无法 ssh localhost：权限被拒绝（公钥）/连接由 ::1 [preauth] 关闭

【问题标题】：Unable to ssh localhost: Permission denied (publickey) / Connection closed by ::1 [preauth]无法 ssh localhost：权限被拒绝（公钥）/连接由 ::1 [preauth] 关闭
【发布时间】：2015-03-28 10:30:57
【问题描述】：

我正在尝试执行

ssh localhost

在 Ubuntu 14.04 LTS 上，但正在获取

Permission denied (publickey).

这是一些调试信息...

首先，我在 ~/.ssh 目录中有以下文件：

ubuntu@<hostname>:~$ ls .ssh
authorized_keys  id_dsa  id_dsa.pub  id_ecdsa  id_ecdsa.pub  id_ed25519  id_ed25519.pub  id_rsa  id_rsa.pub  known_hosts

并且对该目录的访问权限为：

ubuntu@<hostname>:~# stat -c %a ~/.ssh  
700

这是 sshing 的详细输出：

ubuntu@<hostname>:~$ ssh -vvv localhost  
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014  
debug1: Reading configuration data /etc/ssh/ssh_config  
debug1: /etc/ssh/ssh_config line 19: Applying options for *  
debug2: ssh_connect: needpriv 0  
debug1: Connecting to localhost [::1] port 22.  
debug1: Connection established.  
debug3: Incorrect RSA1 identifier  
debug3: Could not load "/home/ubuntu/.ssh/id_rsa" as a RSA1 public key  
debug1: identity file /home/ubuntu/.ssh/id_rsa type 1  
debug1: identity file /home/ubuntu/.ssh/id_rsa-cert type -1  
debug3: Incorrect RSA1 identifier  
debug3: Could not load "/home/ubuntu/.ssh/id_dsa" as a RSA1 public key  
debug1: identity file /home/ubuntu/.ssh/id_dsa type 2  
debug1: identity file /home/ubuntu/.ssh/id_dsa-cert type -1  
debug3: Incorrect RSA1 identifier  
debug3: Could not load "/home/ubuntu/.ssh/id_ecdsa" as a RSA1 public key  
debug1: identity file /home/ubuntu/.ssh/id_ecdsa type 3  
debug1: identity file /home/ubuntu/.ssh/id_ecdsa-cert type -1  
debug3: Incorrect RSA1 identifier  
debug3: Could not load "/home/ubuntu/.ssh/id_ed25519" as a RSA1 public key  
debug1: identity file /home/ubuntu/.ssh/id_ed25519 type 4  
debug1: identity file /home/ubuntu/.ssh/id_ed25519-cert type -1  
debug1: Enabling compatibility mode for protocol 2.0  
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2  
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2  
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000  
debug2: fd 3 setting O_NONBLOCK  
debug3: load_hostkeys: loading entries for host "localhost" from file "/home/ubuntu/.ssh/known_hosts"  
debug3: load_hostkeys: found key type ECDSA in file /home/ubuntu/.ssh/known_hosts:1  
debug3: load_hostkeys: loaded 1 keys  
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521  
debug1: SSH2_MSG_KEXINIT sent  
debug1: SSH2_MSG_KEXINIT received  
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1  
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-ed25519,ssh-rsa,ssh-dss  
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib  
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib  
debug2: kex_parse_kexinit:  
debug2: kex_parse_kexinit:  
debug2: kex_parse_kexinit: first_kex_follows 0  
debug2: kex_parse_kexinit: reserved 0  
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1  
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519  
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se  
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96  
debug2: kex_parse_kexinit: none,zlib@openssh.com  
debug2: kex_parse_kexinit: none,zlib@openssh.com  
debug2: kex_parse_kexinit:  
debug2: kex_parse_kexinit:  
debug2: kex_parse_kexinit: first_kex_follows 0  
debug2: kex_parse_kexinit: reserved 0  
debug2: mac_setup: setup hmac-md5-etm@openssh.com  
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none  
debug2: mac_setup: setup hmac-md5-etm@openssh.com  
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none  
debug1: sending SSH2_MSG_KEX_ECDH_INIT  
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY  
debug1: Server host key: ECDSA 4a:79:23:54:0b:5a:2c:98:39:ed:e4:b4:6b:5b:84:fa  
debug3: load_hostkeys: loading entries for host "localhost" from file "/home/ubuntu/.ssh/known_hosts"  
debug3: load_hostkeys: found key type ECDSA in file /home/ubuntu/.ssh/known_hosts:1  
debug3: load_hostkeys: loaded 1 keys  
debug1: Host 'localhost' is known and matches the ECDSA host key.  
debug1: Found key in /home/ubuntu/.ssh/known_hosts:1  
debug1: ssh_ecdsa_verify: signature correct  
debug2: kex_derive_keys  
debug2: set_newkeys: mode 1  
debug1: SSH2_MSG_NEWKEYS sent  
debug1: expecting SSH2_MSG_NEWKEYS  
debug2: set_newkeys: mode 0  
debug1: SSH2_MSG_NEWKEYS received  
debug1: Roaming not allowed by server  
debug1: SSH2_MSG_SERVICE_REQUEST sent  
debug2: service_accept: ssh-userauth  
debug1: SSH2_MSG_SERVICE_ACCEPT received  
debug2: key: /home/ubuntu/.ssh/id_rsa (0x7f403e66d570),  
debug2: key: /home/ubuntu/.ssh/id_dsa (0x7f403e66d4a0),  
debug2: key: /home/ubuntu/.ssh/id_ecdsa (0x7f403e6724d0),  
debug2: key: /home/ubuntu/.ssh/id_ed25519 (0x7f403e672b80),  
debug1: Authentications that can continue: publickey  
debug3: start over, passed a different list publickey  
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password  
debug3: authmethod_lookup publickey  
debug3: remaining preferred: keyboard-interactive,password  
debug3: authmethod_is_enabled publickey  
debug1: Next authentication method: publickey  
debug1: Offering RSA public key: /home/ubuntu/.ssh/id_rsa  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug1: Offering DSA public key: /home/ubuntu/.ssh/id_dsa  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug1: Offering ECDSA public key: /home/ubuntu/.ssh/id_ecdsa  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug1: Offering ED25519 public key: /home/ubuntu/.ssh/id_ed25519  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug2: we did not send a packet, disable method  
debug1: No more authentication methods to try.  
Permission denied (publickey).

/etc/ssh/sshd_config 文件内容：

ubuntu@<hostname>:~# cat /etc/ssh/sshd_config  
# Package generated configuration file  
# See the sshd_config(5) manpage for details  

# What ports, IPs and protocols we listen for  
Port 22  
# Use these options to restrict which interfaces/protocols sshd will bind to  
#ListenAddress ::  
#ListenAddress 0.0.0.0  
Protocol 2  
# HostKeys for protocol version 2  
HostKey /etc/ssh/ssh_host_rsa_key  
HostKey /etc/ssh/ssh_host_dsa_key  
HostKey /etc/ssh/ssh_host_ecdsa_key  
HostKey /etc/ssh/ssh_host_ed25519_key  
#Privilege Separation is turned on for security  
UsePrivilegeSeparation yes  

# Lifetime and size of ephemeral version 1 server key  
KeyRegenerationInterval 3600  
ServerKeyBits 1024  

# Logging  
SyslogFacility AUTH  
LogLevel INFO  

# Authentication:  
LoginGraceTime 120  
PermitRootLogin without-password  
StrictModes yes  

RSAAuthentication yes  
PubkeyAuthentication yes  
#AuthorizedKeysFile     %h/.ssh/authorized_keys  

# Don't read the user's ~/.rhosts and ~/.shosts files  
IgnoreRhosts yes  
# For this to work you will also need host keys in /etc/ssh_known_hosts  
RhostsRSAAuthentication no  
# similar for protocol version 2  
HostbasedAuthentication no  
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication  
#IgnoreUserKnownHosts yes  

# To enable empty passwords, change to yes (NOT RECOMMENDED)  
PermitEmptyPasswords no  

# Change to yes to enable challenge-response passwords (beware issues with  
# some PAM modules and threads)  
ChallengeResponseAuthentication no  

# Change to no to disable tunnelled clear text passwords  
PasswordAuthentication no  

# Kerberos options  
#KerberosAuthentication no  
#KerberosGetAFSToken no  
#KerberosOrLocalPasswd yes  
#KerberosTicketCleanup yes  

# GSSAPI options  
#GSSAPIAuthentication no  
#GSSAPICleanupCredentials yes  

X11Forwarding yes  
X11DisplayOffset 10  
PrintMotd no  
PrintLastLog yes  
TCPKeepAlive yes  
#UseLogin no  

#MaxStartups 10:30:60  
#Banner /etc/issue.net  

# Allow client to pass locale environment variables  
AcceptEnv LANG LC_*  

Subsystem sftp /usr/lib/openssh/sftp-server  

# Set this to 'yes' to enable PAM authentication, account processing,  
# and session processing. If this is enabled, PAM authentication will  
# be allowed through the ChallengeResponseAuthentication and  
# PasswordAuthentication.  Depending on your PAM configuration,  
# PAM authentication via ChallengeResponseAuthentication may bypass  
# the setting of "PermitRootLogin without-password".  
# If you just want the PAM account and session checks to run without  
# PAM authentication, then enable this but set PasswordAuthentication  
# and ChallengeResponseAuthentication to 'no'.  
UsePAM yes

每次我尝试执行“ssh localhost”时，都会在 /var/log/auth.log 中添加以下行：

Jan 29 08:40:41 <hostname> sshd[5167]: Connection closed by ::1 [preauth]

谁能给点建议？

【问题讨论】：

    标签： ubuntu ssh


    【解决方案1】：

    在阅读了一些不错的手册后，我意识到必须将 ubuntu@ 的公钥（例如，/home/ubuntu/.ssh/id_dsa.pub）添加到用户的 /home/ubuntu/.ssh/authorized_keys 文件中，这包含用于公钥认证的公钥）

    ubuntu@<localhost>:~$ cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

    【讨论】：

    • 在此处记录 (linuxproblem.org/art_9.html) 其中一些可能需要： 1) 将 .ssh 的权限更改为 700；或 2) 将 .ssh/authorized_keys2 的权限更改为 640
    【解决方案2】：

    如果您在适用于 Linux 的 Windows 子系统上运行 Ubuntu，则不会有预安装的公钥或授权密钥列表，因此您需要自己生成。

    如果您还没有安装 openssh-server：

    1. sudo apt-get upgrade
    2. sudo apt-get update
    3. sudo apt-get install openssh-server
    4. sudo service ssh start

    然后按照以下步骤启用sshing to localhost：

    1. cd ~/.ssh
    2. ssh-keygen 生成公钥/私钥 rsa 密钥对；使用默认选项
    3. cat id_rsa.pub &gt;&gt; authorized_keys 将密钥附加到 authorized_keys 文件中
    4. chmod 640 authorized_keys 设置受限权限
    5. sudo service ssh restart 获取最近的更改
    6. ssh localhost

    【讨论】：

    • 谢谢你。帮助我对 CentOS Lightsail 服务器进行故障排除。
    • 这对我有用，我不知道为什么。你介意解释一下'4'是什么步骤吗？做？ （我理解 chmod 640 .. 但是什么 ssh 进程需要访问这个文件？）。我可以避免'4'吗？通过在 ssh 命令上使用 sudo？
    【解决方案3】：

    除了添加公钥之外，您可能还想将 PasswordAuthentication 从“否”更改为“是”（在新安装的 ssh 中，默认情况下可能为“否”）。

    打开配置

    $ sudo nano /etc/ssh/sshd_config

    改变

    PasswordAuthentication no

    到

    PasswordAuthentication yes

    保存并退出。 然后重新加载 ssh 服务器

    $ sudo service ssh reload

    注意：从安全角度不建议使用 PasswordAuthentication，如果您的服务器暴露在互联网上，请禁用它并使用 SSH 密钥。

    【讨论】：

    • 感谢PasswordAuthentication默认为no的建议。 WSL 2 上使用的 Ubuntu 20.04.3 LTS 就是这种情况。使用 sudo service ssh restart 重新启动 ssh 是我之后唯一需要做的事情。
    【解决方案4】：

    调试消息实际上提供了有关错误根本原因的信息。

    debug1: Next authentication method: publickey  
debug1: Offering RSA public key: /home/ubuntu/.ssh/id_rsa  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug1: Offering DSA public key: /home/ubuntu/.ssh/id_dsa  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug1: Offering ECDSA public key: /home/ubuntu/.ssh/id_ecdsa  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug1: Offering ED25519 public key: /home/ubuntu/.ssh/id_ed25519  
debug3: send_pubkey_test  
debug2: we sent a publickey packet, wait for reply  
debug1: Authentications that can continue: publickey  
debug2: we did not send a packet, disable method  
debug1: No more authentication methods to try.  
Permission denied (publickey).

    为了使用公钥进行身份验证，客户端将向服务器发送包含其公钥的SSH_MSG_USERAUTH_REQUEST。服务器收到此消息后，会检查公钥是否已被授权（通常针对authorized_keys文件）。

    客户端有几个使用不同算法创建的公钥（id_rsa.pub、id_dsa.pub、id_ecdsa.pub、id_ed25519.pub）。身份验证时，客户端首先向服务器提供默认公钥id_rsa.pub，并在服务器响应它无法授权提供的公钥时轮换剩余的公钥。最后，当所有公钥授权失败时，SSH客户端显示Permission denied消息。

    preauth 标签显示在身份验证过程完成之前连接已关闭。

    SSH公钥认证中客户端和服务器交互的消息顺序可以参考this article。

    【讨论】：

      猜你喜欢
      • 2020-02-11
      • 2015-07-15
      • 2017-11-09
      • 2018-07-20
      • 2016-02-29
      • 2021-06-16
      • 2019-11-24
      • 2014-11-08
      • 2019-03-11
      相关资源
      最近更新 更多
      热门标签
      Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode