在端口27，而不是端口22？ 可以使用/etc/init.d/sshd使用的备用设置吗？ 接下来我应该尝试在端口22上获得公钥authentication工作吗？

 $ ls -lZ .ssh/authorized_keys -rw-------. fort fort unconfined_u:object_r:httpd_sys_content_t:s0 .ssh/authorized_keys 

 $ ps axZ | grep /usr/sbin/sshd | grep -v grep unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 505 ? Ss 0:00 /usr/sbin/sshd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 942 ? Ss 0:00 /usr/sbin/sshd -p 27 

 # restorecon -vR .ssh restorecon reset /home/fort/.ssh context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /home/fort/.ssh/authorized_keys context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /home/fort/.ssh/known_hosts context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /home/fort/.ssh/authorized_keys2 context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /home/fort/.ssh/id_rsa.pub context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:ssh_home_t:s0 restorecon reset /home/fort/.ssh/id_rsa context unconfined_u:object_r:httpd_sys_content_t:s0->unconfined_u:object_r:ssh_home_t:s0