방금 CentOS 7로 업그레이드한 두 대의 서버가 있는데 그 이후로 어떤 사용자도 SSH 액세스에 키를 사용할 수 없으므로 항상 비밀번호가 필요합니다.
이는 다른 서버에서는 발생하지 않으며 동일한 시스템에서 CentOS 6을 사용하는 경우에도 발생하지 않습니다. .ssh 디렉터리와 가장 일반적인 인증 폴더에 대한 권한을 확인한 후 문제를 Google에서 검색했을 때 .ssh에 있는 모든 파일이 올바른 사용자가 소유하고 있음을 발견했습니다.
Google이나 StackExchange의 다른 답변은 모두 오타나 권한 문제로 귀결되므로 도움이 되지 않았습니다. 출력은 이 질문에 제공된 것과 매우 유사/동일해 보입니다(이 사용자에 대한 SSH 키 인증이 실패하는 이유는 무엇입니까? (센토스 7)), 그러나 ssh-copy-id를 사용할 때 권한 오류가 발생하지 않기 때문에 그들에게 효과가 있었던 솔루션이 우리에게는 효과가 없습니다.
누구 아이디어나 제안이 있나요?
편집: 추가 관련 정보:
- 업데이트된 서버는 OpenSSH_7.4를 실행하고 있고 사람들이 SSH를 시도하는 다른 서버는 OpenSSH_5.3을 실행하고 있습니다.
- 이것은 ssh -vvv 출력입니다(편집됨).
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Connecting to {servername} [159.28.23.7] port 22. debug1: Connection established. debug1: identity file /{home directory}/{username}/.ssh/identity type -1 debug1: identity file /{home directory}/{username}/.ssh/identity-cert type -1 debug3: Not a RSA1 key file /{home directory}/{username}/.ssh/id_rsa. debug2: key_type_from_name: unknown key type '-----BEGIN' debug3: key_read: missing keytype debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug3: key_read: missing whitespace debug2: key_type_from_name: unknown key type '-----END' debug3: key_read: missing keytype debug1: identity file /{home directory}/{username}/.ssh/id_rsa type 1 debug1: identity file /{home directory}/{username}/.ssh/id_rsa-cert type -1 debug1: identity file /{home directory}/{username}/.ssh/id_dsa type -1 debug1: identity file /{home directory}/{username}/.ssh/id_dsa-cert type -1 debug1: identity file /{home directory}/{username}/.ssh/id_ecdsa type -1 debug1: identity file /{home directory}/{username}/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4 debug1: match: OpenSSH_7.4 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3 debug2: fd 3 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug3: Wrote 864 bytes for a total of 885 debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,[email protected] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,[email protected] debug2: kex_parse_kexinit: hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96 debug2: kex_parse_kexinit: hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96 debug2: kex_parse_kexinit: none,[email protected],zlib debug2: kex_parse_kexinit: none,[email protected],zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: found hmac-sha1 debug1: kex: server->client aes128-ctr hmac-sha1 none debug2: mac_setup: found hmac-sha1 debug1: kex: client->server aes128-ctr hmac-sha1 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug3: Wrote 24 bytes for a total of 909 debug2: dh_gen_key: priv key bits set: 152/320 debug2: bits set: 1019/2048 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug3: Wrote 272 bytes for a total of 1181 debug3: check_host_in_hostfile: host {servername} filename /{home directory}/{username}/.ssh/known_hosts debug3: check_host_in_hostfile: host {servername} filename /{home directory}/{username}/.ssh/known_hosts debug3: check_host_in_hostfile: match line 1 debug3: check_host_in_hostfile: host 159.28.23.7 filename /{home directory}/{username}/.ssh/known_hosts debug3: check_host_in_hostfile: host 159.28.23.7 filename /{home directory}/{username}/.ssh/known_hosts debug3: check_host_in_hostfile: match line 1 debug1: Host '{servername}' is known and matches the RSA host key. debug1: Found key in /{home directory}/{username}/.ssh/known_hosts:1 debug2: bits set: 1035/2048 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: Wrote 16 bytes for a total of 1197 debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug3: Wrote 52 bytes for a total of 1249 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /{home directory}/{username}/.ssh/identity ((nil)) debug2: key: /{home directory}/{username}/.ssh/id_rsa (0x7f769e632270) debug2: key: /{home directory}/{username}/.ssh/id_dsa ((nil)) debug2: key: /{home directory}/{username}/.ssh/id_ecdsa ((nil)) debug3: Wrote 84 bytes for a total of 1333 debug1: Authentications that can continue: publickey,password debug3: start over, passed a different list publickey,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Trying private key: /{home directory}/{username}/.ssh/identity debug3: no such identity: /{home directory}/{username}/.ssh/identity debug1: Offering public key: /{home directory}/{username}/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply debug3: Wrote 628 bytes for a total of 1961 debug1: Authentications that can continue: publickey,password debug1: Trying private key: /{home directory}/{username}/.ssh/id_dsa debug3: no such identity: /{home directory}/{username}/.ssh/id_dsa debug1: Trying private key: /{home directory}/{username}/.ssh/id_ecdsa debug3: no such identity: /{home directory}/{username}/.ssh/id_ecdsa debug2: we did not send a packet, disable method debug3: authmethod_lookup password debug3: remaining preferred: ,password debug3: authmethod_is_enabled password debug1: Next authentication method: password
편집 2: 이는 로컬 사용자에게는 발생하지 않고 모든 서버 간에 공유되는 위치에 사용자 디렉토리가 있는 사용자에게만 발생하는 것 같습니다.
답변1
해결책은 궁극적으로 PAM 자체와는 거의 관련이 없습니다. 문제는 실제로 SELinux와의 상호 작용입니다. 우리는 일반적으로 SELinux를 사용하지 않지만 기본적으로 SELinux가 설치되고 활성화되어 있다고 생각했습니다. 허용 모드로 설정하면 문제가 즉시 해결되었으며 사용자는 키를 다시 사용할 수 있었습니다.