平时都是用termius+私钥的方式ssh到azure的vm上进行操作维护,今天突然直接无法连接了,报错如下:
👤 Starting a new connection to: "20.228.249.246" port "22"
⚙️ Starting address resolution of "20.228.249.246"
⚙️ Address resolution finished
⚙️ Connecting to "20.228.249.246" port "22"
👤 Connection to "20.228.249.246" established
⚙️ Starting SSH session
⚙️ Remote server: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
⚙️ Agreed KEX algorithm: ecdh-sha2-nistp256
⚙️ Agreed Host Key algorithm: ecdsa-sha2-nistp256
⚙️ Agreed server-to-client cipher: aes128-ctr MAC: hmac-sha2-256
⚙️ Agreed client-to-server cipher: aes128-ctr MAC: hmac-sha2-256
⚙️ Agreed client-to-server compression: none
⚙️ Agreed server-to-client compression: none
⚙️ Handshake finished
👤 Checking host key: 08:1b:c2:53:fb:08:7c:4e:1c:3f:c4:c1:a8:1a:23:00
👤 Host "20.228.249.246":"22" is known and matches
👤 Authenticating to "20.228.249.246":"22" as "dingdingtest"
⚙️ Available client authentication methods: publickey,password,keyboard-interactive
⚙️ Authentication that can continue: publickey
👤 Authenticating using publickey method
❗ Authentication failed (publickey)
⚙️ Partial success: no
⚙️ Authentication that can continue: publickey
😨 No more authentication methods to try
以为是密钥有问题了,到auzre上重新生成私钥下载下来再导入termius,还是报一样的错误,
通过auzre的shell连接到vm,sudo systemctl restart sshd,重启服务也不行,
sudo systemctl status sshd 看到ssh正常运行,但是有报错如下:
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2024-04-21 19:27:10 CST; 6min ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 974948 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Main PID: 974950 (sshd)
Tasks: 1 (limit: 4623)
Memory: 1.7M
CPU: 89ms
CGroup: /system.slice/ssh.service
└─974950 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"
Apr 21 19:27:10 dingdingtest sshd[974950]: Server listening on :: port 22.
Apr 21 19:27:10 dingdingtest systemd[1]: Started OpenBSD Secure Shell server.
Apr 21 19:27:48 dingdingtest sshd[974960]: Authentication refused: bad ownership or modes for directory /home/dingdingtest
权限有问题?这是什么妖魔鬼怪?用最新的Llama3查了一下,这家伙一会中文一会英文的,看来是标准的真洋鬼子,不过问题还是查到了,
SSH对用户主目录的权限有严格的要求,特别是当使用公钥认证时。如果用户主目录对其他用户开放了写权限,那么其他用户可能能够更改SSH配置或密钥,这会导致安全问题。因此,SSH会拒绝在主目录权限设置不正确的情况下进行公钥认证。
也就是需要把目录权限调整到只能ssh的账号自己访问,chmod go-w /home/dingdingtest 执行之后就好了,但是吊诡的是,这个目录权限确实调整过,但这是几个月前的事了,这几个月用的都好好的,怎么今天就突然出问题了?
也可能是微软又偷偷更新安全策略了?