Eu tenho o SSH configurado com pares de chaves pública / privada separados para cada servidor que eu acesso regularmente, e configuro essas identidades na configuração SSH.
Na primeira vez que eu me conectar a um novo servidor privado, no entanto, precisarei usar uma senha para copiar minha chave pública no arquivo authorized_keys.
Atualmente, se o PubkeyAuthentication estiver habilitado, quando eu executar ssh -v <new-server> , tento usar minha chave privada padrão três vezes antes de falhar com o erro "muitas tentativas com falha". Por que iria tentar uma chave SSH uma segunda ou terceira vez depois que ela falhou uma vez está além de mim - não é como se ele tivesse digitado uma senha.
Como posso configurá-lo para que ele tente usar apenas um arquivo de identidade uma vez e depois voltar para a autenticação de senha?
Minha solução atual (em vez de manual) é:
PubkeyAuthentication no
PubkeyAuthentication como yes
Por alguns dos comentários, aqui estão os logs quando tento conectar-me a um novo servidor (removi o arquivo authorized_keys desse servidor antes de fazer isso para forçar o erro)
{11:48}|~/s/qos >ssh -v sbarnett.vm
OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /home/sbarnett/.ssh/config
debug1: /home/sbarnett/.ssh/config line 30: Applying options for sbarnett.vm
debug1: /home/sbarnett/.ssh/config line 62: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Executing proxy command: exec ssh -q -W sbarnett.vm.domain.com:22 jumphost
debug1: key_load_public: No such file or directory
debug1: permanently_drop_suid: 1000
debug1: identity file /home/sbarnett/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sbarnett/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sbarnett/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sbarnett/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sbarnett/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sbarnett/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sbarnett/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sbarnett/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to sbarnett.vm.domain.com:22 as 'sbarnett'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:m9EW13TUteWcf/0vkNdFRFjwRhoe28neqN77B71DX8M
debug1: Host 'sbarnett.vm.domain.com' is known and matches the ECDSA host key.
debug1: Found key in /home/sbarnett/.ssh/known_hosts:16
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
WARNING. You have accessed a private computer system. Unauthorized access,
use, connection, or entry is not permitted and constitutes a crime
punishable by law. We reserve the right to fully pursue criminal and civil
legal penalties. All individuals using this computer system with or without
proper authority are subject to having all their activities monitored and
recorded. Anyone using this system implicitly consents to this monitoring.
Any evidence of suspected criminal activity revealed by such monitoring may
be provided to law enforcement officials
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: sbarnett@Gimli
debug1: Authentications that can continue: publickey,password
debug1: Offering RSA public key: sbarnett@Gimli
debug1: Authentications that can continue: publickey,password
debug1: Offering RSA public key: sbarnett@Gimli
debug1: Authentications that can continue: publickey,password
debug1: Offering RSA public key: sbarnett@Gimli
debug1: Authentications that can continue: publickey,password
debug1: Offering RSA public key: sbarnett@Gimli
debug1: Authentications that can continue: publickey,password
debug1: Offering RSA public key: sbarnett@Gimli
Received disconnect from UNKNOWN port 0:2: Too many authentication failures
debug1: Authentication succeeded (publickey).
Authenticated to sbarnett.vm.domain.com (via proxy).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: proc
packet_write_wait: Connection to UNKNOWN port 0: Broken pipe
see it trying to use my default private key three times before failing with the error "too many failed attempts".
Isso não é possível. Não vai usar a mesma chave mais vezes se for rejeitada. Pode estar usando outras chaves padrão embora ...
How can I configure it so that it will only try to use an identity file once, then fall back to password authentication?
Você pode configurar o cliente para ignorar chaves públicas por
ssh -oPubkeyAuthentication=no <new-server>