我创build了一个虚拟机并安装了Redhat 6.我在使用公钥authentication方面遇到了问题。
我可以在我的Windows主机上使用PuTTY连接到redhat guest，在那里提示input密码。 我正在尝试为root用户设置公钥authentication，所以我创build了一个~/.ssh文件夹，我相信它是正确的权限。
[root@redhat ~]# cd ~/.ssh [root@redhat .ssh]# pwd /root/.ssh [root@redhat .ssh]# ls -la total 16 drwx------. 2 root root 4096 Aug 21 16:28 . dr-x------. 3 root root 4096 Aug 20 17:20 .. -rw-r--r--. 1 root root 250 Aug 20 17:20 authorized_keys -rw-r--r--. 1 root root 391 Aug 21 16:28 known_hosts
我正在运行我的私人密钥装载，这是成功的与其他主机，所以我不认为这是问题。
当我尝试对VM guest虚拟机进行PuTTY时，系统提示input密码。
如果我检查PuTTY事件日志，我发现以下消息。
2012-08-21 17:29:41 Pageant is running. Requesting keys. 2012-08-21 17:29:41 Pageant has 1 SSH-2 keys 2012-08-21 17:29:46 Trying Pageant key #0 2012-08-21 17:29:46 Server refused our key
我启用了代理转发function，有一件事我偶然发现，有人build议在debugging模式下运行另一个sshd副本，我试过了。 （我剪掉了部分输出以保持这个简短）。
[root@redhat ~]# /usr/sbin/sshd -d -p 2222 debug1: sshd version OpenSSH_5.3p1 debug1: read PEM private key done: type RSA debug1: private host key: #0 type 1 RSA debug1: read PEM private key done: type DSA debug1: private host key: #1 type 2 DSA <...> debug1: Bind to port 2222 on 0.0.0.0. Server listening on 0.0.0.0 port 2222. <...>
此时，我使用命令ssh localhost -p 2222从vm上的另一个会话进行连接
<...> Connection from ::1 port 36844 debug1: Client protocol version 2.0; client software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 <...> debug1: userauth-request for user root service ssh-connection method none debug1: attempt 0 failures 0 debug1: PAM: initializing for "root" debug1: PAM: setting PAM_RHOST to "localhost" debug1: userauth-request for user root service ssh-connection method publickey debug1: attempt 1 failures 0 debug1: test whether pkalg/pkblob are acceptable debug1: PAM: setting PAM_TTY to "ssh" debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: trying public key file /root/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: matching key found: file /root/.ssh/authorized_keys, line 1 Found matching RSA key: <snip> debug1: restore_uid: 0/0 Postponed publickey for root from ::1 port 36844 ssh2 debug1: userauth-request for user root service ssh-connection method publickey debug1: attempt 2 failures 0 debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: trying public key file /root/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: matching key found: file /root/.ssh/authorized_keys, line 1 Found matching RSA key: <snip> debug1: restore_uid: 0/0 debug1: ssh_rsa_verify: signature correct debug1: do_pam_account: called Accepted publickey for root from ::1 port 36844 ssh2 debug1: monitor_child_preauth: root has been authenticated by privileged process <...>
在这一点上，我已经使用我的公钥成功validation了身份，并通过按下Ctrl-D注销。
debug1: Received SIGCHLD. <...> Received disconnect from ::1: 11: disconnected by user <...> [root@redhat ~]#
所以奇怪的是，使用SSH代理转发就足以成功地对在debugging模式下运行的sshd进行身份validation，而不是在端口22上运行的“普通”sshd。
有没有人有任何想法，为什么会这样？
谢谢！
/root/.ssh目录中的SELinux上下文很可能是错误的。
用以下方法validation问题：
ls -alZ /root/.ssh
这些文件的types应该是ssh_home_t 。
解决这个问题：
restorecon -r -v /root/.ssh