SSH 비밀번호 없이 원격 웹 서버에 로그인

2024-6-1 • tag-icon

나는 널리 받아 들여지는 답변을 따르고 있습니다터미널 - 비밀번호를 사용하지 않고 원격 웹 서버에 SSH로 접속하는 방법비밀번호 없이 원격 서버에 SSH 접속

github의 SSH 구성을 로컬 및 원격으로 설치했습니다. 이것은 두 번째 SSH 구성입니다.

또한 참조하십시오Linux/Mac 튜토리얼: SSH 키 기반 인증 - 비밀번호 없이 SSH를 사용하는 방법 - YouTube

로컬 Mac에서 새 키 쌍을 생성합니다.

$ sudo ssh-keygen -t rsa -b 4096 -f ~/.ssh/webserver
Generating public/private rsa key pair.
/Users/me/.ssh/webserver already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /Users/me/.ssh/webserver.
Your public key has been saved in /Users/me/.ssh/webserver.pub.
The key fingerprint is:
SHA256:Ux2ntGEN66Jvpr/eJyWagEHO3frJP51SlIJGP5zGBic [email protected]
The key's randomart image is:
+---[RSA 4096]----+
|            *o.  |
|      .   E+.B.  |
|     + . o.O=. . |

me at Max-2018 in ~/.ssh
$ ls
MyKeyPair.pem      config  id_rsa.pub   webserver
SecondKeyPair.pem  id_rsa  known_hosts  webserver.pub

새 키를 원격 서버(CentOS)에 복사

$ scp webserver.pub [email protected]:/root/.ssh/
[email protected]'s password:
webserver.pub                100%  745    45.3KB/s   00:00
[root@iz2ze9wve43n2nyuvmsfx5z .ssh]# cat webserver.pub  >> authorized_keys
[root@iz2ze9wve43n2nyuvmsfx5z .ssh]# cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8iFaLTdhR878LvznCn2PoiIG0ve5at7Bm4NtmLSmoCdNc7iAWoqQLtvx0WoX00TY0+GtaOF3n3P+O0LflIFV5B+m8Wh1PrpOP2fzBSrwQEL3UUtQ/Ti5vUd7FE2LUla8gjFglV83HFTFRwe2O4G6OutwmrBm0+

.ssh에 대한 권한 변경

#on the remote
[root@iz2ze9wve43n2nyuvmsfx5z ~]# chmod 700 ~/.ssh
[root@iz2ze9wve43n2nyuvmsfx5z ~]# chmod 700 ~/.ssh/*
#on the local
$ chmod 700 ~/.ssh
$ sudo chmod 700 ~/.ssh/*

구성

$ cat ~/.ssh/config
#the above part is the newly added.
Host myserver.com
 IdentityFile ~/.ssh/webserver
 User root

Host *
 AddKeysToAgent yes
 UseKeychain yes
 IdentityFile ~/.ssh/id_rsa

지금까지 "이렇게 하면 필요한 비밀번호 없는 키 쌍 기반 인증이 제공됩니다"라는 대답에 대한 모든 단계가 완료되었습니다.

안타깝게도:

$ ssh [email protected]
[email protected]'s password:

저는 YouTube의 엄지손가락 지침을 따랐습니다. Linux/Mac 튜토리얼: SSH 키 기반 인증 - 비밀번호 없이 SSH를 사용하는 방법 - YouTube

변화/etc/ssh/sshd_config

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

#Change to no to disable tunnelled clear text passwords
PasswordAuthentication no
# and restart
[root@iz2ze9wve43n2nyuvmsfx5z ~]# sudo systemctl restart sshd

로컬에서 다시 시도해 보세요.

[root@iz2ze9wve43n2nyuvmsfx5z ~]# ssh [email protected]
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

scp를 사용하여 솔루션을 검색합니다.

SSH 복사 ID

$ ssh-copy-id -i webserver.pub [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "webserver.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

다른 영상도 확인해요비밀번호 없는 SSH 튜토리얼 - YouTube |

이를 달성하려면 1단계와 2단계를 사용하세요.

changmod to 600

$ sudo ls -al .ssh 
total 32
drw-------  10 me staff  320 Dec  1 00:13 .
drwxr-xr-x+ 67 me staff 2144 Dec  1 00:01 ..
-rw-------   1 me staff 1696 Sep  1 10:15 MyKeyPair.pem
-rw-------   1 me staff 1692 Sep  1 23:21 SecondKeyPair.pem
-rw-------   1 me staff  137 Dec  1 00:01 config
-rw-------   1 me staff 3243 Feb 27  2018 id_rsa
-rw-------   1 me staff  749 Feb 27  2018 id_rsa.pub
-rw-------   1 me staff 3760 Nov  5 19:33 known_hosts
-rw-------   1 me staff 3389 Nov 30 23:22 webserver
-rw-------   1 me staff  745 Nov 30 23:22 webserver.pub

$ sudo ssh [email protected]
[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

내 시도에 문제가 있나요?

$ ssh [email protected] -vvv
OpenSSH_7.8p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/me/.ssh/config
debug1: /Users/me/.ssh/config line 2: Applying options for myserver.com
debug1: /Users/me/.ssh/config line 7: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Connecting to myserver.com port 22.
debug1: Connection established.
debug1: identity file /Users/me/.ssh/webserver type 0
debug1: identity file /Users/me/.ssh/webserver-cert type -1
debug1: identity file /Users/me/.ssh/id_rsa type 0
debug1: identity file /Users/me/.ssh/id_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug3: fd 5 is O_NONBLOCK
debug1: Authenticating to myserver.com:22 as 'root'
debug3: hostkeys_foreach: reading file "/Users/me/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/me/.ssh/known_hosts:12
debug3: load_hostkeys: loaded 1 keys from myserver.com
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:qeZuH78znSba00AGex2oz/uhGTgSuzt0hnl8cT9uup4
debug3: hostkeys_foreach: reading file "/Users/me/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/me/.ssh/known_hosts:12
debug3: load_hostkeys: loaded 1 keys from myserver.com
debug3: hostkeys_foreach: reading file "/Users/me/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/me/.ssh/known_hosts:8
debug3: load_hostkeys: loaded 1 keys from 39.105.51.157
debug1: Host 'myserver.com' is known and matches the ECDSA host key.
debug1: Found key in /Users/me/.ssh/known_hosts:12
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /Users/me/.ssh/webserver (0x7fc3c8701580), explicit
debug2: key: /Users/me/.ssh/id_rsa (0x7fc3c8412d90), explicit
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:Ux2ntGEN66Jvpr/eJyWagEHO3frJP51SlIJGP5zGBic /Users/me/.ssh/webserver
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Offering public key: RSA SHA256:tAc3DhpRdOeAORzhbMTFq0yG+dPFkXmWMYO0dGE/veE /Users/me/.ssh/id_rsa
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

sshd_config서버에서:

[root@iz2ze9wve43n2nyuvmsfx5z ssh]# cat sshd_config
#   $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#ListenAddress 0.0.0.0
#ListenAddress ::

HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile  .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PAM authentication via ChallengeResponseAuthentication may bypass
# If you just want the PAM account and session checks to run without
# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

# override default of no subsystems
Subsystem   sftp    /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server
UseDNS no
AddressFamily inet
PermitRootLogin yes
SyslogFacility AUTHPRIV
PasswordAuthentication no

대체 테스트:

$ /usr/sbin/sshd -d -p 2222
debug1: sshd version OpenSSH_7.8, LibreSSL 2.7.3
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Could not load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.

$ sudo /usr/sbin/sshd -d -p 2222
Password:
debug1: sshd version OpenSSH_7.8, LibreSSL 2.7.3
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Could not load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.

답변1

수행한 단계에 따라 id_rsa는 700 대신 600으로 설정되어야 합니다. 그렇기 때문에 서버에 SSH를 연결할 수 없는 것 같습니다. 내가 언급하는 단계는 다음과 같습니다.

[root@iz2ze9wve43n2nyuvmsfx5z ~]# chmod 700 ~/.ssh
[root@iz2ze9wve43n2nyuvmsfx5z ~]# chmod 700 ~/.ssh/*
#on the local
$ chmod 700 ~/.ssh
$ sudo chmod 700 ~/.ssh/*

두 번째 chmod 명령은 600으로 설정되어야 합니다.

답변2

Mac에서 Linux로 SSH를 통해 연결하는 경우:

일시적으로 서버를 켜십시오 PasswordAuthentication on.

ssh-keygen -b 4096 -t rsa **on the Mac. Like you did**..

이 새 키를 사용해야 합니다.

그런 다음 다음을 설정해야 합니다.

ServerKeyBits 4096 **in sshd_config on the Linux server**.

그럼 ssh-copy-id someuser@somehost 그 다음엔 ssh someuser@somehost돌아봐PasswordAuthentication off

계속 진행되어야 합니다. 또한 공통된 비밀번호가 있는지 확인하십시오.

나는 이것이 효과가 있다는 것을 알고 있습니다:https://serverfault.com/a/940634/496863

답변3

$ sudo /usr/sbin/sshd -d -p 2222
Password:
debug1: sshd version OpenSSH_7.8, LibreSSL 2.7.3
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Could not load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.

로그에 따르면 서버 키가 없는 것 같습니다. 귀하의 질문에 따르면 sshd어떻게 설치되었는지 잘 모르겠습니다 . 일반적으로 패키지를 설치할 때 설치 후 스크립트가 이러한 키를 생성합니다. 어쩌면 다른 방법으로 설치한 걸까요?

하지만 이러한 키가 없으면 최소한 하나를 생성해야 합니다.

다음을 사용하여 ssh-keygen키를 만듭니다 .sshd

$ sudo ssh-keygen -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519

인용하다:https://linux-audit.com/using-ed25519-openssh-keys-instead-of-dsa-rsa-ecdsa/

답변1

답변2

답변3

관련 정보