我已经用cygwin ssh-keygen生成rsa密钥，并将它们复制到服务器上
ssh-copy-id -i id_rsa.pub [email protected] 我在/ etc / ssh / sshd_config文件中有以下设置
RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys PermitRootLogin yes
当我ssh [email protected]它仍然提示input密码。
从/usr/sbin/sshd -d下面的输出表示在.ssh / authorized_keys文件中find了匹配键，但仍需要客户端的密码。
我已经阅读了一堆关于文件和目录的权限的网页张贴，但没有任何作品。 是否有可能在RHEL 6.1中使用密钥进行ssh或禁止？
从ssh和sshd的debugging输出如下。
$ ssh -v [email protected] OpenSSH_6.1p1, OpenSSL 1.0.1c 10 May 2012 debug1: Connecting to my.ip.address [my.ip.address] port 22. debug1: Connection established. debug1: identity file /home/dschulze/.ssh/id_rsa type 1 debug1: identity file /home/dschulze/.ssh/id_rsa-cert type -1 debug1: identity file /home/dschulze/.ssh/id_dsa type 2 debug1: identity file /home/dschulze/.ssh/id_dsa-cert type -1 debug1: identity file /home/dschulze/.ssh/id_ecdsa type -1 debug1: identity file /home/dschulze/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH_5* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: RSA 9f:00:e0:1e:a2:cd:05:53:c8:21:d5:69:25:80:39:92 debug1: Host 'my.ip.address' is known and matches the RSA host key. debug1: Found key in /home/dschulze/.ssh/known_hosts:3 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/dschulze/.ssh/id_rsa debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Offering DSA public key: /home/dschulze/.ssh/id_dsa debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Trying private key: /home/dschulze/.ssh/id_ecdsa debug1: Next authentication method: password
这里是/ usr / sbin / sshd -d的服务器输出
[root@ga2-lab .ssh]# /usr/sbin/sshd -d debug1: sshd version OpenSSH_5.3p1 debug1: read PEM private key done: type RSA debug1: private host key: #0 type 1 RSA debug1: read PEM private key done: type DSA debug1: private host key: #1 type 2 DSA debug1: rexec_argv[0]='/usr/sbin/sshd' debug1: rexec_argv[1]='-d' debug1: Bind to port 22 on 0.0.0.0. Server listening on 0.0.0.0 port 22. debug1: Bind to port 22 on ::. Server listening on :: port 22. debug1: Server will not fork when running in debugging mode. debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8 debug1: inetd sockets after dupping: 3, 3 Connection from 172.60.254.24 port 53401 debug1: Client protocol version 2.0; client software version OpenSSH_6.1 debug1: match: OpenSSH_6.1 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug1: permanently_set_uid: 74/74 debug1: list_hostkey_types: ssh-rsa,ssh-dss debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: client->server aes128-ctr hmac-md5 none debug1: kex: server->client aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: KEX done debug1: userauth-request for user root service ssh-connection method none debug1: attempt 0 failures 0 debug1: PAM: initializing for "root" debug1: userauth-request for user root service ssh-connection method publickey debug1: attempt 1 failures 0 debug1: test whether pkalg/pkblob are acceptable debug1: PAM: setting PAM_RHOST to "172.60.254.24" debug1: PAM: setting PAM_TTY to "ssh" debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: trying public key file /root/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: matching key found: file /root/.ssh/authorized_keys, line 1 Found matching RSA key: db:b3:b9:b1:c9:df:6d:e1:03:5b:57:d3:d9:c4:4e:5c debug1: restore_uid: 0/0 Postponed publickey for root from 172.60.254.24 port 53401 ssh2 debug1: userauth-request for user root service ssh-connection method publickey debug1: attempt 2 failures 0 debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: trying public key file /root/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: matching key found: file /root/.ssh/authorized_keys, line 1 Found matching RSA key: db:b3:b9:b1:c9:df:6d:e1:03:5b:57:d3:d9:c4:4e:5c debug1: restore_uid: 0/0 debug1: ssh_rsa_verify: signature correct debug1: do_pam_account: called Accepted publickey for root from 172.60.254.24 port 53401 ssh2 debug1: monitor_child_preauth: root has been authenticated by privileged process debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism debug1: restore_uid: 0/0 debug1: SELinux support enabled debug1: PAM: establishing credentials PAM: pam_open_session(): Authentication failure debug1: Entering interactive session for SSH2. debug1: server_init_dispatch_20 debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 debug1: input_session_request debug1: channel 0: new [server-session] debug1: session_new: session 0 debug1: session_open: channel 0 debug1: session_open: session 0: link with channel 0 debug1: server_input_channel_open: confirm session debug1: server_input_global_request: rtype [email protected] want_reply 0 debug1: server_input_channel_req: channel 0 request pty-req reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req pty-req debug1: Allocating pty. debug1: session_pty_req: session 0 alloc /dev/pts/1 ssh_selinux_setup_pty: security_compute_relabel: Invalid argument debug1: server_input_channel_req: channel 0 request shell reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req shell debug1: Setting controlling tty using TIOCSCTTY. debug1: Received SIGCHLD. debug1: session_by_pid: pid 17323 debug1: session_exit_message: session 0 channel 0 pid 17323 debug1: session_exit_message: release channel 0 debug1: session_pty_cleanup: session 0 release /dev/pts/1 debug1: session_by_channel: session 0 channel 0 debug1: session_close_by_channel: channel 0 child 0 debug1: session_close: session 0 pid 0 debug1: channel 0: free: server-session, nchannels 1 Received disconnect from 172.60.254.24: 11: disconnected by user debug1: do_cleanup debug1: PAM: cleanup debug1: PAM: deleting credentials
这里是/etc/pam.d/sshd的内容：
#%PAM-1.0 auth required pam_sepermit.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional pam_keyinit.so force revoke session include password-auth
这是ls -lah .ssh的输出
[root@ga2-lab ~]# ls -lah .ssh total 12K drwxr-xr-x. 2 root root 4.0K Dec 11 14:09 . drwxr-xr-x. 3 root root 4.0K Dec 11 14:08 .. -rw-------. 1 root root 399 Dec 11 14:09 authorized_keys
在RHEL 6.5上安装Gitlab 6.4后，我遇到了同样的问题。 无论我做了什么，我都无法使用公钥为主系统用户（git）使用SSH。 再次，SSH密钥是好的，就像〜/ .ssh（700）和〜/ .ssh / authorized_keys（600）上的权限一样。 问题是seliunx是“执行”，而.ssh目录中的上下文是错误的，可能是因为用户是作为系统用户创build的。 你可以修改为@ Dean-Schulze通过将用户更改为普通用户，但我设法修复受影响的用户的上下文使用restorecon命令，这可能会解决您遇到的问题。
检查selinux是否正在执行
sestatus
使用检查上下文
ls -laZ ~/.ssh
我发现“types”上下文需要是“ssh_home_t”
修复ssh目录login / su作为受影响的用户，然后运行
restorecon -R -v ~/.ssh
如果这不起作用，您可能需要修复用户主目录中的上下文
restorecon -R -v ~/
在/var/log/audit/audit.log中拒绝〜。/ ssh如下所示：
type=AVC msg=audit(1355348670.326:87): avc: denied { read } for pid=1490 comm="sshd" name="authorized_keys" dev=dm-1 ino=277466 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
SELinux是否启用？
getenforce
〜/ .ssh的上下文是什么？ 手动创build的目录可能不正确。
# ls -alZd .ssh/ drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 .ssh/
但是在做一个重新标记或设置合适的上下文之后应该有。
# ls -alZd .ssh/ drwx------. root root system_u:object_r:ssh_home_t:s0 .ssh/
或者禁用SELinux / set许可:)
公钥失效通常是由于authorized_keys文件上的文件权限不正确造成的。 确保它被修改为644。
我曾多次遇到这个“问题”。 问题不仅在于文件authorized_keys的权限，还需要正确设置目录“.ssh”和“..”（用户的主目录）的权限。 问题将通过设置像这样的权限解决：700至.ssh，至less754到“..”和600到文件authorized_keys：
# ls -lah .ssh drwx------. 2 root root 4.0K Dec 11 14:09 . drwxr-xr--. 3 root root 4.0K Dec 11 14:08 .. -rw-------. 1 root root 399 Dec 11 14:09 authorized_keys
公钥失效通常是由于authorized_keys文件上的文件权限不正确造成的。 确保它被修改为644：
chmod 644 /root/.ssh/authorized_keys
如果没有解决问题，请尝试检查服务器端/var/log/secure文件中的错误消息。
最后还有一个线索表明SELinux可能会阻塞你的输出：
ssh_selinux_setup_pty：security_compute_relabel：无效的参数
在SELinux日志中可能有这个消息的解释： /var/log/audit/audit.log 。
我通过添加另一个用户来解决这个问题，然后更改Tomcat的webapp /目录为常规用户所有。 那个普通用户没有用密钥进行身份validation的问题，用户可以通过ssh和scp执行命令（远程重新部署到Tomcat）。
RHEL所需的另一个安全防范措施是禁用Tomcatpipe理器应用程序，这样我无法通过Tomcatpipe理器进行远程部署。 （我尝试添加pipe理器应用程序，并设置pipe理员和pipe理员用户，但pipe理器应用程序不会“运行）。