无密访问不生效的问题解决

问题现象描述

使用ssh-keygen生成密钥，然后通过ssh-copy-id将id_rsa.pub拷贝到要访问机器的authorized_keys中，
再通过ssh连接时，仍然提示要输入密码

问题定位

检查日志/var/log/secure，有如下错误信息

Mar 20 11:17:04 myhost sshd[3774]: Authentication refused: bad ownership or modes for file /root/.ssh/authorized_keys
Mar 20 11:17:04 myhost sshd[3774]: Connection closed by 192.168.1.104 [preauth]
Mar 20 11:19:27 myhost sshd[3828]: Accepted password for root from 192.168.1.101 port 57465 ssh2
Mar 20 11:19:27 myhost sshd[3828]: pam_unix(sshd:session): session opened for user root by (uid=0)
Mar 20 11:19:49 myhost sshd[3850]: Authentication refused: bad ownership or modes for directory /root/.ssh

查看目录权限信息

[root@myhost ~]# getfacl /root/
getfacl: Removing leading '/' from absolute path names
# file: root/
# owner: root
# group: root
user::rwx
group::rwx
other::rwx

[root@myhost ~]# getfacl /root/.ssh/
getfacl: Removing leading '/' from absolute path names
# file: root/.ssh/
# owner: root
# group: root
user::rwx
group::---
other::---

修改目录权限，修复问题

[root@myhost ~]# chmod 0644 /root/.ssh/authorized_keys 
[root@myhost ~]# ssh 192.168.1.104
root@192.168.1.104's password: 

[root@myhost ~]# chmod 0700 /root/.ssh/
[root@myhost ~]# ssh 192.168.1.104
root@192.168.1.104's password: 

[root@myhost ~]# chmod 0700 /root/
[root@myhost ~]# ssh 192.168.1.104
Last login: Tue Mar 20 11:19:27 2018 from 192.168.1.101
[root@myhost ~]#