求助：Solaris互信机制。

UnixPanther

各位，我现在在处理一个SSH互信机制的问题。现在的情况是，A、B两个机器上都有相同的用户，互信机制只是从A机器登录到B机器。\r\n现在在A机器上使用用户 user2 可以不用密码登录到 B机器上；命令为“ssh [A机器的IP地址]”。但是，在A机器上使用用户user，就必须要输入密码才能够登录到B机器上。\r\n实现想不通这是为什么，请各位大侠赐教。非常感谢！！\r\n\r\n\r\n以下是2个调试信息：\r\nA-----> , 用户user：\r\n$ ssh 10.200.160.67 -v\r\nSun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: Rhosts Authentication disabled, originating port will not be trusted.\r\ndebug1: ssh_connect: needpriv 0\r\ndebug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.\r\ndebug1: Connection established.\r\ndebug1: identity file /export/home/user/.ssh/identity type -1\r\ndebug1: identity file /export/home/user/.ssh/id_rsa type -1\r\ndebug1: identity file /export/home/user/.ssh/id_dsa type -1\r\ndebug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1\r\ndebug1: no match: Sun_SSH_1.1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-Sun_SSH_1.1\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug1: kex: server->client aes128-ctr hmac-md5 none\r\ndebug1: kex: client->server aes128-ctr hmac-md5 none\r\ndebug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: We proposed langtags, ctos: i-default\r\ndebug1: We proposed langtags, stoc: i-default\r\ndebug1: Negotiated lang: i-default\r\ndebug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP\r\ndebug1: Remote: Negotiated main locale: C\r\ndebug1: Remote: Negotiated messages locale: C\r\ndebug1: dh_gen_key: priv key bits set: 110/256\r\ndebug1: bits set: 1598/3191\r\ndebug1: SSH2_MSG_KEX_DH_GEX_INIT sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY\r\ndebug1: Host \'10.200.160.67\' is known and matches the RSA host key.\r\ndebug1: Found key in /export/home/user/.ssh/known_hosts:1\r\ndebug1: bits set: 1568/3191\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug1: newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug1: newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: done: ssh_kex2.\r\ndebug1: send SSH2_MSG_SERVICE_REQUEST\r\ndebug1: got SSH2_MSG_SERVICE_ACCEPT\r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /export/home/user/.ssh/identity\r\ndebug1: Trying private key: /export/home/user/.ssh/id_rsa\r\ndebug1: Trying private key: /export/home/user/.ssh/id_dsa\r\ndebug1: Next authentication method: keyboard-interactive\r\nPassword: \r\n\r\n\r\n-------------------------------------------------------------------------------------------------------\r\nA-----> B 用户user2\r\n$ ssh 10.200.160.67 -v\r\nSun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: Rhosts Authentication disabled, originating port will not be trusted.\r\ndebug1: ssh_connect: needpriv 0\r\ndebug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.\r\ndebug1: Connection established.\r\ndebug1: identity file /export/home/user2/.ssh/identity type -1\r\ndebug1: identity file /export/home/user2/.ssh/id_rsa type 1\r\ndebug1: identity file /export/home/user2/.ssh/id_dsa type -1\r\ndebug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1\r\ndebug1: no match: Sun_SSH_1.1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-Sun_SSH_1.1\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug1: kex: server->client aes128-ctr hmac-md5 none\r\ndebug1: kex: client->server aes128-ctr hmac-md5 none\r\ndebug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: We proposed langtags, ctos: i-default\r\ndebug1: We proposed langtags, stoc: i-default\r\ndebug1: Negotiated lang: i-default\r\ndebug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP\r\ndebug1: Remote: Negotiated main locale: C\r\ndebug1: Remote: Negotiated messages locale: C\r\ndebug1: dh_gen_key: priv key bits set: 138/256\r\ndebug1: bits set: 1561/3191\r\ndebug1: SSH2_MSG_KEX_DH_GEX_INIT sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY\r\ndebug1: Host \'10.200.160.67\' is known and matches the RSA host key.\r\ndebug1: Found key in /export/home/user2/.ssh/known_hosts:1\r\ndebug1: bits set: 1562/3191\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug1: newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug1: newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: done: ssh_kex2.\r\ndebug1: send SSH2_MSG_SERVICE_REQUEST\r\ndebug1: got SSH2_MSG_SERVICE_ACCEPT\r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /export/home/user2/.ssh/identity\r\ndebug1: Trying public key: /export/home/user2/.ssh/id_rsa\r\ndebug1: Server accepts key: pkalg ssh-rsa blen 149 lastkey 682d8 hint 1\r\ndebug1: read PEM private key done: type RSA\r\ndebug1: Authentication succeeded (publickey)\r\ndebug1: channel 0: new [client-session]\r\ndebug1: send channel open 0\r\ndebug1: Entering interactive session.\r\ndebug1: ssh_session2_setup: id 0\r\ndebug1: channel request 0: pty-req\r\ndebug1: channel request 0: shell\r\ndebug1: fd 4 setting TCP_NODELAY\r\ndebug1: channel 0: open confirm rwindow 0 rmax 32768\r\nLast login: Mon Mar 30 07:24:32 2009 from 10.200.179.21\r\nSun Microsystems Inc.   SunOS 5.10      Generic January 2005\r\n$

UnixPanther

欢迎光临，没事常来看看～～

山野村夫

从错误现象看user的key有问题，再生成一次试试

UnixPanther

楼上的兄台，刚才在B机器上，使用命令“ssh-keygen -t rsa”重新生成了user的 RSA 密钥。将pub的文件拷贝到A机器的目录~/.ssh下并改名为authorized_keys，但是还是一样需要输入密码。\r\n我对比了一下重新生成前和重新生成后的调试日志，只是文件大小有差异。\r\n以下是重新生成后key后，调试日志。\r\n$ ssh 10.200.160.67 -v\r\nSun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: Rhosts Authentication disabled, originating port will not be trusted.\r\ndebug1: ssh_connect: needpriv 0\r\ndebug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.\r\ndebug1: Connection established.\r\ndebug1: identity file /export/home/user/.ssh/identity type -1\r\ndebug1: identity file /export/home/user/.ssh/id_rsa type -1\r\ndebug1: identity file /export/home/user/.ssh/id_dsa type -1\r\ndebug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1\r\ndebug1: no match: Sun_SSH_1.1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-Sun_SSH_1.1\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug1: kex: server->client aes128-ctr hmac-md5 none\r\ndebug1: kex: client->server aes128-ctr hmac-md5 none\r\ndebug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: We proposed langtags, ctos: i-default\r\ndebug1: We proposed langtags, stoc: i-default\r\ndebug1: Negotiated lang: i-default\r\ndebug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP\r\ndebug1: Remote: Negotiated main locale: C\r\ndebug1: Remote: Negotiated messages locale: C\r\ndebug1: dh_gen_key: priv key bits set: 116/256\r\ndebug1: bits set: 1637/3191\r\ndebug1: SSH2_MSG_KEX_DH_GEX_INIT sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY\r\ndebug1: Host \'10.200.160.67\' is known and matches the RSA host key.\r\ndebug1: Found key in /export/home/user/.ssh/known_hosts:1\r\ndebug1: bits set: 1595/3191\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug1: newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug1: newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: done: ssh_kex2.\r\ndebug1: send SSH2_MSG_SERVICE_REQUEST\r\ndebug1: got SSH2_MSG_SERVICE_ACCEPT\r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /export/home/user/.ssh/identity\r\ndebug1: Trying private key: /export/home/user/.ssh/id_rsa\r\ndebug1: Trying private key: /export/home/user/.ssh/id_dsa\r\ndebug1: Next authentication method: keyboard-interactive\r\nPassword: \r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\nPassword: \r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\nPassword: \r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: No more authentication methods to try.\r\nPermission denied (gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased).\r\ndebug1: Calling cleanup 0x34214(0x0)

山野村夫

这个我也不大懂了，等高人来解决吧，我也顺便学习学习

UnixPanther

先用USER2用着，这是一个技术问题。等待高人……

li_hunter

在自己的机器上试了一下，成功了。方法为：user账号也必须使用ssh-keygen生成rsa的key，并将id_rsa.pub传到B机器上的authorized_keys文件中即可。为了不输入密钥，生成key时的密钥必须为空串。

UnixPanther

楼上的兄台。\r\n对于user2，我就是按照这个方法在B机器上生成的，然后将id_rsa.pub文件拷贝到A机器的user2 目录下。user2是可以不输入密码登录的。\r\n对于user，是使用与user2 同样的方法，但是它却让输入密码。即使再生成一次，也还是这样。\r\n\r\n这就是问题原因。\r\n\r\n我想这个问题，应该设计到SSH的底层的一些东西或者是我们平时不关注的区域。\r\n比较棘手。\r\n\r\n现在不断的顶，主要是想学习一下。如果是在解决不了，就这样吧。\r\n毕竟达到目的的方法多着呢。

smz0102

ssh-keygen -t rsa\r\ncp /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys\r\n然后把.ssh 文件夹里的内容都拷贝到另一台机器上\r\n这样就可以互信了