인증키를 생성한 후에도 비밀번호를 묻는 메시지가 계속 표시됩니다.

인증키를 생성한 후에도 비밀번호를 묻는 메시지가 계속 표시됩니다.

저는 Macbook Pro를 가지고 있고, 원격 컴퓨터에 로그인할 때마다 비밀번호를 입력할 필요가 없도록 인증키 설정에 성공했습니다.

몇 년 후, 저는 Ubuntu가 설치된 새 컴퓨터를 구입했습니다. 지금 같은 일을 하려고 하는데 문제가 생겼습니다.

지금까지 ssh-keygen -t dsa폴더에 대한 권한을 ~/.ssh700으로, id_dsa*파일에 대한 권한을 600으로 변경했습니다.

원격 컴퓨터에서 파일을 업데이트했는데 authorised_keys이제 다음과 같습니다.

ssh-rsa KEYFORTHEOLDMACHINEWHICHISTILLUSE
ssh-dss KEYFORTHENEWMACHINE

그 사이에 공간이 있어요. 이것이 중요한지는 모르겠지만 그 사이에 공백과 개행 문자를 넣지 않고 시도했습니다.

내 서버의 권한이 위와 같은지 확인했습니다.

하지만 ssh들어가도 여전히 비밀번호를 묻는 메시지가 표시됩니다. 내가 잘못하고 있다는 것이 분명한가요?


고쳐 쓰다:

내가 실행하면 ls -ld ~/ ~/.ssh ~/.ssh/authorized_keys다음을 얻습니다.

drwxr-xr-x 5 myusername domain users       4096 Jun  8 20:58 /home/myusername/
drwx------ 2 myusername domain users       4096 Jun  8 18:06 /home/myusername/.ssh
-rw------- 1 myusername subdept-phys-sags 1044 Jun  8 18:06 /home/myusername/.ssh/authorized_keys

고쳐 쓰다:

내가 실행하면 ssh -vv remote_server다음을 얻습니다.

OpenSSH_7.2p2 Ubuntu-4, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /home/jg/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "ssh-gateway.physics.ac.uk" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to ssh-gateway.physics.ac.uk [163.1.240.41] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_rsa-cert type -1
debug1: identity file /home/jg/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/jg/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.7 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to ssh-gateway.physics.ac.uk:22 as 'brook'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:Ay2gqDucgtHyDl2rDdBifYSewyrqz1Tu9PZYU4FTeLU
debug1: Host 'ssh-gateway.physics.ac.uk' is known and matches the ECDSA host key.
debug1: Found key in /home/jg/.ssh/known_hosts:1
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: Skipping ssh-dss key /home/jg/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
debug2: key: /home/jg/.ssh/id_rsa ((nil))
debug2: key: /home/jg/.ssh/id_ecdsa ((nil))
debug2: key: /home/jg/.ssh/id_ed25519 ((nil))
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug2: we did not send a packet, disable method
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information No Kerberos credentials available
debug1: Unspecified GSS failure.  Minor code may provide more information No Kerberos credentials available
debug1: Unspecified GSS failure.  Minor code may provide more information
debug1: Unspecified GSS failure.  Minor code may provide more information No Kerberos credentials available
debug2: we did not send a packet, disable method
debug1: Next authentication method: publickey
debug1: Trying private key: /home/jg/.ssh/id_rsa
debug1: Trying private key: /home/jg/.ssh/id_ecdsa
debug1: Trying private key: /home/jg/.ssh/id_ed25519
debug2: we did not send a packet, disable method
debug1: Next authentication method: password

답변1

중요한 내용은 다음과 같습니다.

debug1: ssh-dss 키 /home/jg/.ssh/id_dsa 건너뛰기 - PubkeyAcceptedKeyTypes에 없음

~에서http://www.openssh.com/txt/release-7.0

  • ssh(1), sshd(8): 기본 알고리즘 세트를 교체하는 대신 추가할 수 있도록 Ciphers, MAC, KexAlgorithms, HostKeyAlgorithms, PubkeyAcceptedKeyTypes 및 HostbasedKeyTypes 옵션을 확장합니다. 이제 옵션 앞에 "+"를 붙여 기본값에 추가할 수 있습니다(예: "HostKeyAlgorithms=+ssh-dss").

/etc/ssh/ssh_config또는 에 다음을 추가해 보세요 .~/.ssh/config

PubkeyAcceptedKeyTypes +ssh-dss

참고: RSA를 사용하여 새 키를 생성하고 이 질문을 완전히 건너뛰는 대신(간단한 질문이면 ssh-keygen충분합니다)반품ssh-copy-id수동 키 복사 대신 권장됩니다 .

관련 정보