记一次ssh免密登录失败的debug经历

Posted 2023-01-28 Locutus

1. 问题

设置ssh免密登陆时，发现有一些机器正常登陆，有一些机器提示错误信息：public-key authentication with the server for user gzsun failed. Please verify username and public/private key pair.

2. 解决

2.1 查看ssh日志，debug

在本地，使用ssh客户端登陆。

# ssh root@xxxx -p 2222 -v

在ssh服务端，查看日志。

# more /var/log/secure 

其中，显示用户的.ssh文件夹和用户主目录/home/jack没有权限。

Authentication refused: bad ownership or modes for directory /home/jack/.ssh
Authentication refused: bad ownership or modes for directory /home/jack/.ssh
Authentication refused: bad ownership or modes for directory /home/jack/.ssh
error: Received disconnect from 36.111.140.26 port 59536:14: Unable to authenticate using any of the configured authentication methods.  [preauth]

Authentication refused: bad ownership or modes for directory /home/jack
Authentication refused: bad ownership or modes for directory /home/jack
Authentication refused: bad ownership or modes for directory /home/jack
error: Received disconnect from 36.111.140.26 port 62668:14: Unable to authenticate using any of the configured authentication methods.  [preauth]

因为/home/jack/.ssh目录只供属主用户读写执行，其他用户都不可以，这就导致了
/home/jack/.ssh/authorized_keys无法被读取，也就导致了ssh认证不通过。

2.2 解决方法

解决方法很简单，检测相关目录权限，把不符合要求的按要求设置权限即可。

# chmod 700 /home/jack/

# chmod 700 /home/jack/.ssh

# chmod 600 /home/jack/.ssh/authorized_keys

# chown -R jack:jack /home/jack

注：无论什么工具，debug一定要好好看文档。

3. 参考文章

https://wiki.centos.org/HowTos/Network/SecuringSSH