Authentification par clé publique SSH refusée

Sep 16 2020

J'essaye de me connecter à une machine virtuelle via SSH.

Je peux me connecter à un compte avec un mot de passe.

J'ai créé un autre utilisateur sans mot de passe, généré une clé ssh sur ma machine hôte (Windows) et placé la clé publique à l'intérieur de l'utilisateur / .ssh / allowed_keys, et défini l'autorisation en lecture seule, avec la pleine propriété de l'utilisateur.

Cependant, lorsque j'essaye de ssh, depuis localhost sur la VM OU depuis ma machine hôte, la clé publique est toujours refusée. J'ai configuré le serveur ssh pour n'accepter que l'authentification par clé publique.

C'est l'erreur que j'obtiens quand je cours ssh -vv user@localhost -i privatekey

PS C:\Users\gicum\.ssh> ssh -vv [email protected] -p 2222 -i mironica
OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5
debug1: Reading configuration data C:\\Users\\gicum/.ssh/config
debug1: C:\\Users\\gicum/.ssh/config line 1: Applying options for 192.168.230.129
debug2: resolve_canonicalize: hostname 192.168.230.129 is address
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 192.168.230.129 [192.168.230.129] port 2222.
debug1: Connection established.
debug1: identity file mironica.pub type 0
debug1: key_load_public: No such file or directory
debug1: identity file mironica.pub-cert type -1
debug1: identity file C:\\Users\\gicum/.ssh/mironica type 0
debug1: key_load_public: No such file or directory
debug1: identity file C:\\Users\\gicum/.ssh/mironica-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.230.129:2222 as 'mironica'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:gS6dFKtHfhm8j4RkJ41ISAn0XS5KLrGlAD+QCHMp8qc
debug1: checking without port identifier
debug1: Host '192.168.230.129' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\gicum/.ssh/known_hosts:10
debug1: found matching key w/out port
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: mironica.pub (00000266CA181500), explicit, agent
debug2: key: C:\\Users\\gicum/.ssh/mironica (00000266CA181030), explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:JbiX5u8cO0CxDtwgv258/TLUWyG/xh4XwTvGIQjdXrc mironica.pub
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug1: Offering public key: RSA SHA256:JbiX5u8cO0CxDtwgv258/TLUWyG/xh4XwTvGIQjdXrc C:\\Users\\gicum/.ssh/mironica
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey).

Le problème est similaire lorsque vous essayez via localhost comme mentionné ci-dessus. Je ne peux pas comprendre quel pourrait être mon problème ici?

La clé publique

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPPRMQ3Z+aYhluLi0iY9atBjliwNCvZb3FjywsbiVDYotuWrO8Ee/dRrCVaNF9fRU44JdMm9rZ1FH6HRbLejQiUpATiOxUIno6kKfa8GZjFwrf0Q80H0G2n8zqkZMdP4DbDI1PMLpNT60n/LWv1FOgw7dr/TRlNCzb/J4socm1kXKDRcE5B4xkh8uCuK9QevwMcJ3iqkZ9v3bxBI/N+VyBPE3WfBwzNKX3xZPB9BQirRSRyAffh3DLaEik4tMtDTmYqbpsLXcHnG9rUh1vrCxoB56RtphMR3D3ORNl0XBy3E5mXEo5jqvRMMG7kRyVv9jSnDPM6UiO+sF2vawjRZzouXZHZKLOsOycMbx/lX/jB4TGcLRs+BiRyfMEYvrbr5SzhFPikyn15lFFQSVl+rTnoW3xg05CpEqVTwZqoWPfEUar1UzbRex7QJN9BKqCFeoBH/jTaUvw+8a3T+ELV4co+PI3J7+RhdOsiZGFxJ5D20+Ik2BbBw0qMsFnhmprX+ltDP6D3hXd5vCj3EqK6blgjfQofsHdZsLGem6lxYCoF41FmNLJIR0S7luz30ewUw+3Haiks1ti0Vmgle6RNLyrddRkwWrO0pkyRkDA1Q5BOO34EHvGUXb/FKGrMr0ngccTBINY2G3AMeHOzpCSO/9BnK+YrikLjEj86TxqIB9gEQ== gicum@bosslife

/var/log/auth.log

Sep 15 14:03:45 ubuntu sshd[9423]: Received SIGHUP; restarting.
Sep 15 14:03:45 ubuntu sshd[9423]: Server listening on 0.0.0.0 port 22.
Sep 15 14:03:45 ubuntu sshd[9423]: Server listening on :: port 22.
Sep 15 14:17:02 ubuntu CRON[11586]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 15 14:17:02 ubuntu CRON[11586]: pam_unix(cron:session): session closed for user root
Sep 15 14:24:49 ubuntu sshd[11884]: Connection reset by authenticating user mironica 192.168.230.1 port 50138 [preauth]
Sep 15 14:25:16 ubuntu sshd[11904]: Connection reset by authenticating user mironica 192.168.230.1 port 50141 [preauth]
Sep 15 14:26:47 ubuntu sshd[11955]: Connection reset by authenticating user mironica 192.168.230.1 port 50173 [preauth]
Sep 15 14:27:01 ubuntu sshd[11965]: Connection reset by authenticating user mironica 192.168.230.1 port 50182 [preauth]
Sep 15 14:27:20 ubuntu sshd[11980]: Connection reset by authenticating user mironica 192.168.230.1 port 50194 [preauth]
Sep 15 14:42:48 ubuntu gdm-password]: gkr-pam: unlocked login keyring

Réponses

Ozerov Sep 16 2020 at 19:46

Vous devez définir le mot de passe de l'utilisateur que vous souhaitez utiliser pour une connexion sans mot de passe, puis vous pouvez définir l'authentification par clé publique. Et si vous pouvez vous connecter à une machine distante, vous pouvez exécuter ssh en mode débogage pour trouver le problème.

dans une machine distante

#ddd is debug mode level.
$ stopsrc -s sshd $ /usr/sbin/sshd -ddd

puis essayez de vous connecter à la machine distante depuis la vôtre, lorsque la connexion sera publiée, les messages seront imprimés sur votre terminal de machine distante que vous avez démarré sshd.