Chaves SSH configuradas e registros mostram sucesso, mas ainda solicitando senha?

Question

Isso nunca funcionou corretamente, eu não acho. Não me lembro, só tenho introduzido a senha todo esse tempo. Eu admin dez servidores de carga balanceada, mas estou acessando-os internamente via ip's internos. Quando eu ssh-copy-id minha chave para o sistema remoto, parece que ele autentica com sucesso, mas ainda me pede uma senha. Minha pasta .ssh tem permanentes de 600, somente known_hosts tem 644 e outros servidores em que as chaves trabalham têm o mesmo perms. / var / log / secure diz que foi aceito. Todas as permissões em / etc / ssh / * são 644. Alguma idéia? Obrigado antecipadamente!

**/var/log/secure**
Jul 25 07:30:55 X sshd[25970]: Accepted password for user from 172.29.2.133 port 23423 ssh2
Jul 25 07:30:55 X sshd[25970]: pam_unix(sshd:session): session opened for user user by (uid=0)
Jul 25 07:37:27 X sudo: pam_unix(sudo:auth): conversation failed
Jul 25 07:37:27 X sudo: pam_unix(sudo:auth): auth could not identify password for [user]
Jul 25 07:38:15 X sudo:   user: TTY=pts/1 ; PWD=/home/user ; USER=root ; COMMAND=/usr/bin/less /var/log/secure

**ssh -v output**
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014                                                            
debug1: Reading configuration data /etc/ssh/ssh_config                                              
debug1: /etc/ssh/ssh_config line 29: Applying options for *                                         
debug1: Connecting to X [172.20.2.131] port 22.                                              
debug1: Connection established.                                                                     
debug1: identity file /home/user/.ssh/id_rsa type 1                                               
debug1: identity file /home/user/.ssh/id_rsa-cert type -1                                         
debug1: identity file /home/user/.ssh/id_dsa type -1                                              
debug1: identity file /home/user/.ssh/id_dsa-cert type -1                                         
debug1: identity file /home/user/.ssh/id_ecdsa type -1                                            
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1                                       
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0                               
debug1: channel 0: free: client-session, nchannels 1                                                
Connection to X closed.                                                                      
Transferred: sent 11752, received 9832 bytes, in 262.0 seconds                                      
Bytes per second: sent 44.9, received 37.5                                                          
debug1: Exit status 0                                                                               
user@AUR-000229:/mnt/c/Users/user$ ssh -v X
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014                                                            
debug1: Reading configuration data /etc/ssh/ssh_config                                              
debug1: /etc/ssh/ssh_config line 29: Applying options for *                                         
debug1: Connecting to X [172.20.2.131] port 22.                                              
debug1: Connection established.                                                                     
debug1: identity file /home/user/.ssh/id_rsa type 1                                               
debug1: identity file /home/user/.ssh/id_rsa-cert type -1                                         
debug1: identity file /home/user/.ssh/id_dsa type -1                                              
debug1: identity file /home/user/.ssh/id_dsa-cert type -1                                         
debug1: identity file /home/user/.ssh/id_ecdsa type -1                                            
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1                                       
debug1: identity file /home/user/.ssh/id_ed25519 type -1                                          
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1                                     
debug1: Enabling compatibility mode for protocol 2.0                                                
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8                              
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3                            
debug1: match: OpenSSH_4.3 pat OpenSSH_4* compat 0x00000000                                         
debug1: SSH2_MSG_KEXINIT sent                                                                       
debug1: SSH2_MSG_KEXINIT received                                                                   
debug1: kex: server->client aes128-ctr hmac-md5 none                                                
debug1: kex: client->server aes128-ctr hmac-md5 none                                                
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent                                            
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP                                                         
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent                                                               
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY                                                         
debug1: Server host key: RSA 8a:0f:76:f8:55:e7:65:25:10:ae:f3:d9:3c:dd:48:0a                        
debug1: Host 'X' is known and matches the RSA host key.                                      
debug1: Found key in /home/user/.ssh/known_hosts:10                                               
debug1: ssh_rsa_verify: signature correct                                                           
debug1: SSH2_MSG_NEWKEYS sent                                                                       
debug1: expecting SSH2_MSG_NEWKEYS                                                                  
debug1: SSH2_MSG_NEWKEYS received                                                                   
debug1: SSH2_MSG_SERVICE_REQUEST sent                                                               
debug1: SSH2_MSG_SERVICE_ACCEPT received                                                            
debug1: Authentications that can continue: password                                                 
debug1: Next authentication method: password                                                        
user@X's password:                                                                         
debug1: Authentication succeeded (password).                                                        
Authenticated to X ([172.20.2.131]:22).                                                      
debug1: channel 0: new [client-session]                                                             
debug1: Entering interactive session.                                                               
debug1: Sending environment.                                                                        
debug1: Sending env LANG = en_US.UTF-8                                                              
Last login: Tue Jul 25 07:26:18 2017 from 172.29.2.133   



**Another server who with the same setup, keys work.**
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014

debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 29: Applying options for *
debug1: Connecting to X [172.20.2.132] port 22.
debug1: Connection established.
debug1: identity file /home/user/.ssh/id_rsa type 1
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3
debug1: match: OpenSSH_4.3 pat OpenSSH_4* compat 0x00000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 15:5c:e0:96:15:6c:18:85:e8:e8:86:ab:3a:e7:7e:b7
debug1: Host 'X' is known and matches the RSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:25
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/user/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to X ([172.20.2.132]:22).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Last login: Tue Jul 25 07:27:19 2017 from 172.29.2.133                  

    

Answer 1

Não contradizer ninguém, mas se o servidor só estiver solicitando autenticação de senha, seu cliente não oferecerá uma chave.

Na sua depuração acima:

debug1: Authentications that can continue: password
debug1: Next authentication method: password
user@X's password:
debug1: Authentication succeeded (password).
Authenticated to X ([172.20.2.131]:22).

O servidor ao qual você está se conectando não oferece (o cliente) para fornecer um PSK. O sshd_config do servidor deve ter o seguinte:

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys

Para comparação, esta é minha saída de depuração do ssh para um servidor que está corretamente disposto a aceitar a autenticação de chave pública:

debug1: Authentications that can continue: publickey,keyboard-interactive

debug1: Next authentication method: publickey

debug1: Offering RSA public key: imported-openssh-key

debug1: Server accepts key: pkalg rsa-sha2-512 blen 151

debug1: Single to Multithread CTR cipher swap - client request

debug1: Authentication succeeded (publickey).

- desculpe pela má formatação -

    

Answer 2

Como Datmocc sugere, verifique a propriedade do arquivo authorized_keys no servidor, bem como a propriedade do id_rsa arquivo localmente. Você também deve garantir que somente o proprietário tenha permissão de leitura ( chmod 400 <file> ). Dê uma olhada na saída de log do sshd no servidor quando ele for iniciado, ele irá reclamar se houver um problema com essas permissões.

O log de depuração da sua sessão ssh mostra que ele não fornece a chave privada para autenticação (como sugerido no título da pergunta), e pelo que parece, seu servidor nem anuncia aceitar autenticação de chave privada. Um log de depuração de uma sessão de autenticação de chave privada bem-sucedida deve conter algo como:

debug1: Authentications that can continue: publickey,**others
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/user/.ssh/id_rsa
debug1: Server accepts key: pkalg rsa-sha2-512 blen 407
debug1: Authentication succeeded (publickey).

Até o servidor informar Authentications that can continue: publickey , seu cliente nunca oferecerá um.