我尝试在没有密码输入的情况下通过ssh在机器A和B之间设置git用户访问。 完成这些步骤后:
/*
* suppose A stands for 192.168.16.14
* and then B stands for machine ip 192.168.16.160
*/
git@A:~/.ssh$ ssh-keygen -t rsa
git@A:~/.ssh$ cp id_rsa.pub /tmp/lzq.rsa.git.pub
git@A:~/.ssh$ exit
root@A:~# scp /tmp/lzq.rsa.git.pub 192.168.16.160:/tmp
[OK]
/*
* thus [OK] means machine A root user can login B
by root user with ssh access without password,
* and B also can do right things in respectively.
*/
git@B:~/.ssh$ ssh-keygen -t rsa
git@B:~/.ssh$ cp id_rsa.pub /tmp/zz.rsa.git.pub
git@B:~/.ssh$ exit
root@B:~# scp /tmp/zz.rsa.git.pub 192.168.16.14:/tmp
[OK]
git@A:~/.ssh$ cp /tmp/zz.rsa.git.pub ./
git@A:~/.ssh$ cat id_rsa.pub >> authorized_keys
git@A:~/.ssh$ cat zz.rsa.git.pub >> authorized_keys
git@A:~/.ssh$ sudo /etc/init.d/sshd restart
git@B:~/.ssh$ cp /tmp/lzq.rsa.git.pub ./
git@B:~/.ssh$ cat id_rsa.pub >> authorized_keys
git@B:~/.ssh$ cat lzq.rsa.git.pub >> authorized_keys
git@B:~/.ssh$ sudo /etc/init.d/sshd restart
git@A:~/$ ssh -vvv 192.168.16.14
Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-27-generic x86_64)
* Documentation: https://help.ubuntu.com/
139 packages can be updated.
46 updates are security updates.
Last login: Thu Sep 6 11:05:28 2012 from 192.168.16.14
git@zzz-Inspiron-1545:
所以:
/*
* we can use 'ssh 192.168.16.14' as git user in B, the log show as followings.
* note that 'lavande-G31M-ES2C' stands for A.
* the quote section record as file 'lzq-ssh-zz-success.txt'
*/
git@lavande-G31M-ES2C:~/.ssh$ ssh -vvv 192.168.16.160
OpenSSH_5.9p1Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.16.160 [192.168.16.160] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/git/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /home/git/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/git/.ssh/id_rsa-cert type -1
debug1: identity file /home/git/.ssh/id_dsa type -1
debug1: identity file /home/git/.ssh/id_dsa-cert type -1
debug1: identity file /home/git/.ssh/id_ecdsa type -1
debug1: identity file /home/git/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "192.168.16.160" from file "/home/git/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/git/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit:
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr
hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA e0:29:49:e6:f0:8a:fd:59:da:03:aa:3b:e1:ea:e4:2b debug3: load_hostkeys: loading entries for host "192.168.16.160" from file "/home/git/.ssh/known_hosts" debug3: load_hostkeys: found key type ECDSA in file /home/git/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys debug1: Host '192.168.16.160' is known and matches the ECDSA host key.
debug1: Found key in /home/git/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1:expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept:ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/git/.ssh/id_rsa (0x7f06fdce77d0)
debug2: key: /home/git/.ssh/id_dsa ((nil))
debug2: key: /home/git/.ssh/id_ecdsa ((nil)) debug1: Authentications that can continue: publickey
debug3:start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/git/.ssh/id_rsa
debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 3e:89:13:95:e7:3e:73:60:fa:06:77:1b:e0:e0:0d:b3
debug3: sign_and_send_pubkey: RSA 3e:89:13:95:e7:3e:73:60:fa:06:77:1b:e0:e0:0d:b3
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey). Authenticated to 192.168.16.160 ([192.168.16.160]:22).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open:channel_new: 0
debug2: channel 0: send open
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug2: fd 3 setting TCP_NODELAY
debug2: channel 0: request pty-req confirm 1
debug1: Sending environment.
debug3: Ignored env SHELL debug3: Ignored env TERM
debug3: Ignored env XDG_SESSION_COOKIE
debug3: Ignored env USER
debug3: Ignored env MAIL
debug3: Ignored env PATH
debug3: Ignored env PWD
debug1: Sending env LANG = en_US.UTF-8
debug2: channel 0: request env confirm 0
debug3: Ignored env SHLVL
debug3: Ignored env HOME
debug3: Ignored env LOGNAME
debug3: Ignored env DISPLAY
debug3: Ignored env XAUTHORITY
debug3: Ignored env COLORTERM
debug3: Ignored env OLDPWD
debug3: Ignored env _
debug2: channel 0: request shell confirm 1
debug2: callback done debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0 Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-27-generic x86_64)
* Documentation: https://help.ubuntu.com/
139 packages can be updated. 46 updates are security updates.
Last login: Thu Sep 6 11:05:28 2012 from 192.168.16.14
git@zzz-Inspiron-1545:~$ debug2: client_check_window_change: changed
debug2: channel 0: request window-change confirm 0 debug2:
client_check_window_change: changed debug2: channel 0: request
window-change confirm 0 git@zzz-Inspiron-1545:~$
[code]git@B:~/$ ssh -vvv 192.168.16.14[/code]
git@192.168.16.14's password:
问题:
/*
* "git@192.168.16.14's password:", the result is not the same in respectively.
* log file as 'zz-ssh-lzq-err.txt'
*/
显示日志文件如下(注意'zzz-Inspiron-1545
'代表'B
'):
git@zzz-Inspiron-1545:~/.ssh$ ssh -vvv 192.168.16.14
OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.16.14 [192.168.16.14] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/git/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /home/git/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/git/.ssh/id_rsa-cert type -1
debug1: identity file /home/git/.ssh/id_dsa type -1
debug1: identity file /home/git/.ssh/id_dsa-cert type -1
debug1: identity file /home/git/.ssh/id_ecdsa type -1
debug1: identity file /home/git/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "192.168.16.14" from file "/home/git/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/git/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 03:32:02:5b:ac:29:41:a3:dc:96:33:a5:f7:ae:22:3d
debug3: load_hostkeys: loading entries for host "192.168.16.14" from file "/home/git/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/git/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug1: Host '192.168.16.14' is known and matches the ECDSA host key.
debug1: Found key in /home/git/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/git/.ssh/id_rsa (0x7f514e700890)
debug2: key: /home/git/.ssh/id_dsa ((nil))
debug2: key: /home/git/.ssh/id_ecdsa ((nil))
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/git/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/git/.ssh/id_dsa
debug3: no such identity: /home/git/.ssh/id_dsa
debug1: Trying private key: /home/git/.ssh/id_ecdsa
debug3: no such identity: /home/git/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
git@192.168.16.14's password:
debug3: packet_send2: adding 64 (len 48 padlen 16 extra_pad 64)
debug2: we sent a password packet, wait for reply
Connection closed by 192.168.16.14
git@zzz-Inspiron-1545:~/.ssh$
你有没有发现这个问题?
我该如何解决这个问题呢?
为什么我们无法通过ssh访问A
而无需使用密码B
作为git用户?
答案 0 :(得分:0)
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/git/.ssh/id_dsa
debug3: no such identity: /home/git/.ssh/id_dsa
没有这样的身份 - 就是这样
http://inderpreetsingh.com/2011/08/04/ssh-privatepublic-key-auth-not-working/
http://www.cyberciti.biz/faq/ssh-password-less-login-with-dsa-publickey-authentication/
答案 1 :(得分:0)
在一个终端中,在A上,在更高端口上以调试模式启动sshd服务器:
/usr/sbin/sshd -d -e -p1234
然后,在另一个终端,从B,连接
ssh -p 1234 192.168.16.14
sshd的日志将打印在屏幕上,您很可能会看到它无法正常工作的原因。