无法以tty-less用户身份登录


10

我试图通过从没有tty的用户(我的apache服务器运行为该用户)的用户调用ssh(使用密钥认证)来运行单个命令,并一直得到以下结果:

OpenSSH_5.9p1, OpenSSL 1.0.0g 18 Jan 2012
Pseudo-terminal will not be allocated because stdin is not a terminal.
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to localhost [::1] port 54367.
debug1: Connection established.
debug1: identity file nonpublic/id_rsa type 1
debug1: identity file nonpublic/id_rsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9
debug1: match: OpenSSH_5.9 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA e3:c2:37:8e:8b:d4:77:63:7f:d2:ba:12:e5:e9:d1:9a
debug1: checking without port identifier
debug1: read_passphrase: can't open /dev/tty: No such device or address
Host key verification failed.

调用ssh时设置-t标志。密钥没有密码短语,该密码短语可以抑制对任何输入的需求,但显然没有。如何防止ssh尝试打开/ dev / tty?

编辑:代码标签不起作用?

Edit2:完整的ssh命令:

ssh -i nonpublic/id_rsa -l username -p 54367 -t -v username@localhost /home/username/minecraftserver/Scripts/start 2>&1

我已经用“用户名”替换了用户名。

Edit3:我尝试使用与root相同的密钥进行ssh-ing并得到以下结果:

OpenSSH_5.9p1, OpenSSL 1.0.0g 18 Jan 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to localhost [::1] port 54367.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /srv/http/nonpublic/id_rsa type 1
debug1: identity file /srv/http/nonpublic/id_rsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9
debug1: match: OpenSSH_5.9 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA e3:c2:37:8e:8b:d4:77:63:7f:d2:ba:12:e5:e9:d1:9a
debug1: checking without port identifier
The authenticity of host '[localhost]:54367 ([::1]:54367)' can't be established.
ECDSA key fingerprint is e3:c2:37:8e:8b:d4:77:63:7f:d2:ba:12:e5:e9:d1:9a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[localhost]:54367' (ECDSA) to the list of known hosts.
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /srv/http/nonpublic/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Enter passphrase for key '/srv/http/nonpublic/id_rsa':
debug1: No more authentication methods to try.
Permission denied (publickey).

即使不需要,它也会提示我输入密码。此外,我可以使用该密钥在Windows机器上使用PuTTY进行ssh操作,并且不会提示我输入密码。

Edit4:我将服务器添加到了apache用户known_hosts中,现在我得到了:

OpenSSH_5.9p1, OpenSSL 1.0.0g 18 Jan 2012
Pseudo-terminal will not be allocated because stdin is not a terminal.
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to localhost [::1] port 54367.
debug1: Connection established.
debug1: identity file nonpublic/id_rsa type 1
debug1: identity file nonpublic/id_rsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9
debug1: match: OpenSSH_5.9 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA e3:c2:37:8e:8b:d4:77:63:7f:d2:ba:12:e5:e9:d1:9a
debug1: Host '[localhost]:54367' is known and matches the ECDSA host key.
debug1: Found key in /srv/http/.ssh/known_hosts:1
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: nonpublic/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: No more authentication methods to try.
Permission denied (publickey).`

另外,这是known_hosts的内容:

[localhost]:54367 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBILr7jLp5CeYfyrCroaDjkaWgDHXRrQD+G8Fz/CQOY1PcluUFTkrN447bXmC6R27LOClE+RPaveYb4MOlObpGGE=

为什么说ecdsa?这是一个rsa密钥。

Edit5:解决。问题在于密钥对是由PuTTY生成的,它以与OpenSSH不兼容的格式写入私钥。cjc在评论中提供的解决方案。


回复:代码标签。不可以,使用反引号括住代码,或者在行的前面放置4个空格。
cjc 2012年

完整的ssh命令是什么?
cjc 2012年

你为什么要通过-t
Zoredache

@Zoredache认为这会有所帮助。一些网站建议。
Surma 2012年

1
@ Surma,ecdsa是指服务器的密钥,而不是客户端上的密钥。
amcnabb 2012年

Answers:


11

实际上,问题似乎并不在于它正在尝试读取密码短语,这只是一个警告。而是尝试进行主机密钥验证,但失败了。如果您真的希望它从不询问主机密钥,请考虑在ssh命令行中添加以下选项:

-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null

请注意,这可能涉及安全性,因此请务必阅读ssh_config手册页中的这些选项。

编辑:给定您更新的错误消息,似乎您有损坏的身份文件(或cjc指出,它的格式可能错误)。尝试使用ssh-keygen手动创建一个新的,然后将其添加到服务器的authorized_keys中。


您似乎是对的,我只是尝试将密钥用作根用户。结果为OP。
Surma 2012年

1
实际上,除了使用StrictHostKeyChecking = no之外,您还可以获取服务器的公钥并将其粘贴在用户的.ssh / known_host文件中。或将其放在系统范围内的known_hosts文件中。
cjc 2012年

@cjc,我同意通常是更好的解决方案。
amcnabb 2012年

@cjc我从根目录(将服务器添加到已知主机)复制了known_hosts,并设置了正确的权限。我现在得到不同的输出,请检查OP。
Surma

1
@amcnabb您提到您在PuTTY中使用了密钥。您是否将密钥转换为OpenSSH?
cjc 2012年

0

出于兴趣,将环境设置为什么/etc/passwd-缺少环境/bin/bash可能是您的问题。


/ bin / false我可能应该提到这是由php运行的,当您调用shell_exec()时,它显然会生成一个shell(这就是我用来运行此程序的原因)。
Surma 2012年

1
明白了 那么在那种情况下,为什么不只使用pecl.php.net/package/ssh2-而不是与shell_exec()
Ben Lessani-Sonassi,2012年

那是一个好主意。
Surma 2012年

当然,您确实应该在问题中解释您正在尝试通过PHP进行此操作-因为我提供的答案可以更准确地解决您的问题。
Ben Lessani-Sonassi 2012年
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.