调试ssh信任关系过程

1.问题描述

虚拟机搭建hadoop伪分布式，已经正常运行很长一段时间了，ssh信任关系也没有任何问题，今天尝试安装了lzo，安装完毕准备重启hadoop使其生效，一直提示需要输入密码，测试了下 ssh localhost date，一样提示需要输入密码，问题就出在了ssh信任关系上

2.解决过程

2.1.尝试解决1

• 删除hadoop用户家目录下的.ssh

[hadoop@hadoop000 ~]$ rm -rf .ssh

• 重新进行ssh配置

# 三步回车
[hadoop@hadoop000 ~]$ ssh-keygen
[hadoop@hadoop000 .ssh]$ cat id_rsa.pub >> authorized_keys 
[hadoop@hadoop000 .ssh]$ chmod 600 authorized_keys

• 测试

[hadoop@hadoop000 .ssh]$ ssh localhost date
hadoop@localhost's password: 
Permission denied, please try again.
hadoop@localhost's password: 
Permission denied, please try again.
hadoop@localhost's password: 
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

问题依然存在

2.2.尝试解决2

• 查看/var/log/secure

[root@hadoop000 log]# tail -f secure
Sep 30 10:26:00 hadoop000 sshd[112168]: Accepted password for root from 172.16.75.1 port 61385 ssh2
Sep 30 10:26:00 hadoop000 sshd[112168]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep 30 10:31:43 hadoop000 sshd[112203]: Authentication refused: bad ownership or modes for directory /home/hadoop
Sep 30 10:31:45 hadoop000 sshd[112203]: Failed password for hadoop from ::1 port 43650 ssh2
Sep 30 10:31:45 hadoop000 sshd[112203]: Failed password for hadoop from ::1 port 43650 ssh2
Sep 30 10:31:45 hadoop000 sshd[112203]: Connection closed by ::1 port 43650 [preauth]
Sep 30 10:36:50 hadoop000 sshd[112225]: Authentication refused: bad ownership or modes for directory /home/hadoop
Sep 30 10:36:56 hadoop000 sshd[112225]: Failed password for hadoop from ::1 port 43662 ssh2
Sep 30 10:36:56 hadoop000 sshd[112225]: Failed password for hadoop from ::1 port 43662 ssh2
Sep 30 10:36:56 hadoop000 sshd[112225]: Connection closed by ::1 port 43662 [preauth]

其实这里已经可以看出问题所在，为了让问题更明确，转到hadoop用户下重新执行 ssh localhost date ，然后就会看到root用户的界面会多出几行刚输出错误信息

[root@hadoop000 log]# tail -f secure
Sep 30 10:26:00 hadoop000 sshd[112168]: Accepted password for root from 172.16.75.1 port 61385 ssh2
Sep 30 10:26:00 hadoop000 sshd[112168]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep 30 10:31:43 hadoop000 sshd[112203]: Authentication refused: bad ownership or modes for directory /home/hadoop
Sep 30 10:31:45 hadoop000 sshd[112203]: Failed password for hadoop from ::1 port 43650 ssh2
Sep 30 10:31:45 hadoop000 sshd[112203]: Failed password for hadoop from ::1 port 43650 ssh2
Sep 30 10:31:45 hadoop000 sshd[112203]: Connection closed by ::1 port 43650 [preauth]
Sep 30 10:36:50 hadoop000 sshd[112225]: Authentication refused: bad ownership or modes for directory /home/hadoop
Sep 30 10:36:56 hadoop000 sshd[112225]: Failed password for hadoop from ::1 port 43662 ssh2
Sep 30 10:36:56 hadoop000 sshd[112225]: Failed password for hadoop from ::1 port 43662 ssh2
Sep 30 10:36:56 hadoop000 sshd[112225]: Connection closed by ::1 port 43662 [preauth]

# 以下为刚输出的错误信息
Sep 30 10:38:39 hadoop000 sshd[112234]: Authentication refused: bad ownership or modes for directory /home/hadoop
Sep 30 10:38:42 hadoop000 sshd[112234]: Failed password for hadoop from ::1 port 43668 ssh2
Sep 30 10:38:42 hadoop000 sshd[112234]: Failed password for hadoop from ::1 port 43668 ssh2
Sep 30 10:38:42 hadoop000 sshd[112234]: Connection closed by ::1 port 43668 [preauth]

到此问题已准确定位是 /home/hadoop 目录权限问题，接下来就是修改该目录权限
⚠️ 只修改该目录权限，而不改动该目录下的文件权限

# 修改前
[root@hadoop000 home]# ll
总用量 4
drwxrwxr-x. 13 hadoop hadoop 4096 9月  30 10:09 hadoop
drwx------.  2 mysql  mysql    83 9月  16 22:57 mysql

# 问题要害
[root@hadoop000 home]# chmod 700 hadoop

# 修改后
[root@hadoop000 home]# ll
总用量 4
drwx------. 13 hadoop hadoop 4096 9月  30 10:09 hadoop
drwx------.  2 mysql  mysql    83 9月  16 22:57 mysql

接着再去hadoop用户下验证ssh信任关系

[hadoop@hadoop000 .ssh]$ ssh localhost date
2019年 09月 30日 星期一 10:40:10 CST