我有两台机器在谷歌计算引擎,我想ssh的另一台服务器。 因此,在第一台机器(namenode)上,我为用户hadoop创build了一个无密码的ssh密钥,并创build了一个cat id_rsa.pub >> authorized_keys。 在第二台机器(datanode1)上还有一个名为hadoop的用户。 第二台机器的hadoop用户有一个空的〜/ .ssh目录。
当我现在尝试从第一台机器ssh到第二台机器时,我得到:
hadoop@namenode:~/.ssh$ ssh -v hadoop@datanode1 OpenSSH_6.0p1 Debian-4, OpenSSL 1.0.1e 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to datanode1 [10.240.223.55] port 22. debug1: Connection established. debug1: identity file /home/hadoop/.ssh/id_rsa type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file /home/hadoop/.ssh/id_rsa-cert type -1 debug1: identity file /home/hadoop/.ssh/id_dsa type -1 debug1: identity file /home/hadoop/.ssh/id_dsa-cert type -1 debug1: identity file /home/hadoop/.ssh/id_ecdsa type -1 debug1: identity file /home/hadoop/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4 debug1: match: OpenSSH_6.0p1 Debian-4 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA 10:54:3e:ec:07:58:48:85:28:40:90:43:e1:8f:3d:f0 debug1: Host 'datanode1' is known and matches the ECDSA host key. debug1: Found key in /home/hadoop/.ssh/known_hosts:1 debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/hadoop/.ssh/id_rsa debug1: Authentications that can continue: publickey debug1: Trying private key: /home/hadoop/.ssh/id_dsa debug1: Trying private key: /home/hadoop/.ssh/id_ecdsa debug1: No more authentication methods to try. Permission denied (publickey).
我不明白这里发生了什么事。
更新:我没有将id_rsa.pub复制到目标服务器上的authorized_keys文件。 但是,现在我得到以下错误:
hadoop@namenode:~/.ssh$ ssh datanode1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: POSSIBLE DNS SPOOFING DETECTED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ The ECDSA host key for datanode1 has changed, and the key for the corresponding IP address 10.240.226.88 is unknown. This could either mean that DNS SPOOFING is happening or the IP address for the host and its host key have changed at the same time. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is 9f:8d:07:09:a9:67:63:b4:b9:2b:f5:39:ed:ef:55:d6. Please contact your system administrator. Add correct host key in /home/hadoop/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /home/hadoop/.ssh/known_hosts:1 ECDSA host key for datanode1 has changed and you have requested strict checking. Host key verification failed.
在/ etc / ssh / ssh_config中添加“StrictHostKeyChecking = no”修复了这个问题。
您的SSH公钥需要被复制到目标服务器,而不是源。
~/.ssh/id_rsa.pub刚刚创build的~/.ssh/id_rsa.pub文件 ~/.ssh/authorized_keys文件中 ~/.ssh/authorized_keys检查权限设置为0600 ssh-copy-id帮助器应用程序(我没有Google Compute的直接经验,所以这可能对您不适用)。 记住SSH密钥validation如何工作的一个好方法(至less对我来说)是这样的:
~/.ssh/id_rsa ),并生成公钥转发给接收方机器。 ~/.ssh/id_rsa.pub )仅供参考,如果拥有私钥 ,则可以重新创build/计算。 ~/.ssh/authorized_keys文件是一个“白名单”的种类。 它列出了允许连接到该用户帐户的所有公共密钥签名。 我build议你更新/home/hadoop/.ssh/known_hosts的主机指纹(或者删除该行,并在重新login时重新确认主机),而不是禁用StrictHostKeyChecking 。
(这假设你的服务器不会改变维护DNS的IP)