求助：Solaris互信机制。

UnixPanther

各位，我现在在处理一个SSH互信机制的问题。现在的情况是，A、B两个机器上都有相同的用户，互信机制只是从A机器登录到B机器。
现在在A机器上使用用户 user2 可以不用密码登录到 B机器上；命令为“ssh [A机器的IP地址]”。但是，在A机器上使用用户user，就必须要输入密码才能够登录到B机器上。
实现想不通这是为什么，请各位大侠赐教。非常感谢！！


以下是2个调试信息：
A-----> , 用户user：
$ ssh 10.200.160.67 -v
Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: ssh_connect: needpriv 0
debug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.
debug1: Connection established.
debug1: identity file /export/home/user/.ssh/identity type -1
debug1: identity file /export/home/user/.ssh/id_rsa type -1
debug1: identity file /export/home/user/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1
debug1: no match: Sun_SSH_1.1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-Sun_SSH_1.1
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default
debug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default
debug1: We proposed langtags, ctos: i-default
debug1: We proposed langtags, stoc: i-default
debug1: Negotiated lang: i-default
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: Remote: Negotiated main locale: C
debug1: Remote: Negotiated messages locale: C
debug1: dh_gen_key: priv key bits set: 110/256
debug1: bits set: 1598/3191
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.200.160.67' is known and matches the RSA host key.
debug1: Found key in /export/home/user/.ssh/known_hosts:1
debug1: bits set: 1568/3191
debug1: ssh_rsa_verify: signature correct
debug1: newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: done: ssh_kex2.
debug1: send SSH2_MSG_SERVICE_REQUEST
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased
debug1: Next authentication method: gssapi-keyex
debug1: Next authentication method: gssapi-with-mic
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug1: Next authentication method: publickey
debug1: Trying private key: /export/home/user/.ssh/identity
debug1: Trying private key: /export/home/user/.ssh/id_rsa
debug1: Trying private key: /export/home/user/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
Password:


-------------------------------------------------------------------------------------------------------
A-----> B 用户user2
$ ssh 10.200.160.67 -v
Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: ssh_connect: needpriv 0
debug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.
debug1: Connection established.
debug1: identity file /export/home/user2/.ssh/identity type -1
debug1: identity file /export/home/user2/.ssh/id_rsa type 1
debug1: identity file /export/home/user2/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1
debug1: no match: Sun_SSH_1.1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-Sun_SSH_1.1
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default
debug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default
debug1: We proposed langtags, ctos: i-default
debug1: We proposed langtags, stoc: i-default
debug1: Negotiated lang: i-default
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: Remote: Negotiated main locale: C
debug1: Remote: Negotiated messages locale: C
debug1: dh_gen_key: priv key bits set: 138/256
debug1: bits set: 1561/3191
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.200.160.67' is known and matches the RSA host key.
debug1: Found key in /export/home/user2/.ssh/known_hosts:1
debug1: bits set: 1562/3191
debug1: ssh_rsa_verify: signature correct
debug1: newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: done: ssh_kex2.
debug1: send SSH2_MSG_SERVICE_REQUEST
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased
debug1: Next authentication method: gssapi-keyex
debug1: Next authentication method: gssapi-with-mic
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug1: Next authentication method: publickey
debug1: Trying private key: /export/home/user2/.ssh/identity
debug1: Trying public key: /export/home/user2/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 149 lastkey 682d8 hint 1
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey)
debug1: channel 0: new [client-session]
debug1: send channel open 0
debug1: Entering interactive session.
debug1: ssh_session2_setup: id 0
debug1: channel request 0: pty-req
debug1: channel request 0: shell
debug1: fd 4 setting TCP_NODELAY
debug1: channel 0: open confirm rwindow 0 rmax 32768
Last login: Mon Mar 30 07:24:32 2009 from 10.200.179.21
Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
$

bbs_currency

来看看的。

UnixPanther

欢迎光临，没事常来看看～～

山野村夫

从错误现象看user的key有问题，再生成一次试试

UnixPanther

楼上的兄台，刚才在B机器上，使用命令“ssh-keygen -t rsa”重新生成了user的 RSA 密钥。将pub的文件拷贝到A机器的目录~/.ssh下并改名为authorized_keys，但是还是一样需要输入密码。
我对比了一下重新生成前和重新生成后的调试日志，只是文件大小有差异。
以下是重新生成后key后，调试日志。
$ ssh 10.200.160.67 -v
Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: ssh_connect: needpriv 0
debug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.
debug1: Connection established.
debug1: identity file /export/home/user/.ssh/identity type -1
debug1: identity file /export/home/user/.ssh/id_rsa type -1
debug1: identity file /export/home/user/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1
debug1: no match: Sun_SSH_1.1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-Sun_SSH_1.1
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default
debug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default
debug1: We proposed langtags, ctos: i-default
debug1: We proposed langtags, stoc: i-default
debug1: Negotiated lang: i-default
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: Remote: Negotiated main locale: C
debug1: Remote: Negotiated messages locale: C
debug1: dh_gen_key: priv key bits set: 116/256
debug1: bits set: 1637/3191
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.200.160.67' is known and matches the RSA host key.
debug1: Found key in /export/home/user/.ssh/known_hosts:1
debug1: bits set: 1595/3191
debug1: ssh_rsa_verify: signature correct
debug1: newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: done: ssh_kex2.
debug1: send SSH2_MSG_SERVICE_REQUEST
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased
debug1: Next authentication method: gssapi-keyex
debug1: Next authentication method: gssapi-with-mic
debug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible
Unknown code 0
)
debug1: Next authentication method: publickey
debug1: Trying private key: /export/home/user/.ssh/identity
debug1: Trying private key: /export/home/user/.ssh/id_rsa
debug1: Trying private key: /export/home/user/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
Password:
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased
Password:
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased
Password:
debug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased
debug1: No more authentication methods to try.
Permission denied (gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased).
debug1: Calling cleanup 0x34214(0x0)

山野村夫

这个我也不大懂了，等高人来解决吧，我也顺便学习学习

UnixPanther

先用USER2用着，这是一个技术问题。等待高人……

UnixPanther

  顶起来～～

li_hunter

在自己的机器上试了一下，成功了。方法为：user账号也必须使用ssh-keygen生成rsa的key，并将id_rsa.pub传到B机器上的authorized_keys文件中即可。为了不输入密钥，生成key时的密钥必须为空串。

UnixPanther

楼上的兄台。
对于user2，我就是按照这个方法在B机器上生成的，然后将id_rsa.pub文件拷贝到A机器的user2 目录下。user2是可以不输入密码登录的。
对于user，是使用与user2 同样的方法，但是它却让输入密码。即使再生成一次，也还是这样。

这就是问题原因。

我想这个问题，应该设计到SSH的底层的一些东西或者是我们平时不关注的区域。
比较棘手。

现在不断的顶，主要是想学习一下。如果是在解决不了，就这样吧。
毕竟达到目的的方法多着呢。