Linux 之 SSH免密登陆之二配置无效解析

客官°小女子只卖身不卖艺 2022-06-16 14:47 281阅读 0赞

*  错误1 文件夹及文件权限解析
 *  错误2 文件夹的标签错误解析

--------------------

## 错误1 文件夹及文件权限解析 ##

### Question ###

免密登陆无法生效。

### Answer ###

*  .ssh目录的权限必须是700
 *  .ssh/authorized\_keys文件权限必须是600  
    基本的操作为

chmod 700 /root/.ssh
    chmod 600 /root/.ssh/authorized_keys

### Reference ###

原因是权限过高导致了ssh登陆的安全性得不到保证，所以造成了实效，官方文档如下:

man sshd
    .....
         ~/.ssh/authorized_keys
                 Lists the public keys (DSA/ECDSA/RSA) that can be used for logging in as this user.  The format of
                 this file is described above.  The content of the file is not highly sensitive, but the recommended
                 permissions are read/write for the user, and not accessible by others.
    
                 If this file, the ~/.ssh directory, or the user's home directory are writable by other users, then the
                 file could be modified or replaced by unauthorized users.  In this case, sshd will not allow it to be
                 used unless the StrictModes option has been set to “no”.
    ........

--------------------

## 错误2 文件夹的标签错误解析 ##

### Question ###

在某些Linux系统(Redhat 6.5 ／ Centos 7)上，设置了问题1并不能解决问题，我们通过ssh -v 调试发现问题。

sh-3.2# ssh -v root@192.168.100.63
    OpenSSH_6.9p1, LibreSSL 2.1.8
    debug1: Reading configuration data /etc/ssh/ssh_config
    debug1: /etc/ssh/ssh_config line 21: Applying options for *
    debug1: Connecting to 192.168.100.63 [192.168.100.63] port 22.
    debug1: Connection established.
    debug1: permanently_set_uid: 0/0
    debug1: identity file /var/root/.ssh/id_rsa type 1
    debug1: key_load_public: No such file or directory
    debug1: identity file /var/root/.ssh/id_rsa-cert type -1
    debug1: key_load_public: No such file or directory
    debug1: identity file /var/root/.ssh/id_dsa type -1
    debug1: key_load_public: No such file or directory
    debug1: identity file /var/root/.ssh/id_dsa-cert type -1
    debug1: key_load_public: No such file or directory
    debug1: identity file /var/root/.ssh/id_ecdsa type -1
    debug1: key_load_public: No such file or directory
    debug1: identity file /var/root/.ssh/id_ecdsa-cert type -1
    debug1: key_load_public: No such file or directory
    debug1: identity file /var/root/.ssh/id_ed25519 type -1
    debug1: key_load_public: No such file or directory
    debug1: identity file /var/root/.ssh/id_ed25519-cert type -1
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_6.9
    debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
    debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000
    debug1: Authenticating to 192.168.100.63:22 as 'root'
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug1: kex: server->client aes128-ctr umac-64@openssh.com none
    debug1: kex: client->server aes128-ctr umac-64@openssh.com none
    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
    debug1: got SSH2_MSG_KEX_DH_GEX_GROUP
    debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
    debug1: got SSH2_MSG_KEX_DH_GEX_REPLY
    debug1: Server host key: ssh-rsa SHA256:mxdRr3cfr86jDyAS8l7MoxfsM0GQqJkAlp0G2XwHBLM
    
    # 说明已经验证成功了 找到了 authorithy_keys 的记录
    
    debug1: Host '192.168.100.63' is known and matches the RSA host key.
    debug1: Found key in /var/root/.ssh/known_hosts:19
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug1: SSH2_MSG_NEWKEYS received
    debug1: SSH2_MSG_SERVICE_REQUEST sent
    debug1: SSH2_MSG_SERVICE_ACCEPT received
    debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    
    # 下方说明没有验证成功，导致了 跳到了下一个阶段的验证
    
    debug1: Next authentication method: publickey
    debug1: Offering RSA public key: /var/root/.ssh/id_rsa
    debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    debug1: Trying private key: /var/root/.ssh/id_dsa
    debug1: Trying private key: /var/root/.ssh/id_ecdsa
    debug1: Trying private key: /var/root/.ssh/id_ed25519
    debug1: Next authentication method: password

### Answer ###

因为之前使用`ssh-keygen -t rsa`命令生成的`.ssh`文件夹免密配置都是成功的。但是，我们通过`mkdir -p`自己创建的一直不成功！通过查找资料得知，原来是文件夹竟然还有一个叫做标签的东西。通过如下的命令可以知道，差别在于何处:

＃.bak 是我通过重命名过的系统自己生成的.ssh文件夹
    [root@rhel6 ~]# ls -laZ
    drwx------. root root unconfined_u:object_r:ssh_home_t:s0 .bak
    drwx------. root root unconfined_u:object_r:admin_home_t:s0 .ssh

发现系统生成的确实是用一个叫做`ssh_home_t:s0`的标签，但是我们自己创建的为`admin_home_t:s0`，所以我们改变下就可以了;

改造命令如下所示:

restorecon -r -vv /root/.ssh
    # 其它用户 换成 ~/.ssh

那么问题就可以解决了，关于chmod命令和ssh免密脚本会在其它文章内具体详解。

--------------------

## 参考文献 ##

\[1\] [ssh设置免密码登陆仍然需要密码][ssh]  
\[2\] [CentOS SSH公钥登录问题 ][CentOS SSH_]  
\[3\] [一次由SELinux引起的ssh公钥认证失败问题][SELinux_ssh]  
\[4\] [ssh key生成和配置 ][ssh key_]  
\[5\] [ ssh免密登录方法不生效？][ssh 1]  
\[6\] [ssh配置authorized\_keys后仍然需要输入密码的问题][ssh_authorized_keys]  
\[7\][ssh配置authorized\_keys后仍然需要输入密码的问题][ssh_authorized_keys 1]

[ssh]: https://segmentfault.com/q/1010000002903000
[CentOS SSH_]: https://segmentfault.com/q/1010000000445726
[SELinux_ssh]: http://www.cnblogs.com/qcly/archive/2013/07/27/3219535.html
[ssh key_]: http://blog.sina.com.cn/s/blog_96b8a1540101e5it.html
[ssh 1]: http://www.cnblogs.com/shengulong/p/6709743.html
[ssh_authorized_keys]: http://www.cnblogs.com/snowbook/p/5671406.html
[ssh_authorized_keys 1]: http://smilejay.com/2013/01/ssh-password-authorized_keys/