新装的1604，ssh登录到服务器必须输入密码

kidli · **发表于 :** 2016-09-16 17:28

新装的1604，ssh 登录到服务器必须输入密码，服务器一直没动过，客户机重装了1604。
重新用 ssh-keygen 生成 key、上传到服务器都不行，咋整？

用 -v 指令，日志如下：

代码:

$ ssh -v user@server
OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to server [192.168.11.11] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: identity file /home/user/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1.10
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.10 pat OpenSSH_5* compat 0x0c000000
debug1: Authenticating to server:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: umac-64@openssh.com compression: none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:PQu/H1PmoYBrsHv8dCPatjjgva1oET0RSZeMnAFjwXo
debug1: Host 'server' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:5
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: Skipping ssh-dss key /home/user/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/id_rsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Trying private key: /home/user/.ssh/id_ed25519
debug1: Next authentication method: password
user@server's password: 

vickycq · **发表于 :** 2016-09-16 17:36

kidli 写道:

重新用 ssh-keygen 生成 key、上传到服务器都不行，

具体如何“上传”的？“上传”后采取了何种措施？
服务器待登录账户的家目录是否加密？
服务器的 sshd_config 是否允许 PubkeyAuthentication？

kidli · **发表于 :** 2016-09-16 18:33

vickycq 写道:

kidli 写道:

重新用 ssh-keygen 生成 key、上传到服务器都不行，

具体如何“上传”的？“上传”后采取了何种措施？
服务器待登录账户的家目录是否加密？
服务器的 sshd_config 是否允许 PubkeyAuthentication？

上传：
ssh-copy-id -i ~/.ssh/id_dsa.pub user@server
然后检查了服务器上的 authorized_keys，确认上传成功了

上传后执行：
ssh user@server，需要输入密码，而以前是不需要的

服务器 sshd_config 里的 PubkeyAuthentication 是 yes；服务器账户的家目录没有加密。

补充一下，服务器一直没动过，是客户机这边，以前一直是 1404，今天重装了个 1604 后出现的问题。

vickycq · **发表于 :** 2016-09-16 19:19

kidli 写道:

以前一直是 1404，今天重装了个 1604 后出现的问题。
debug1: Skipping ssh-dss key /home/user/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
ssh-copy-id -i ~/.ssh/id_dsa.pub user@server

openssh changelog 写道:

openssh (1:7.1p1-1) unstable; urgency=medium
- Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html

参见 http://changelogs.ubuntu.com/changelogs/pool/main/o/openssh/openssh_7.2p2-4ubuntu2.1/changelog
尝试换用 RSA 密钥。

kidli · **发表于 :** 2016-09-16 20:21

vickycq 写道:

kidli 写道:

以前一直是 1404，今天重装了个 1604 后出现的问题。
debug1: Skipping ssh-dss key /home/user/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
ssh-copy-id -i ~/.ssh/id_dsa.pub user@server

openssh changelog 写道:

openssh (1:7.1p1-1) unstable; urgency=medium
- Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html

参见 http://changelogs.ubuntu.com/changelogs/pool/main/o/openssh/openssh_7.2p2-4ubuntu2.1/changelog
尝试换用 RSA 密钥。

非常感谢，换 rsa 就可以了，之前还尝试了把 dss 重新启用，还是不行。
另外还有一台服务器换 rsa 也不行，最后又生成了一套 ecdsa 的 key 才搞定。

新装的1604，ssh登录到服务器必须输入密码

在线用户