有没有办法启用密码身份验证，以便用户可以在azure vm中使用密码或公钥登录？

Question

我正在尝试找出一种方法，让用户在没有正确的公钥的情况下使用密码登录我的虚拟机。我不想删除公钥身份验证，那么有没有办法根据用户启用两者？

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication no

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
KbdInteractiveAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem   sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server
ChallengeResponseAuthentication no

这是我的 sshd_config 文件。我要在这里做出什么改变才能得到我想要的东西？

Answer 1

我尝试在我的环境中重现相同的问题并得到以下结果

我已经创建了 linux vm 并以root用户身份连接

我们可以通过两种方式在sshd_config文件中启用密码验证。

Match user username
PasswordAuthentication yes

我们可以添加上面的行，如

Echo "Match user username\nPasswordAuthentication yes" >> /etc/sshd/sshd_config

如果我们需要多个用户，以上命令适用于单个用户

Match user u_name1,u_name2,....

用逗号分隔我们可以添加多个用户

添加上述行后我们必须重新启动文件，否则它不会反映

sudo systemctl restart ssh

第二种可能的方法是，我创建了新脚本

sudo su -i
cd /usr/local/bin
vi filename.sh

在该文件中，请编写以下脚本

       #!/bin/bash
        
        while [[ $# -gt 0 ]]; do
          key="$1"
          case $key in
            help)
              usage
              shift
              shift
              ;;
            -u|--user) SFTP_USER="$2"
              shift # past argument
              shift # past value
              ;;
            -p|--password) THE_PASSWORD="$2"
              shift # past argument
              shift # past value
              ;;
          esac
        done
        
        function usage {
          echo "Usage: $0 --user testuser [ --password <your password> ]" exit 0
        }
        
        if [[ -z ${SFTP_USER} ]]; then
          usage
        fi
        
        LOCAL_SECRET_ACCESS_KEY=$(sudo grep ldap.password /opt/sftpgw/application.properties | cut -d'=' -f2)
        
        if [[ -n "$THE_PASSWORD" ]]; then
          NEW_PASSWORD="${THE_PASSWORD}"
        else
          NEW_PASSWORD=$(head /dev/urandom | tr -dc A-Z0-9 | head -c 12 ; echo '')
        fi
        
        ldapmodify -D "cn=admin" -w ${LOCAL_SECRET_ACCESS_KEY} <<HERE
        dn: uid=${SFTP_USER},ou=People,dc=sftpgateway,dc=com
        changetype: modify
        replace: userPassword
        userPassword: ${NEW_PASSWORD}
        HERE
        
        echo "The password for the new user ${SFTP_USER} has been set to ${NEW_PASSWORD}"

之后运行脚本并传递用户名和密码

/usr/local/bin/password.sh -u <u_name> -p <password>

注意： 如果我们不传递密码，它将生成密码

Answer 2

我认为这对于多个用户来说并不完全是正确的方法。我们需要更改 /etc/ssh/sshd_config