【SSH免密登录】ssh免密设置总是无效？这里有完整的配置步骤

SSH免密码登录步骤

1. 我们假设有两台机器A, B，我们需要实现机器A SSH免密码登录到B， 这时我们需要现在机器A上生成公钥私钥， 也就是我们上面提到的"ssh-keygen -t rsa"。

   ssh-keygen -t rsa
   

2. 我们需要在机器A上生成一份authorized_keys， 用于存储每台机器A的公钥。

   cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
   

3. 我们还需要改变authorized_keys的权限，使之能够拷贝到其他机器上

   chmod 644 ~/.ssh/authorized_keys
   

   如果有必要,可能/.ssh/路径还需要700权限

4. 我们需要确保能用账号密码的方式登入到B机器

   ssh root@172.17.0.4
   

5. 我们还需要通过ssh-copy-id将机器A的公钥复制到机器B的 "~/.ssh/authorized_keys"文件中

   ssh-copy-id root@172.17.0.4 # 需要输入密码（默认公钥）
   ssh-copy-id -i ~/.ssh/id_rsa_yangan root@172.17.0.4 # 复制自定义公钥
   

6. 将机器A使用的私钥添加到由ssh-agent 维护的列表中

   ssh-add ~/.ssh/id_rsa
   

   这步如果提示 Could not open a connection to your authentication agent.，先执行 eval 'ssh-agent -s' 启动 ssh-agent 再添加

7. 执行 “ssh root@172.17.0.4” 可以发现不用输入密码，实现免密码登录。在这里插入代码片

如果一直不成功的话，直接检查authorized_keys有没有需要添加的key，如果没有的话，可以检查/root/.ssh/下的文件，copy-id时使用指定root下的公钥即可

如果还是无效，需要打开文件 /etc/ssh/sshd_config，配置如下：

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
#PermitRootLogin prohibit-password
PermitRootLogin yes
StrictModes no

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile	%h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

然后 service sshd reload 使配置生效即可