带有authorized_keys的Windows openssh仍然要求输入用户密码

问题描述 投票：0回答：2

当我尝试使用私钥使用 Windows ssh 连接到 Windows OpenSSH 服务器时，ssh 仍然要求输入密码。

  1. 我通过添加 OpenSSH Server Windows 附加功能来安装 OpenSSH。
  2. 我使用 Windows 服务管理控制台手动启动 OpenSSH SSH Server Windows 服务。
  3. 然后我使用 ssh-keygen -t ed255519 创建了一个公钥/私钥对
  4. 我已将公钥复制到 
    clientssh
    帐户 
    .ssh
    目录中：
PS C:\Users\user> ssh [email protected] mkdir C:\Users\clientssh\.ssh\
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:FD9uvvMTBBDMF3jkzZTMEk7iUImY/a7oZRe+wwusCN4.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
[email protected]'s password:
PS C:\Users\user> scp .ssh\id_ed25519.pub [email protected]:C:\Users\clientssh\.ssh\authorized_keys
[email protected]'s password:
id_ed25519.pub                                                                        100%  103    51.5KB/s   00:00
  1. 然后，当我尝试连接到 
    clientssh
    帐户时，系统会询问我私钥的密码，这表明 ssh 已找到它，它成功解密了它（不再请求），但密钥似乎被忽略了，因为我还被要求提供 
    clientssh
    密码。
PS C:\Users\user> ssh -v [email protected] dir .ssh
OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22.
debug1: Connection established.
debug1: identity file C:\\Users\\user/.ssh/id_rsa type -1
debug1: identity file C:\\Users\\user/.ssh/id_rsa-cert type -1
debug1: identity file C:\\Users\\user/.ssh/id_dsa type -1
debug1: identity file C:\\Users\\user/.ssh/id_dsa-cert type -1
debug1: identity file C:\\Users\\user/.ssh/id_ecdsa type -1
debug1: identity file C:\\Users\\user/.ssh/id_ecdsa-cert type -1
debug1: identity file C:\\Users\\user/.ssh/id_ed25519 type -1
debug1: identity file C:\\Users\\user/.ssh/id_ed25519-cert type -1
debug1: identity file C:\\Users\\user/.ssh/id_xmss type -1
debug1: identity file C:\\Users\\user/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_for_Windows_8.1
debug1: match: OpenSSH_for_Windows_8.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 127.0.0.1:22 as 'clientssh'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:FD9uvvMTBBDMF3jkzZTMEk7iUImY/a7oZRe+wwusCN4
debug1: Host '127.0.0.1' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\user/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: pubkey_prepare: ssh_get_authentication_socket: No such file or directory
debug1: Will attempt key: C:\\Users\\user/.ssh/id_rsa
debug1: Will attempt key: C:\\Users\\user/.ssh/id_dsa
debug1: Will attempt key: C:\\Users\\user/.ssh/id_ecdsa
debug1: Will attempt key: C:\\Users\\user/.ssh/id_ed25519
debug1: Will attempt key: C:\\Users\\user/.ssh/id_xmss
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: C:\\Users\\user/.ssh/id_rsa
debug1: Trying private key: C:\\Users\\user/.ssh/id_dsa
debug1: Trying private key: C:\\Users\\user/.ssh/id_ecdsa
debug1: Trying private key: C:\\Users\\user/.ssh/id_ed25519
debug1: read_passphrase: can't open /dev/tty: No such file or directory
Enter passphrase for key 'C:\Users\user/.ssh/id_ed25519':
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Trying private key: C:\\Users\\user/.ssh/id_xmss
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: No such file or directory
[email protected]'s password:
debug1: Authentication succeeded (password).
Authenticated to 127.0.0.1 ([127.0.0.1]:22).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug1: Sending command: dir .ssh
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est FA33-B148

 Répertoire de C:\Users\clientssh\.ssh

22/08/2022  16:38    <DIR>          .
22/08/2022  16:38    <DIR>          ..
22/08/2022  16:38               103 authorized_keys
               1 fichier(s)              103 octets
               2 Rep(s)  54860242944 octets libres
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2136, received 3084 bytes, in 0.1 seconds

注意：我修复了上面捕获中的一些无效代码页字符。

我阅读了与此主题接近的其他主题，但它们要么不适用，因为面向 Linux，要么因为没有真正的解决方案。我从他们那里得到的唯一的东西就是在 ssh 上使用 -v 的想法。虽然这对我没有多大帮助...

windows ssh private-key openssh
2个回答
3
投票

我终于在 GitHub 上找到了 Windows OpenSSH 故障排除文档（而不是在传统的 Microsoft 网站上！）： https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

如该文档中所述，我将 DEBUG3 日志级别添加到 OpenSSH 服务器配置文件中（较低的调试级别不会揭示问题）。我发现

clientssh
账户中的授权文件的访问权限已被授权给
user
账户。

16004 2022-08-24 10:01:54.598 debug1: trying public key file C:\\Users\\clientssh\\.ssh/authorized_keys
16004 2022-08-24 10:01:54.599 debug3: Bad permissions. Try removing permissions for user: DESKTOP-N2I2AHF\\user (S-1-5-21-2546763314-2673200902-885207948-1001) on file C:/Users/clientssh/.ssh/authorized_keys.
16004 2022-08-24 10:01:54.599 Authentication refused.

这很令人惊讶，因为我使用 ssh 复制了文件。

但我终于明白了访问权限是如何被破坏的：我已经使用

user
帐户验证了授权文件已被正确复制。这是可能的，因为 
user
帐户具有管理权限。而且看起来，当您要求访问通常没有访问权限的目录时，资源管理器不会冒充管理员来获取权限，而是修改目录访问权限，让您永久访问该目录！

删除对 

user
帐户的 
clientssh
访问权限可以让 OpenSSH 正常工作。

0
投票

我也遇到了同样的问题，即使复制了 ssh id 后，远程 ssh 仍要求输入密码。我正在尝试管理会话。

对我有用的步骤：

  1. 将客户端 SSH 公钥复制到服务器文件（换行）：

    C:\ProgramData\ssh\administrators_authorized_keys
    请注意，当您在管理员模式下打开编辑器时，可以打开并保存此文件。

  2. 在 Windows 服务器上运行以下命令：

    icacls.exe“C：\ ProgramData \ ssh dministrators_authorized_keys”/继承：r / grant“管理员：F”/ grant“系统：F”

这是为了设置正确的权限

  1. 在 Windows 服务器上重新启动服务（在 services.msc 中）： OpenSSH SSH 服务器 （如果您经常需要的话，在属性中将其更改为自动启动）

通过 ssh 命令从客户端连接：

ssh user@server-name-or-ip-address

现在，它应该要求输入密码。

最新问题
© www.soinside.com 2019 - 2024. All rights reserved.