質問: 公開鍵ssh認証の使用方法 2つのubuntu12.04(ベータ)サーバー(node1とnode2)があり、それらの間にパスワードなしのルートアクセスを確立したいと考えています。他のユーザーは他のボックスにアクセスできないようにする必要があります。また、sshのデフォルトポートが220に変更されていることにも注意してください。これが私がしたことです:sudo -i cd /root/.ssh ssh-keygen -t rsa # with default name and empty password cat id_rsa.pub > authorized_keys 次に、id_rsaとid_rsa.pubをnode2にコピーし、id_rsa.pubをauthorized_keysに追加しました。両方のホストに同じ/root/.ssh/configファイルがあります。host node1 hostname 1.2.3.4 port 220 identityfile /root/.ssh/id_rsa host node2 hostname 5.6.7.8 port 220 identityfile /root/.ssh/id_rsa ここで問題となるのは、ssh node2と入力すると、パスワードの入力を求められることです。何が問題なのですか?更新:クライアントのデバッグ情報:debug1: server host key: rsa *** debug1: host '[*.*.*.*]:220' is known and matches the rsa host key. debug1: found key in /root/.ssh/known_hosts:6 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: ssh2_msg_newkeys sent debug1: expecting ssh2_msg_newkeys debug2: set_newkeys: mode 0 debug1: ssh2_msg_newkeys received debug1: roaming not allowed by server debug1: ssh2_msg_service_request sent debug2: service_accept: ssh-userauth debug1: ssh2_msg_service_accept received debug2: key: /root/.ssh/id_rsa ((nil)) debug1: authentications that can continue: publickey,password debug1: next authentication method: publickey debug1: trying private key: /root/.ssh/id_rsa debug1: read pem private key done: type rsa debug2: we sent a publickey packet, wait for reply debug1: authentications that can continue: publickey,password debug2: we did not send a packet, disable method debug1: next authentication method: password サーバーのデバッグ情報:debug1: userauth-request for user root service ssh-connection method none [preauth] debug1: attempt 0 failures 0 [preauth] debug1: pam: initializing for "root" debug1: pam: setting pam_rhost to "*.*.*.*" debug1: pam: setting pam_tty to "ssh" debug1: userauth-request for user root service ssh-connection method publickey [preauth] debug1: attempt 1 failures 0 [preauth] debug1: test whether pkalg/pkblob are acceptable [preauth] debug1: checking blacklist file /usr/share/ssh/blacklist.rsa-2048 debug1: checking blacklist file /etc/ssh/blacklist.rsa-2048 debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: trying public key file /root/.ssh/authorized_keys debug1: fd 4 clearing o_nonblock debug1: matching key found: file /root/.ssh/authorized_keys, line 2 found matching rsa key: **** debug1: restore_uid: 0/0 debug3: mm_answer_keyallowed: key 0x7f0647b0c1b0 is allowed debug3: mm_request_send entering: type 22 debug2: userauth_pubkey: authenticated 0 pkalg ssh-rsa [preauth] postponed publickey for root from *.*.*.* port 38887 ssh2 [preauth] 権限:drwx------ 2 root root 4096 mar 26 15:34 .ssh -rw------- 1 root root 840 mar 26 14:50 authorized_keys -rw-r--r-- 1 root root 225 mar 26 15:34 config -rw------- 1 root root 1679 mar 26 14:47 id_rsa -rw-r--r-- 1 root root 2652 mar 26 14:39 known_hosts 設定ファイルからのいくつかの行:permitrootlogin without-password rsaauthentication yes pubkeyauthentication yes authorizedkeysfile %h/.ssh/authorized_keys usepam no # also tried yes
回答: デバッグするには、loglevel debugの/etc/ssh/sshd_configを使用します。考えられる落とし穴の1つは、.sshの下にあるはずの/home/someuser/ディレクトリを/root/に置くことです。