Linux
在 ssh 命令上使用 -i 參數時，公鑰身份驗證失敗
我必須在兩台 Linux 伺服器上進行基於公鑰的身份驗證。
機器 2 (192.168.3.132)
使用者名：vfx_30
主目錄：
/home/vfx_30SSH 密鑰：
/home/vfx_30/.ssh/id_rsa/home/vfx_30/.ssh/id_rsa.pub機器 1 (192.168.3.131)
vfx_30 使用者的公鑰文件位置是
/root/keys/vfx_30.pub（machine2/home/vfx_30/.ssh/id_rsa.pub複製到這裡）使用以下命令無法使用從機器 1 到機器 2 的公鑰登錄：
ssh -v -i /root/keys/vfx_30.pub vfx_30@192.168.3.132請注意：
- 機器 1 上沒有名為 vfx_30 的使用者 /
authorized_keys此處未使用- 使用
-i參數傳遞公鑰。- 在機器 1 上以 root 使用者身份執行此命令
/etc/ssh/sshd_config:RSAAuthentication yes PubkeyAuthentication yes詳細登錄機器 1
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to 192.168.3.132 [192.168.3.132] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/keys/vfx_30.pub type 1 debug1: identity file /root/keys/vfx_30.pub-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 debug1: match: OpenSSH_5.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host '192.168.3.132' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:1 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information Cannot determine realm for numeric host address debug1: Next authentication method: publickey debug1: Offering public key: /root/keys/vfx_30.pub debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: password vfx_30@192.168.3.132's password:機器 2 上的審核日誌 (
/var/log/audit/audit.log)type=CRYPTO_KEY_USER msg=audit(1407837882.656:3259): user pid=27704 uid=0 auid=0 ses=171 msg='op=destroy kind=server fp=e9:69:4f:ad:06:d9:cc:7e:bb:0a:7e:57:03:ea:24:a1 direction=? spid=27704 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.3.131 terminal=? res=success' type=CRYPTO_KEY_USER msg=audit(1407837882.656:3260): user pid=27704 uid=0 auid=0 ses=171 msg='op=destroy kind=server fp=56:f6:8d:7e:f3:33:c3:6c:f1:52:49:57:3a:9b:ed:d7 direction=? spid=27704 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.3.131 terminal=? res=success' type=CRYPTO_SESSION msg=audit(1407837882.656:3261): user pid=27703 uid=0 auid=0 ses=171 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=27704 suid=74 rport=59764 laddr=192.168.3.132 lport=22 exe="/usr/sbin/sshd" hostname=? addr=192.168.3.131 terminal=? res=success' type=CRYPTO_SESSION msg=audit(1407837882.656:3262): user pid=27703 uid=0 auid=0 ses=171 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=27704 suid=74 rport=59764 laddr=192.168.3.132 lport=22 exe="/usr/sbin/sshd" hostname=? addr=192.168.3.131 terminal=? res=success' type=USER_AUTH msg=audit(1407837882.704:3263): user pid=27703 uid=0 auid=0 ses=171 msg='op=pubkey acct="vfx_30" exe="/usr/sbin/sshd" hostname=? addr=192.168.3.131 terminal=ssh res=failed'
您無法使用公鑰連接。
公鑰 (id_rsa.pub) 應位於伺服器端，而私鑰 (id_rsa) 應位於客戶端。
在機器 2 上安裝密鑰：
cat id_rsa.pub >> /home/vfx_30/.ssh/authorized_keys # sometimes this file is called authorized_keys2並從機器 1 連接：
ssh -i id_rsa vfx_30@192.168.3.132
您正在嘗試向後使用密鑰。您創建了一個密鑰對，可用於從機器 2 建立 ssh 連接。
接下來，您嘗試從根本沒有密鑰對的機器 1 建立連接。
要使其工作，首先在機器 1 上創建一個密鑰對。您可以使用 來創建它
ssh-keygen，就像在機器 2 上一樣。
~/.ssh/id_rsa.pub可以選擇在行尾的註釋中編輯並添加日期。我發現在那裡有一個日期很有用，這樣在我放置公鑰的任何地方，我都可以看到它是哪個版本，以防我以後必須輪換它。接下來
~/.ssh/id_rsa.pub從機器 1 中獲取內容並將其附加到~/.ssh/authorized_keys機器 2 上。（在此過程中創建authorized_keys文件，如果它不存在）。