ssh共享密钥身份validation请求input密码，除非sshd使用-d选项运行

我的客户端是Ubuntu，而服务器是CentOS。 我有共享密钥身份validation设置为从客户端login到服务器。 当我运行如下的服务器：

sudo `which sshd` -d 

一切按预期工作; 我没有得到用户login提示。 我认为这意味着一切都在正确的位置，具有正确的权限等。当我以“正常”模式重新启动服务器：

 sudo service sshd restart 

我的客户提示我input用户密码。

这里是成功的详细输出（sshd -d）：

• 强制IIS提示input凭据
• 组策略和Internet Explorer的站点到区域分配问题？
• 从命令行启用SLES 12中的LDAP客户端
• NO 来自远程authentication服务器的意外响应
• sshd_config如何让一个用户拥有完全不受限制的sftp并允许ssh

 anregen@ba-vm-atf-01:~/workspace$ ssh -v [email protected] OpenSSH_6.0p1 (CentrifyDC build 5.1.1-814) (CentrifyDC build 5.1.1-814), OpenSSL 0.9.8w 23 Apr 2012 debug1: Reading configuration data /etc/centrifydc/ssh/ssh_config debug1: /etc/centrifydc/ssh/ssh_config line 52: Applying options for * debug1: Connecting to test.lab.network.com [172.20.80.45] port 22. debug1: Connection established. debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_rsa type 1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_rsa-cert type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_dsa type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_dsa-cert type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_ecdsa type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH_5* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.0 debug1: Miscellaneous failure No credentials cache found debug1: Miscellaneous failure No credentials cache found debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: RSA 1e:57:9c:69:d2:09:29:0b:5b:4d:e4:f7:98:ee:f5:94 debug1: Host 'test.lab.network.com' is known and matches the RSA host key. debug1: Found key in /home/MyNetwork.local/anregen/.ssh/known_hosts:7 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic debug1: Miscellaneous failure No credentials cache found debug1: Miscellaneous failure No credentials cache found debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/MyNetwork.local/anregen/.ssh/id_rsa debug1: Server accepts key: pkalg ssh-rsa blen 279 debug1: read PEM private key done: type RSA debug1: Authentication succeeded (publickey). Authenticated to test.lab.network.com ([172.20.80.45]:22). debug1: channel 0: new [client-session] debug1: Requesting [email protected] debug1: Entering interactive session. Last login: Tue Jun 17 16:03:39 2014 from ba-vm-atf-01.lab.network.com Environment: USER=web LOGNAME=web HOME=/var/www PATH=/usr/local/bin:/bin:/usr/bin MAIL=/var/mail/web SHELL=/bin/bash SSH_CLIENT=172.20.80.27 32973 22 SSH_CONNECTION=172.20.80.27 32973 172.20.80.45 22 SSH_TTY=/dev/pts/1 TERM=xterm SELINUX_ROLE_REQUESTED= SELINUX_LEVEL_REQUESTED= SELINUX_USE_CURRENT_RANGE= -bash-4.1$ 

这里是从“失败” sudo service sshd restart的详细输出：

 anregen@ba-vm-atf-01:~/workspace$ ssh -v [email protected] OpenSSH_6.0p1 (CentrifyDC build 5.1.1-814) (CentrifyDC build 5.1.1-814), OpenSSL 0.9.8w 23 Apr 2012 debug1: Reading configuration data /etc/centrifydc/ssh/ssh_config debug1: /etc/centrifydc/ssh/ssh_config line 52: Applying options for * debug1: Connecting to test.lab.network.com [172.20.80.45] port 22. debug1: Connection established. debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_rsa type 1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_rsa-cert type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_dsa type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_dsa-cert type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_ecdsa type -1 debug1: identity file /home/MyNetwork.local/anregen/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH_5* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.0 debug1: Miscellaneous failure No credentials cache found debug1: Miscellaneous failure No credentials cache found debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key: RSA 1e:57:9c:69:d2:09:29:0b:5b:4d:e4:f7:98:ee:f5:94 debug1: Host 'test.lab.network.com' is known and matches the RSA host key. debug1: Found key in /home/MyNetwork.local/anregen/.ssh/known_hosts:7 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic debug1: Miscellaneous failure No credentials cache found debug1: Miscellaneous failure No credentials cache found debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/MyNetwork.local/anregen/.ssh/id_rsa debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Trying private key: /home/MyNetwork.local/anregen/.ssh/id_dsa debug1: Trying private key: /home/MyNetwork.local/anregen/.ssh/id_ecdsa debug1: Next authentication method: password [email protected]'s password: 

有什么想法使用-d使这个工作？ 或者是在service工具之外运行sshd？

编辑：通过请求，这里是服务器端日志与-d选项。 我添加了#comments来显示远程/客户端活动。

 [anregen@ba-vm-web-01 ~]$ clear [anregen@ba-vm-web-01 ~]$ sudo service sshd stop Stopping sshd: [ OK ] [anregen@ba-vm-web-01 ~]$ sudo `which sshd` -d debug1: sshd version OpenSSH_5.3p1 debug1: read PEM private key done: type RSA debug1: private host key: #0 type 1 RSA debug1: read PEM private key done: type DSA debug1: private host key: #1 type 2 DSA debug1: rexec_argv[0]='/usr/sbin/sshd' debug1: rexec_argv[1]='-d' Set /proc/self/oom_score_adj from 0 to -1000 debug1: Bind to port 22 on 0.0.0.0. Server listening on 0.0.0.0 port 22. debug1: Bind to port 22 on ::. Server listening on :: port 22. # At this point, I log in from remote as "web" debug1: Server will not fork when running in debugging mode. debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8 debug1: inetd sockets after dupping: 3, 3 Connection from 172.20.80.27 port 37828 debug1: Client protocol version 2.0; client software version OpenSSH_6.0 debug1: match: OpenSSH_6.0 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug1: permanently_set_uid: 74/74 debug1: list_hostkey_types: ssh-rsa,ssh-dss debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: client->server aes128-ctr hmac-md5 none debug1: kex: server->client aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: KEX done debug1: userauth-request for user web service ssh-connection method none debug1: attempt 0 failures 0 debug1: PAM: initializing for "web" debug1: PAM: setting PAM_RHOST to "ba-vm-atf-01.lab.network.com" debug1: PAM: setting PAM_TTY to "ssh" debug1: userauth-request for user web service ssh-connection method publickey debug1: attempt 1 failures 0 debug1: test whether pkalg/pkblob are acceptable debug1: temporarily_use_uid: 500/500 (e=0/0) debug1: trying public key file /var/www/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: matching key found: file /var/www/.ssh/authorized_keys, line 1 Found matching RSA key: 6b:b4:a1:41:e2:7c:0a:c6:2b:6d:27:87:f4:3c:6e:0c debug1: restore_uid: 0/0 Postponed publickey for web from 172.20.80.27 port 37828 ssh2 debug1: userauth-request for user web service ssh-connection method publickey debug1: attempt 2 failures 0 debug1: temporarily_use_uid: 500/500 (e=0/0) debug1: trying public key file /var/www/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: matching key found: file /var/www/.ssh/authorized_keys, line 1 Found matching RSA key: 6b:b4:a1:41:e2:7c:0a:c6:2b:6d:27:87:f4:3c:6e:0c debug1: restore_uid: 0/0 debug1: ssh_rsa_verify: signature correct debug1: do_pam_account: called Accepted publickey for web from 172.20.80.27 port 37828 ssh2 debug1: monitor_child_preauth: web has been authenticated by privileged process debug1: temporarily_use_uid: 500/500 (e=0/0) debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism debug1: restore_uid: 0/0 debug1: SELinux support enabled debug1: PAM: establishing credentials debug1: temporarily_use_uid: 500/500 (e=0/0) debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism debug1: restore_uid: 0/0 User child is on pid 19221 debug1: PAM: establishing credentials debug1: permanently_set_uid: 500/500 debug1: Entering interactive session for SSH2. debug1: server_init_dispatch_20 debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 debug1: input_session_request debug1: channel 0: new [server-session] debug1: session_new: session 0 debug1: session_open: channel 0 debug1: session_open: session 0: link with channel 0 debug1: server_input_channel_open: confirm session debug1: server_input_global_request: rtype [email protected] want_reply 0 debug1: server_input_channel_req: channel 0 request pty-req reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req pty-req debug1: Allocating pty. debug1: session_new: session 0 debug1: session_pty_req: session 0 alloc /dev/pts/1 debug1: server_input_channel_req: channel 0 request shell reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req shell debug1: Setting controlling tty using TIOCSCTTY. # at this point I send "exit" from remote to logout debug1: Received SIGCHLD. debug1: session_by_pid: pid 19222 debug1: session_exit_message: session 0 channel 0 pid 19222 debug1: session_exit_message: release channel 0 debug1: session_by_tty: session 0 tty /dev/pts/1 debug1: session_pty_cleanup: session 0 release /dev/pts/1 Received disconnect from 172.20.80.27: 11: disconnected by user debug1: do_cleanup debug1: do_cleanup debug1: PAM: cleanup debug1: PAM: closing session debug1: PAM: deleting credentials