求助：Solaris互信機(jī)制。

UnixPanther

各位，我現(xiàn)在在處理一個(gè)SSH互信機(jī)制的問題�，F(xiàn)在的情況是，A、B兩個(gè)機(jī)器上都有相同的用戶，互信機(jī)制只是從A機(jī)器登錄到B機(jī)器。\r\n現(xiàn)在在A機(jī)器上使用用戶 user2 可以不用密碼登錄到 B機(jī)器上；命令為“ssh [A機(jī)器的IP地址]”。但是，在A機(jī)器上使用用戶user，就必須要輸入密碼才能夠登錄到B機(jī)器上。\r\n實(shí)現(xiàn)想不通這是為什么，請(qǐng)各位大俠賜教。非常感謝�。�\r\n\r\n\r\n以下是2個(gè)調(diào)試信息：\r\nA-----> , 用戶user：\r\n$ ssh 10.200.160.67 -v\r\nSun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: Rhosts Authentication disabled, originating port will not be trusted.\r\ndebug1: ssh_connect: needpriv 0\r\ndebug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.\r\ndebug1: Connection established.\r\ndebug1: identity file /export/home/user/.ssh/identity type -1\r\ndebug1: identity file /export/home/user/.ssh/id_rsa type -1\r\ndebug1: identity file /export/home/user/.ssh/id_dsa type -1\r\ndebug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1\r\ndebug1: no match: Sun_SSH_1.1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-Sun_SSH_1.1\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug1: kex: server->client aes128-ctr hmac-md5 none\r\ndebug1: kex: client->server aes128-ctr hmac-md5 none\r\ndebug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: We proposed langtags, ctos: i-default\r\ndebug1: We proposed langtags, stoc: i-default\r\ndebug1: Negotiated lang: i-default\r\ndebug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP\r\ndebug1: Remote: Negotiated main locale: C\r\ndebug1: Remote: Negotiated messages locale: C\r\ndebug1: dh_gen_key: priv key bits set: 110/256\r\ndebug1: bits set: 1598/3191\r\ndebug1: SSH2_MSG_KEX_DH_GEX_INIT sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY\r\ndebug1: Host \'10.200.160.67\' is known and matches the RSA host key.\r\ndebug1: Found key in /export/home/user/.ssh/known_hosts:1\r\ndebug1: bits set: 1568/3191\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug1: newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug1: newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: done: ssh_kex2.\r\ndebug1: send SSH2_MSG_SERVICE_REQUEST\r\ndebug1: got SSH2_MSG_SERVICE_ACCEPT\r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /export/home/user/.ssh/identity\r\ndebug1: Trying private key: /export/home/user/.ssh/id_rsa\r\ndebug1: Trying private key: /export/home/user/.ssh/id_dsa\r\ndebug1: Next authentication method: keyboard-interactive\r\nPassword: \r\n\r\n\r\n-------------------------------------------------------------------------------------------------------\r\nA-----> B 用戶user2\r\n$ ssh 10.200.160.67 -v\r\nSun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: Rhosts Authentication disabled, originating port will not be trusted.\r\ndebug1: ssh_connect: needpriv 0\r\ndebug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.\r\ndebug1: Connection established.\r\ndebug1: identity file /export/home/user2/.ssh/identity type -1\r\ndebug1: identity file /export/home/user2/.ssh/id_rsa type 1\r\ndebug1: identity file /export/home/user2/.ssh/id_dsa type -1\r\ndebug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1\r\ndebug1: no match: Sun_SSH_1.1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-Sun_SSH_1.1\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug1: kex: server->client aes128-ctr hmac-md5 none\r\ndebug1: kex: client->server aes128-ctr hmac-md5 none\r\ndebug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: We proposed langtags, ctos: i-default\r\ndebug1: We proposed langtags, stoc: i-default\r\ndebug1: Negotiated lang: i-default\r\ndebug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP\r\ndebug1: Remote: Negotiated main locale: C\r\ndebug1: Remote: Negotiated messages locale: C\r\ndebug1: dh_gen_key: priv key bits set: 138/256\r\ndebug1: bits set: 1561/3191\r\ndebug1: SSH2_MSG_KEX_DH_GEX_INIT sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY\r\ndebug1: Host \'10.200.160.67\' is known and matches the RSA host key.\r\ndebug1: Found key in /export/home/user2/.ssh/known_hosts:1\r\ndebug1: bits set: 1562/3191\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug1: newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug1: newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: done: ssh_kex2.\r\ndebug1: send SSH2_MSG_SERVICE_REQUEST\r\ndebug1: got SSH2_MSG_SERVICE_ACCEPT\r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /export/home/user2/.ssh/identity\r\ndebug1: Trying public key: /export/home/user2/.ssh/id_rsa\r\ndebug1: Server accepts key: pkalg ssh-rsa blen 149 lastkey 682d8 hint 1\r\ndebug1: read PEM private key done: type RSA\r\ndebug1: Authentication succeeded (publickey)\r\ndebug1: channel 0: new [client-session]\r\ndebug1: send channel open 0\r\ndebug1: Entering interactive session.\r\ndebug1: ssh_session2_setup: id 0\r\ndebug1: channel request 0: pty-req\r\ndebug1: channel request 0: shell\r\ndebug1: fd 4 setting TCP_NODELAY\r\ndebug1: channel 0: open confirm rwindow 0 rmax 32768\r\nLast login: Mon Mar 30 07:24:32 2009 from 10.200.179.21\r\nSun Microsystems Inc.   SunOS 5.10      Generic January 2005\r\n$

UnixPanther

歡迎光臨，沒事常來看看～～

山野村夫

從錯(cuò)誤現(xiàn)象看user的key有問題，再生成一次試試

UnixPanther

樓上的兄臺(tái)，剛才在B機(jī)器上，使用命令“ssh-keygen -t rsa”重新生成了user的 RSA 密鑰。將pub的文件拷貝到A機(jī)器的目錄~/.ssh下并改名為authorized_keys，但是還是一樣需要輸入密碼。\r\n我對(duì)比了一下重新生成前和重新生成后的調(diào)試日志，只是文件大小有差異。\r\n以下是重新生成后key后，調(diào)試日志。\r\n$ ssh 10.200.160.67 -v\r\nSun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: Rhosts Authentication disabled, originating port will not be trusted.\r\ndebug1: ssh_connect: needpriv 0\r\ndebug1: Connecting to 10.200.160.67 [10.200.160.67] port 22.\r\ndebug1: Connection established.\r\ndebug1: identity file /export/home/user/.ssh/identity type -1\r\ndebug1: identity file /export/home/user/.ssh/id_rsa type -1\r\ndebug1: identity file /export/home/user/.ssh/id_dsa type -1\r\ndebug1: Remote protocol version 2.0, remote software version Sun_SSH_1.1\r\ndebug1: no match: Sun_SSH_1.1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-Sun_SSH_1.1\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug1: kex: server->client aes128-ctr hmac-md5 none\r\ndebug1: kex: client->server aes128-ctr hmac-md5 none\r\ndebug1: Peer sent proposed langtags, ctos: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: Peer sent proposed langtags, stoc: en-CA,en-US,es-MX,fr-CA,zh,zh-CN,en,es,fr,i-default\r\ndebug1: We proposed langtags, ctos: i-default\r\ndebug1: We proposed langtags, stoc: i-default\r\ndebug1: Negotiated lang: i-default\r\ndebug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP\r\ndebug1: Remote: Negotiated main locale: C\r\ndebug1: Remote: Negotiated messages locale: C\r\ndebug1: dh_gen_key: priv key bits set: 116/256\r\ndebug1: bits set: 1637/3191\r\ndebug1: SSH2_MSG_KEX_DH_GEX_INIT sent\r\ndebug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY\r\ndebug1: Host \'10.200.160.67\' is known and matches the RSA host key.\r\ndebug1: Found key in /export/home/user/.ssh/known_hosts:1\r\ndebug1: bits set: 1595/3191\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug1: newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug1: newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: done: ssh_kex2.\r\ndebug1: send SSH2_MSG_SERVICE_REQUEST\r\ndebug1: got SSH2_MSG_SERVICE_ACCEPT\r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: Next authentication method: gssapi-keyex\r\ndebug1: Next authentication method: gssapi-with-mic\r\ndebug1: Failed to acquire GSS-API credentials for any mechanisms (No credentials were supplied, or the credentials were unavailable or inaccessible\r\nUnknown code 0\r\n)\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /export/home/user/.ssh/identity\r\ndebug1: Trying private key: /export/home/user/.ssh/id_rsa\r\ndebug1: Trying private key: /export/home/user/.ssh/id_dsa\r\ndebug1: Next authentication method: keyboard-interactive\r\nPassword: \r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\nPassword: \r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\nPassword: \r\ndebug1: Authentications that can continue: gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased\r\ndebug1: No more authentication methods to try.\r\nPermission denied (gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,hostbased).\r\ndebug1: Calling cleanup 0x34214(0x0)

山野村夫

這個(gè)我也不大懂了，等高人來解決吧，我也順便學(xué)習(xí)學(xué)習(xí)

UnixPanther

先用USER2用著，這是一個(gè)技術(shù)問題。等待高人……

li_hunter

在自己的機(jī)器上試了一下，成功了。方法為：user賬號(hào)也必須使用ssh-keygen生成rsa的key，并將id_rsa.pub傳到B機(jī)器上的authorized_keys文件中即可。為了不輸入密鑰，生成key時(shí)的密鑰必須為空串。

UnixPanther

樓上的兄臺(tái)。\r\n對(duì)于user2，我就是按照這個(gè)方法在B機(jī)器上生成的，然后將id_rsa.pub文件拷貝到A機(jī)器的user2 目錄下。user2是可以不輸入密碼登錄的。\r\n對(duì)于user，是使用與user2 同樣的方法，但是它卻讓輸入密碼。即使再生成一次，也還是這樣。\r\n\r\n這就是問題原因。\r\n\r\n我想這個(gè)問題，應(yīng)該設(shè)計(jì)到SSH的底層的一些東西或者是我們平時(shí)不關(guān)注的區(qū)域。\r\n比較棘手。\r\n\r\n現(xiàn)在不斷的頂，主要是想學(xué)習(xí)一下。如果是在解決不了，就這樣吧。\r\n畢竟達(dá)到目的的方法多著呢。

smz0102

ssh-keygen -t rsa\r\ncp /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys\r\n然后把.ssh 文件夾里的內(nèi)容都拷貝到另一臺(tái)機(jī)器上\r\n這樣就可以互信了