权限被拒绝（公钥）。当连接到AWS服务器

我刚刚创建了一个AMI与亚马逊，我能够很好地使用亚马逊创建的密钥在SSH中。我已经添加了一个用户到系统并设置了他们的密码，当我尝试登录时，我得到了“Permission denied（publickey）”。连接到服务器时。权限被拒绝（公钥）。当连接到AWS服务器

[email protected]:~$ ssh -v [email protected] 
OpenSSH_5.8p1 Debian-1ubuntu3, OpenSSL 0.9.8o 01 Jun 2010 
debug1: Reading configuration data /etc/ssh/ssh_config 
debug1: Applying options for * 
debug1: Connecting to honey-aws-west [50.1.1.1] port 22. 
debug1: Connection established. 
debug1: identity file /home/spoofy/.ssh/id_rsa type -1 
debug1: identity file /home/spoofy/.ssh/id_rsa-cert type -1 
debug1: identity file /home/spoofy/.ssh/id_dsa type -1 
debug1: identity file /home/spoofy/.ssh/id_dsa-cert type -1 
debug1: identity file /home/spoofy/.ssh/id_ecdsa type -1 
debug1: identity file /home/spoofy/.ssh/id_ecdsa-cert type -1 
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debian-  1ubuntu3 
debug1: match: OpenSSH_5.8p1 Debian-1ubuntu3 pat OpenSSH* 
debug1: Enabling compatibility mode for protocol 2.0 
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-1ubuntu3 
debug1: SSH2_MSG_KEXINIT sent 
debug1: SSH2_MSG_KEXINIT received 
debug1: kex: server->client aes128-ctr hmac-md5 none 
debug1: kex: client->server aes128-ctr hmac-md5 none 
debug1: sending SSH2_MSG_KEX_ECDH_INIT 
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY 
debug1: Server host key: RSA 2f:80:ab:9d:38:35:ae:eb:a2:bf:bc:20:1f:d9:89:62 
debug1: Host 'honey-aws-west' is known and matches the RSA host key. 
debug1: Found key in /home/spoofy/.ssh/known_hosts:7 
debug1: ssh_rsa_verify: signature correct 
debug1: SSH2_MSG_NEWKEYS sent 
debug1: expecting SSH2_MSG_NEWKEYS 
debug1: SSH2_MSG_NEWKEYS received 
debug1: Roaming not allowed by server 
debug1: SSH2_MSG_SERVICE_REQUEST sent 
debug1: SSH2_MSG_SERVICE_ACCEPT received 
debug1: Authentications that can continue: publickey 
debug1: Next authentication method: publickey 
debug1: Trying private key: /home/spoofy/.ssh/id_rsa 
debug1: Trying private key: /home/spoofy/.ssh/id_dsa 
debug1: Trying private key: /home/spoofy/.ssh/id_ecdsa 
debug1: No more authentication methods to try. 
Permission denied (publickey).

我知道，通常它的权限问题，在这种情况下，但我检查了这些，他们似乎很好..也因为我可以ssh -i blah.pem中..我猜它可能是一个不同的问题？这里是sshd_config的

# Package generated configuration file 
# See the sshd(8) manpage for details 

# What ports, IPs and protocols we listen for 
Port 1337 
# Use these options to restrict which interfaces/protocols sshd will bind to 
#ListenAddress :: 
#ListenAddress 0.0.0.0 
Protocol 2 
# HostKeys for protocol version 2 
HostKey /etc/ssh/ssh_host_rsa_key 
HostKey /etc/ssh/ssh_host_dsa_key 
#Privilege Separation is turned on for security 
UsePrivilegeSeparation yes 

# Lifetime and size of ephemeral version 1 server key 
KeyRegenerationInterval 3600 
ServerKeyBits 768 

# Logging 
SyslogFacility AUTH 
LogLevel INFO 

# Authentication: 
LoginGraceTime 120 
PermitRootLogin yes 
StrictModes yes 

RSAAuthentication yes 
PubkeyAuthentication yes 
#AuthorizedKeysFile  %h/.ssh/authorized_keys 

# Don't read the user's ~/.rhosts and ~/.shosts files 
IgnoreRhosts yes 
# For this to work you will also need host keys in /etc/ssh_known_hosts 
RhostsRSAAuthentication no 
# similar for protocol version 2 
HostbasedAuthentication no 
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication 
#IgnoreUserKnownHosts yes 

# To enable empty passwords, change to yes (NOT RECOMMENDED) 
PermitEmptyPasswords no 

# Change to yes to enable challenge-response passwords (beware issues with 
# some PAM modules and threads) 
ChallengeResponseAuthentication no 

# Change to no to disable tunnelled clear text passwords 
PasswordAuthentication no 
# Kerberos options 
#KerberosAuthentication no 
#KerberosGetAFSToken no 
#KerberosOrLocalPasswd yes 
#KerberosTicketCleanup yes 

# GSSAPI options 
#GSSAPIAuthentication no 
#GSSAPICleanupCredentials yes 

X11Forwarding yes 
X11DisplayOffset 10 
PrintMotd no 
PrintLastLog yes 
TCPKeepAlive yes 
#UseLogin no 

#MaxStartups 10:30:60 
#Banner /etc/issue.net 

# Allow client to pass locale environment variables 
AcceptEnv LANG LC_* 

Subsystem sftp /usr/lib/openssh/sftp-server 

UsePAM yes

用户是不是超级user..but确实有sudo访问。

来源

2011-08-17 spoofy

系统管理问题上http://www.serverfault.com属于 - 这是一个编程Q＆A网站。 –

我假设你的意思是你不能使用密码登录到这个新用户。

首先，您需要检查ssh_config是否允许用户使用密码登录。根据您的默认设置，它可能不是默认选项。

另外，如果您的新用户拥有超级用户权限，则在使用密码时也可能会阻止登录。

UPDATE：

您需要设置一个或两个的这些设置为yes。我不记得第二个，所以试试第一个。

ChallengeResponseAuthentication no 
PasswordAuthentication no

来源

2011-08-17 00:36:53

这里是sshd_config – spoofy

ummm ...哪里？ –

刚刚编辑后..由于某种原因不能将其粘贴为评论 – spoofy

我不清楚您是否尝试使用或不使用密码登录。如果您尝试使用新用户帐户登录并且没有密码，则需要将用户的公钥添加到.ssh目录authorized_keys文件中。

如果您的用户名为“spoofy”，去

/home/spoofy/.ssh/

，在这里创建一个名为authorized_keys在它的公共密钥文件。

那么你应该能够

$ ssh [email protected]#####.amazonaws.com

我在这里有一个较长的书面记录登录。

http://thekeesh.com/2011/05/setting-up-user-accounts-password-authentication-and-ssh-keys-on-a-new-ec2-instance/

来源

2011-08-17 01:11:49 jkeesh

这个工作对我来说：

ssh-keygen -R <server_IP>

删除存储在工作站上的旧密钥还与替代

然后做同样的SSH再次，它的工作：

ssh -v -i <your_pem_file> [email protected]<server_IP>

on ubun tu实例的用户名是：ubuntu 在Amazon Linux AMI上的用户名是：ec2-user

我不必从图像重新创建实例。

来源

2013-02-04 15:54:43 Cris

如果您仍在监控此....

您的/家在一个单独的分区？

如果我离开/ home的根分区，我可以ssh作为普通用户就好了。

只要在/ home上安装单独的文件系统（即单独的EBS卷格式化并装入）（并更新新分区上的用户的.ssh文件），我就不能再使用pubkey验证ssh了。密码验证有效。

来源

2013-03-18 04:44:20 RokShox

您可能需要在系统

restorecon -r /home/*/.ssh

来源

2013-08-07 07:19:28 RokShox

使用超级用户运行restorecon或root帐户尝试命令。

例如：

苏SSH -v -i /path/key.pem用户名@ IP_machine

来源

2017-04-07 11:56:59

权限被拒绝（公钥）。当连接到AWS服务器

回答

相关问题