SSH 액세스에는 로컬 네트워크에서는 비밀번호가 필요하지만 공용 네트워크에서는 비밀번호가 필요합니다.

다른 서버로 SSH 연결하는 데 문제가 있습니다. SSH 키를 생성하여 다른 서버에 복사했습니다.

-bash-4.2$ whoami
postgres
-bash-4.2$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/pgsql/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /var/lib/pgsql/.ssh/id_rsa.
Your public key has been saved in /var/lib/pgsql/.ssh/id_rsa.pub.
The key fingerprint is:
96:fd:e7:5b:d2:b0:ac:b3:3e:7b:55:fd:ad:4f:9f:c5 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
|                 |
|                 |
|                .|
|         o      o|
|        S .   . +|
|       .   . . =+|
|            . =oE|
|            o+o++|
|           .=*o+o|
+-----------------+
-bash-4.2$ ssh-copy-id 192.168.2.75
The authenticity of host '192.168.2.75 (192.168.2.75)' can't be established.
ECDSA key fingerprint is 20:00:96:92:ff:a7:00:cb:a1:3a:30:fe:db:dd:55:c6.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '192.168.2.75'"
and check to make sure that only the key(s) you wanted were added.

하지만 여전히 비밀번호가 필요합니다

-bash-4.2$ ssh 192.168.2.75
[email protected]'s password:
Last login: Thu Mar 31 10:09:45 2016 from 192.168.2.138
-bash-4.2$ whoami
postgres
-bash-4.2$

연결된 호스트 이름:

-bash-4.2$ hostname
slave.localdomain.tld

커넥터 호스트 이름:

-bash-4.2$ hostname
master.localdomain.tld

하지만 난 접근할 수 있어루트 사용자비밀번호 없이.

-bash-4.2$ ssh-copy-id [email protected]
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

-bash-4.2$ ssh [email protected]
Last login: Thu Mar 31 10:10:20 2016 from 192.168.2.138
[root@slave ~]#

원격 서버에도 접속할 수 있어요포스트그레스 사용자비밀번호 없이

-bash-4.2$ ssh-copy-id 108.61.199.64 -p 2222
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh -p '2222' '108.61.199.64'"
and check to make sure that only the key(s) you wanted were added.

-bash-4.2$ ssh 108.61.199.64 -p 2222
Last login: Thu Mar 31 11:08:54 2016 from 78.189.14.197
-bash-4.2$ whoami
postgres
-bash-4.2$ hostname
postgresql.MYDOMAIN.COM

이게 마지막 몇 줄이야 SSH-vvv 산출:

debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /var/lib/pgsql/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /var/lib/pgsql/.ssh/id_dsa
debug3: no such identity: /var/lib/pgsql/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /var/lib/pgsql/.ssh/id_ecdsa
debug3: no such identity: /var/lib/pgsql/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /var/lib/pgsql/.ssh/id_ed25519
debug3: no such identity: /var/lib/pgsql/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password

누구든지 내가 뭘 잘못하고 있는지 도와줄 수 있나요?

편집하다:

권한은 다음과 같습니다루트&포스트그레스 사용자.

[root@localhost pgsql]# ll /var/lib/pgsql/
total 12
dr-xr-x---.  4 postgres postgres   67 Mar 31 09:57 .
drwxr-xr-x. 27 root     root     4096 Mar 31 13:15 ..
-rw-------.  1 postgres postgres 1350 Mar 31 13:02 .bash_history
-rwx------.  1 postgres postgres  268 Mar 30 14:15 .bash_profile
drwx------.  2 postgres postgres   76 Mar 31 10:46 .ssh
drwx------.  4 postgres postgres   48 Mar 31 09:30 9.5
[root@localhost pgsql]# ll /root/
total 32
dr-xr-x---.  4 root root 4096 Mar 31 09:31 .
dr-xr-xr-x. 17 root root 4096 Mar 31 09:37 ..
-rw-------.  1 root root 3389 Mar 31 10:59 .bash_history
-rw-r--r--.  1 root root   18 Dec 29  2013 .bash_logout
-rw-r--r--.  1 root root  176 Dec 29  2013 .bash_profile
-rw-r--r--.  1 root root  176 Dec 29  2013 .bashrc
-rw-r--r--.  1 root root  100 Dec 29  2013 .cshrc
drwxr-----.  3 root root   18 Mar 30 14:14 .pki
drwx------.  2 root root   76 Mar 31 12:51 .ssh
-rw-r--r--.  1 root root  129 Dec 29  2013 .tcshrc

여기있어/var/log/audit/audit.logSSH를 원할 때.

[root@localhost pgsql]# cat /var/log/audit/audit.log
type=CRYPTO_KEY_USER msg=audit(1459431065.262:1195): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=2b:3f:aa:b8:46:1d:b8:f9:d7:c2:16:96:67:68:f1:0d direction=? spid=3585 suid=74  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431065.262:1196): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3585 suid=74 rport=56439 laddr=192.168.2.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=USER_ERR msg=audit(1459431065.263:1197): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident grantors=? acct="?" exe="/usr/sbin/sshd" hostname=192.168.2.138 addr=192.168.2.138 terminal=ssh res=failed'
type=CRYPTO_KEY_USER msg=audit(1459431065.264:1198): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ef:0b:31:91:b7:38:45:42:88:6d:d5:d7:c2:f7:ee:6a direction=? spid=3584 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431065.265:1199): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=20:00:96:92:ff:a7:00:cb:a1:3a:30:fe:db:dd:55:c6 direction=? spid=3584 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431065.265:1200): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=2b:3f:aa:b8:46:1d:b8:f9:d7:c2:16:96:67:68:f1:0d direction=? spid=3584 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=USER_LOGIN msg=audit(1459431065.265:1201): pid=3584 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="postgres" exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=ssh res=failed'
type=CRYPTO_KEY_USER msg=audit(1459431066.776:1202): pid=3589 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ef:0b:31:91:b7:38:45:42:88:6d:d5:d7:c2:f7:ee:6a direction=? spid=3589 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431066.776:1203): pid=3589 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=20:00:96:92:ff:a7:00:cb:a1:3a:30:fe:db:dd:55:c6 direction=? spid=3589 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1459431066.776:1204): pid=3589 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=2b:3f:aa:b8:46:1d:b8:f9:d7:c2:16:96:67:68:f1:0d direction=? spid=3589 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_SESSION msg=audit(1459431066.777:1205): pid=3588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 [email protected] [email protected] spid=3589 suid=74 rport=56440 laddr=192.168.2.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=CRYPTO_SESSION msg=audit(1459431066.777:1206): pid=3588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 [email protected] [email protected] spid=3589 suid=74 rport=56440 laddr=192.168.2.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=? res=success'
type=AVC msg=audit(1459431066.945:1207): avc:  denied  { read } for  pid=3588 comm="sshd" name="authorized_keys" dev="dm-0" ino=47671 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:postgresql_db_t:s0 tclass=file
type=SYSCALL msg=audit(1459431066.945:1207): arch=c000003e syscall=2 success=no exit=-13 a0=7f1e85e81ac0 a1=800 a2=1 a3=7f1e7fa5e2e0 items=0 ppid=3551 pid=3588 auid=4294967295 uid=0 gid=0 euid=26 suid=0 fsuid=26 egid=26 sgid=0 fsgid=26 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
type=USER_AUTH msg=audit(1459431066.945:1208): pid=3588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="postgres" exe="/usr/sbin/sshd" hostname=? addr=192.168.2.138 terminal=ssh res=failed'

노트: 3개의 서버가 모두 실행 중입니다.Centos 7

로컬 서버:CentOS Linux release 7.1.1503 (Core)

원격 서버:CentOS Linux release 7.2.1511 (Core)