SSH权限被拒绝（公共密钥），但root ssh可以工作

我正在尝试为我在数字海洋ubuntu 12.04服务器上用Chef创建的用户帐户设置ssh访问。我在数字海洋中设置了选项，以便在创建Droplet时自动复制Mac的ssh密钥。

我可以毫无问题地以root用户身份登录，但其他用户无法通过身份验证。这似乎是一个常见问题，我检查了其他一些答案，并找到此命令以获取更多信息：

ssh -vvv -i id_rsa user@serverIP

使用该命令的root用户（成功）的日志为

调试

1: Offering RSA public key: /Users/evan/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp snip!
debug3: sign_and_send_pubkey: snip!
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).

失败的用户：

调试

1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/evan/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Trying private key: /Users/evan/.ssh/id_dsa
debug3: no such identity: /Users/evan/.ssh/id_dsa: No such file or directory
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.

在我看来，这意味着公钥不正确。但是，如果我以root用户身份登录并转到home/otheraccount/.ssh/authorized_keys，则可以看到我的ssh密钥在那里。我以为也许有错误，所以我做到了，cp .ssh/authorized_keys ~/home/otheraccout/.ssh/authorized_keys但是那没有帮助。我不知道还能去哪里。

我的etc/ssh/sshd_conig：

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
"sshd_config" 88L, 2508C
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

# GS

SAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding no
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60

AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM no
Banner /etc/ssh_banner

编辑：

drwx------ 2 deploy deploy 4096 Apr 20 06:00 .ssh
-rw------- 1 deploy deploy 820 Apr 20 05:35 authorized_keys

编辑2：

如评论中所建议/var/log/authlog：

Apr 21 04:59:30 localhost sshd[586]: User deploy not allowed because account is locked
Apr 21 04:59:30 localhost sshd[586]: input_userauth_request: invalid user deploy [preauth]

我试着做sudo usermod --expiredate -1 deploy，它回来了no changes

• SSH登录可能由于各种原因而失败（错误的目录/文件权限，错误的密钥等），并且连接的客户端只会得到Permission denied或No more authentication methods to try或某些一般性错误。

• 登录失败的确切原因将在ssh日志中/var/log/auth.log或/var/log/secure取决于syslog配置中提供。

我刚安装CentOS7时也遇到同样的问题。

1.检查主目录权限以及〜/ .ssh和〜/ .ssh / authorized_keys权限（如@clement所述）

chmod o-w ~/; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys

2.检查 / etc / ssh / sshd_config设置&&服务sshd重新启动（每次编辑后）有用：在sshd_config中尝试“ LogLevel VERBOSE”。

检查一切正常后，我仍然收到密码提示。

使用-vvv日志运行ssh客户端：

debug3: send_pubkey_test 
debug2: we sent a publickey packet, wait for reply

服务器（/ var / log / secure）日志：

Failed publickey for * from * port * ssh2: RSA *

ssh服务器不会向客户端发送更多错误信息，因为这将带来安全风险。

如果我在其他端口“ sshd -p 5555 -d”上运行了sshd。钥匙起作用了。可以无密码登录。WTF？

SAD :-（说我然后禁用了selinux（在/ etc / selinux / config中设置SELINUX = disabled）并重新启动。然后无密码登录就可以了。

我当前的sshd_config设置：

[root@hp-bl-05 ~]# grep -vE "^#|^$" /etc/ssh/sshd_config  
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
SyslogFacility AUTHPRIV
LogLevel VERBOSE
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile  .ssh/authorized_keys
HostbasedAuthentication yes
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication no
GSSAPICleanupCredentials no
UsePAM yes
X11Forwarding yes
UseDNS no
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem   sftp    /usr/libexec/openssh/sftp-server

因此，很高兴知道我们是否可以更改selinux中的某些内容以使无密码的ssh登录正常工作。谁能改善答案？

同样在这里：https : //superuser.com/questions/352368/ssh-still-asks-for-password-after-setting-up-key-based-authentication/1072999#1072999