☰

키를 사용하는 두 서버 간의 scp 권한이 거부되었습니다(공개 키)

tag-icon • tag-icon scp
키를 사용하는 두 서버 간의 scp 권한이 거부되었습니다(공개 키)

두 서버 모두 동일한 키를 사용합니다. 로그에서 아무 것도 발견하지 못했습니다.

$ scp -vvv -i /home/user/myPrivateKey.key /dev [email protected]:~/home/user
Executing: program /usr/bin/ssh host 10.xxx.xxx.xxx, user user, command scp -v -t /home/user
OpenSSH_6.7p1 Debian-5+deb8u3, OpenSSL 1.0.1t  3 May 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: /etc/ssh/ssh_config line 57: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 10.xxx.xxx.xxx [10.xxx.xxx.xxx] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/myPrivateKey.key type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/myPrivateKey.key-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4p1 Debian-10+deb9u2
debug1: match: OpenSSH_7.4p1 Debian-10+deb9u2 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "10.xxx.xxx.xxx" from file "/root/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /root/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa$
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,di$
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-e$
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,a$
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],[email protected],arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,a$
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-25$
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-25$
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-gr$
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-25$
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-25$
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup [email protected]
debug1: kex: server->client aes128-ctr [email protected] none
debug2: mac_setup: setup [email protected]
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 20:53:50:b4:4f:9e:4e:86:82:7a:dc:44:82:d4:c1:8a
debug3: load_hostkeys: loading entries for host "10.xxx.xxx.xxx" from file "/root/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /root/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys
debug1: Host '10.xxx.xxx.xxx' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/user/myPrivateKey.key ((nil)), explicit
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/myPrivateKey.key
debug3: sign_and_send_pubkey: RSA 96:2e:35:c2:25:6a:a8:b8:21:48:43:24:a3:69:c0:df
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).
lost connection

답변1

debug1: Trying private key: /home/user/myPrivateKey.key
debug3: sign_and_send_pubkey: RSA 96:2e:35:c2:25:6a:a8:b8:21:48:43:24:a3:69:c0:df
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey

SSH 클라이언트가 개인 키를 보냈지만 이전 스타일의 키 해시로 인해 SSH 프로토콜 버전 1.x 키일 수 있다고 생각됩니다. 원격 버전은 Debian의 OpenSSH 7.4p1입니다. 이 버전은 더 이상 사용되지 않고 치명적인 보안 결함이 있는 것으로 밝혀졌기 때문에 SSH 프로토콜 버전 1.x 지원을 완전히 제거합니다.

그렇지 않은 경우 이러한 메시지는 서버가 키를 승인하지 않음을 나타냅니다. 서버의 인증 로그(Debian)를 확인해야 합니다. /var/log/auth.log대상 사용자의 홈 디렉터리, 하위 디렉터리 또는 파일의 권한에 문제가 있는 경우 이에 대한 메시지가 표시되어야 합니다.~/.ssh~/.ssh/authorized_keys

가장 일반적인 문제는 잘못된 소유권 또는 너무 많은 쓰기 권한입니다. authorized_keys계정 소유자만 파일에 쓸 수 있도록 파일을 보호해야 합니다. 그렇지 않으면 sshd파일이 완전히 무시됩니다.

관련 정보