SSHパスワードなしでリモートWebサーバーにログイン

私は広く受け入れられている答えに従います端末 - パスワードを使用せずにリモートWebサーバーにSSHで接続する方法パスワードなしでリモートサーバーにSSH接続する

githubのSSH設定をローカルとリモートでインストールしました。これは2番目のSSH構成です。

また参照してくださいLinux/Mac チュートリアル: SSH キーベース認証 - パスワードなしで SSH を使用する方法 - YouTube

1. ローカルMacで新しいキーペアを作成します。

   $ sudo ssh-keygen -t rsa -b 4096 -f ~/.ssh/webserver
   Generating public/private rsa key pair.
   /Users/me/.ssh/webserver already exists.
   Overwrite (y/n)? y
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /Users/me/.ssh/webserver.
   Your public key has been saved in /Users/me/.ssh/webserver.pub.
   The key fingerprint is:
   SHA256:Ux2ntGEN66Jvpr/eJyWagEHO3frJP51SlIJGP5zGBic [email protected]
   The key's randomart image is:
   +---[RSA 4096]----+
   |            *o.  |
   |      .   E+.B.  |
   |     + . o.O=. . |
   
   me at Max-2018 in ~/.ssh
   $ ls
   MyKeyPair.pem      config  id_rsa.pub   webserver
   SecondKeyPair.pem  id_rsa  known_hosts  webserver.pub
   

2. 新しいキーをリモートサーバー（CentOS）にコピーする

   $ scp webserver.pub [email protected]:/root/.ssh/
   [email protected]'s password:
   webserver.pub                100%  745    45.3KB/s   00:00
   [root@iz2ze9wve43n2nyuvmsfx5z .ssh]# cat webserver.pub  >> authorized_keys
   [root@iz2ze9wve43n2nyuvmsfx5z .ssh]# cat authorized_keys
   ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8iFaLTdhR878LvznCn2PoiIG0ve5at7Bm4NtmLSmoCdNc7iAWoqQLtvx0WoX00TY0+GtaOF3n3P+O0LflIFV5B+m8Wh1PrpOP2fzBSrwQEL3UUtQ/Ti5vUd7FE2LUla8gjFglV83HFTFRwe2O4G6OutwmrBm0+
   

3. .sshの権限の変更

   #on the remote
   [root@iz2ze9wve43n2nyuvmsfx5z ~]# chmod 700 ~/.ssh
   [root@iz2ze9wve43n2nyuvmsfx5z ~]# chmod 700 ~/.ssh/*
   #on the local
   $ chmod 700 ~/.ssh
   $ sudo chmod 700 ~/.ssh/*
   

4. 構成

   $ cat ~/.ssh/config
   #the above part is the newly added.
   Host myserver.com
    IdentityFile ~/.ssh/webserver
    User root
   
   Host *
    AddKeysToAgent yes
    UseKeychain yes
    IdentityFile ~/.ssh/id_rsa
   

これまでのところ、「これを行うと、必要なパスワードのないキーペアベースの認証が提供されます」という回答のすべての手順が完了しました。

5. 残念ながら：

   $ ssh [email protected]
   [email protected]'s password:
   

6. 私はYouTubeの親指の指示に従いました。 Linux/Mac チュートリアル: SSH キーベース認証 - パスワードなしで SSH を使用する方法 - YouTube

   変化/etc/ssh/sshd_config

   sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
   
   #Change to no to disable tunnelled clear text passwords
   PasswordAuthentication no
   # and restart
   [root@iz2ze9wve43n2nyuvmsfx5z ~]# sudo systemctl restart sshd
   

7. ローカルでもう一度やり直してください。

   [root@iz2ze9wve43n2nyuvmsfx5z ~]# ssh [email protected]
   Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
   

8. scp を使用してソリューションを検索します。

   SSHコピーID

   $ ssh-copy-id -i webserver.pub [email protected]
   /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "webserver.pub"
   /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
   /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
   [email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
   

9. 他のビデオも確認します。パスワードなしのSSHチュートリアル - YouTube |

   これを達成するには、ステップ1と2を使用してください。

   changmod to 600
   
   $ sudo ls -al .ssh 
   total 32
   drw-------  10 me staff  320 Dec  1 00:13 .
   drwxr-xr-x+ 67 me staff 2144 Dec  1 00:01 ..
   -rw-------   1 me staff 1696 Sep  1 10:15 MyKeyPair.pem
   -rw-------   1 me staff 1692 Sep  1 23:21 SecondKeyPair.pem
   -rw-------   1 me staff  137 Dec  1 00:01 config
   -rw-------   1 me staff 3243 Feb 27  2018 id_rsa
   -rw-------   1 me staff  749 Feb 27  2018 id_rsa.pub
   -rw-------   1 me staff 3760 Nov  5 19:33 known_hosts
   -rw-------   1 me staff 3389 Nov 30 23:22 webserver
   -rw-------   1 me staff  745 Nov 30 23:22 webserver.pub
   
   $ sudo ssh [email protected]
   [email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
   

私の試みに問題がありますか？

$ ssh [email protected] -vvv
OpenSSH_7.8p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/me/.ssh/config
debug1: /Users/me/.ssh/config line 2: Applying options for myserver.com
debug1: /Users/me/.ssh/config line 7: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Connecting to myserver.com port 22.
debug1: Connection established.
debug1: identity file /Users/me/.ssh/webserver type 0
debug1: identity file /Users/me/.ssh/webserver-cert type -1
debug1: identity file /Users/me/.ssh/id_rsa type 0
debug1: identity file /Users/me/.ssh/id_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug3: fd 5 is O_NONBLOCK
debug1: Authenticating to myserver.com:22 as 'root'
debug3: hostkeys_foreach: reading file "/Users/me/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/me/.ssh/known_hosts:12
debug3: load_hostkeys: loaded 1 keys from myserver.com
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:qeZuH78znSba00AGex2oz/uhGTgSuzt0hnl8cT9uup4
debug3: hostkeys_foreach: reading file "/Users/me/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/me/.ssh/known_hosts:12
debug3: load_hostkeys: loaded 1 keys from myserver.com
debug3: hostkeys_foreach: reading file "/Users/me/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/me/.ssh/known_hosts:8
debug3: load_hostkeys: loaded 1 keys from 39.105.51.157
debug1: Host 'myserver.com' is known and matches the ECDSA host key.
debug1: Found key in /Users/me/.ssh/known_hosts:12
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /Users/me/.ssh/webserver (0x7fc3c8701580), explicit
debug2: key: /Users/me/.ssh/id_rsa (0x7fc3c8412d90), explicit
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:Ux2ntGEN66Jvpr/eJyWagEHO3frJP51SlIJGP5zGBic /Users/me/.ssh/webserver
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Offering public key: RSA SHA256:tAc3DhpRdOeAORzhbMTFq0yG+dPFkXmWMYO0dGE/veE /Users/me/.ssh/id_rsa
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

sshd_configサーバーから：

[root@iz2ze9wve43n2nyuvmsfx5z ssh]# cat sshd_config
#   $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#ListenAddress 0.0.0.0
#ListenAddress ::

HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile  .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes

# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PAM authentication via ChallengeResponseAuthentication may bypass
# If you just want the PAM account and session checks to run without
# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

# override default of no subsystems
Subsystem   sftp    /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server
UseDNS no
AddressFamily inet
PermitRootLogin yes
SyslogFacility AUTHPRIV
PasswordAuthentication no

代替テスト：

$ /usr/sbin/sshd -d -p 2222
debug1: sshd version OpenSSH_7.8, LibreSSL 2.7.3
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Could not load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.

$ sudo /usr/sbin/sshd -d -p 2222
Password:
debug1: sshd version OpenSSH_7.8, LibreSSL 2.7.3
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Could not load host key: /etc/ssh/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.