E a mensagem exibida duas vezes nos logs de depuração:
Authentication refused: bad ownership or modes for directory /root
Corrija as permissões de /root e veja onde isso leva você.
Estou executando uma versão do Linux 2.6.27-vpac2 em uma plataforma PXA270 (armv5tel) Eu tenho uma versão do OpenSSH 3.8.1 p1 (Debian-8.sarge.4) tentando rodar nele. Eu executei o sshd no formato -ddd para depurar e abaixo está o resultado quando tento conectar:
root@thisslave:~/.ssh$ /usr/sbin/sshd -ddd -f /etc/ssh/sshd_config
debug2: read_server_config: filename /etc/ssh/sshd_config
debug1: sshd version OpenSSH_3.8.1p1 Debian-8.sarge.4
debug1: private host key: #0 type 0 RSA1
debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
socket: Address family not supported by protocol
debug1: Server will not fork when running in debugging mode.
Connection from 192.168.1.101 port 40520
debug1: Client protocol version 2.0; client software version OpenSSH_5.8p1 Debian-7ubuntu1
debug1: match: OpenSSH_5.8p1 Debian-7ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1 Debian-8.sarge.4
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,[email protected],aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,[email protected],aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],ssh-rsa,[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug2: dh_gen_key: priv key bits set: 134/256
debug2: bits set: 518/1024
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug2: bits set: 538/1024
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
debug2: input_userauth_request: setting up authctxt for root
debug2: input_userauth_request: try method none
Failed none for root from 192.168.1.101 port 40520 ssh2
debug1: userauth-request for user root service ssh-connection method publickey
debug1: attempt 1 failures 1
debug2: input_userauth_request: try method publickey
debug1: test whether pkalg/pkblob are acceptable
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys
debug3: secure_filename: checking '/root/.ssh'
debug3: secure_filename: checking '/root'
Authentication refused: bad ownership or modes for directory /root
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys
debug3: secure_filename: checking '/root/.ssh'
debug3: secure_filename: checking '/root'
Authentication refused: bad ownership or modes for directory /root
debug1: restore_uid: 0/0
debug2: userauth_pubkey: authenticated 0 pkalg ssh-rsa
Failed publickey for root from 192.168.1.101 port 40520 ssh2
debug1: userauth-request for user root service ssh-connection method keyboard-interactive
debug1: attempt 2 failures 2
debug2: input_userauth_request: try method keyboard-interactive
debug1: keyboard-interactive devs
debug1: auth2_challenge: user=root devs=
debug1: kbdint_alloc: devices 'pam'
debug2: auth2_challenge_start: devices pam
debug2: kbdint_next_device: devices <empty>
debug1: auth2_challenge_start: trying authentication method 'pam'
debug3: PAM: sshpam_init_ctx entering
Failed keyboard-interactive for root from 192.168.1.101 port 40520 ssh2
Connection closed by 192.168.1.101
debug1: do_cleanup
Algumas coisas a serem observadas:
1) Estou usando chaves que estão sendo usadas atualmente em dois outros servidores (da mesma plataforma e compilação do kernel do Linux)
2) Eu defini as permissões de acordo com o diretório .ssh (700), authorized_keys (644). Para o servidor, acho que estes são os necessários, por favor corrija-me se estiver errado.
3) Se eu desativar a configuração StrictMode (ou seja, defina como 'não'). Eu sou capaz de me conectar. Mas acredito que isso é algo que eu não deveria fazer, porque os outros dois servidores sshd em execução não têm essa configuração como 'não'.
Estou realmente perplexo e tentando resolver as coisas com a permissão de cerca de uma semana agora. Esperando que alguém lance algumas idéias do meu jeito.
Acabei de ter o mesmo caso: bad ownership on /xxx (a pasta superior).
Todos os outros requisitos usuais do ssh foram atendidos no meu caso:
w ' para ir a qualquer lugar (grupo ou outros) .ssh
.ssh/authorized_keys
E, no entanto, uma sessão sshd -d é exibida de forma consistente
Authentication refused: bad ownership or modes for directory /xxx
A única discrepância que encontrei é que /xxx/yyy era próprio de root , enquanto /xxx era de propriedade de " aUser ".
Eu fiz como root a chown root:root /xxx
E o erro desapareceu.
O problema foi impresso no seu log:
Authentication refused: bad ownership or modes for directory /root
Verifique as permissões do diretório base do usuário root, /root .
Um exemplo de permissões de trabalho de um servidor ativo:
error@www ~ $ ls -ld /root
drwx------. 6 root root 4096 Oct 16 19:12 /root
Uma resposta mais abrangente é encontrada nesta postagem do blog: link
A versão TL; DR é (as permissões são bastante específicas):
chmod go-w /home/your-user
chmod 700 /home/your-user/.ssh
chmod 600 /home/your-user/.ssh/authorized_keys*
Além disso, se o diretório home do seu usuário for um symlink, você também deverá segui-lo e chmod go-w / chmod 755.
Tags ssh authentication rsa