拒绝许可（publickey，keyboard-interactive）

Question

我尝试使用ssh连接到PlanetLab节点，但出现了“Permission denied (publickey,keyboard-interactive)”的错误。这是什么意思？以下是异常的详细信息。

> OpenSSH_5.1p1 Debian-5ubuntu1, OpenSSL
> 0.9.8g 19 Oct 2007 debug1: Reading configuration data /etc/ssh/ssh_config
> debug1: Applying options for * debug2:
> ssh_connect: needpriv 0 debug1:
> Connecting to planetlab1.csee.usf.edu
> [131.247.2.241] port 22. debug1:
> Connection established. debug1:
> permanently_set_uid: 0/0 debug3: Not a
> RSA1 key file /home/keven/.ssh/id_rsa.
> debug2: key_type_from_name: unknown
> key type '-----BEGIN' debug3:
> key_read: missing keytype debug2:
> key_type_from_name: unknown key type
> 'Proc-Type:' debug3: key_read: missing
> keytype debug2: key_type_from_name:
> unknown key type 'DEK-Info:' debug3:
> key_read: missing keytype debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug3:
> key_read: missing whitespace debug2:
> key_type_from_name: unknown key type
> '-----END' debug3: key_read: missing
> keytype debug1: identity file
> /home/keven/.ssh/id_rsa type 1 debug1:
> Checking blacklist file
> /usr/share/ssh/blacklist.RSA-2048
> debug1: Checking blacklist file
> /etc/ssh/blacklist.RSA-2048 debug1:
> Remote protocol version 2.0, remote
> software version OpenSSH_4.7 debug1:
> match: OpenSSH_4.7 pat OpenSSH_4*
> debug1: Enabling compatibility mode
> for protocol 2.0 debug1: Local version
> string SSH-2.0-OpenSSH_5.1p1
> Debian-5ubuntu1 debug2: fd 3 setting
> O_NONBLOCK debug1: SSH2_MSG_KEXINIT
> sent debug1: SSH2_MSG_KEXINIT received
> debug2: kex_parse_kexinit:
> diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
> debug2: kex_parse_kexinit:
> ssh-rsa,ssh-dss debug2:
> kex_parse_kexinit:
> aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[e-mail],aes128-ctr,aes192-ctr,aes256-ctr
> debug2: kex_parse_kexinit:
> aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[e-mail],aes128-ctr,aes192-ctr,aes256-ctr
> debug2: kex_parse_kexinit:
> hmac-md5,hmac-sha1,[e-mail],hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
> debug2: kex_parse_kexinit:
> hmac-md5,hmac-sha1,[e-mail],hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
> debug2: kex_parse_kexinit:
> none,[e-mail],zlib debug2:
> kex_parse_kexinit:
> none,[e-mail],zlib debug2:
> kex_parse_kexinit:  debug2:
> kex_parse_kexinit:  debug2:
> kex_parse_kexinit: first_kex_follows 0
> debug2: kex_parse_kexinit: reserved 0 
> debug2: kex_parse_kexinit:
> diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
> debug2: kex_parse_kexinit:
> ssh-rsa,ssh-dss debug2:
> kex_parse_kexinit:
> aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[e-mail],aes128-ctr,aes192-ctr,aes256-ctr
> debug2: kex_parse_kexinit:
> aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[e-mail],aes128-ctr,aes192-ctr,aes256-ctr
> debug2: kex_parse_kexinit:
> hmac-md5,hmac-sha1,[e-mail],hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
> debug2: kex_parse_kexinit:
> hmac-md5,hmac-sha1,[e-mail],hmac-ripemd160,[e-mail],hmac-sha1-96,hmac-md5-96
> debug2: kex_parse_kexinit:
> none,[e-mail] debug2:
> kex_parse_kexinit:
> none,[e-mail] debug2:
> kex_parse_kexinit:  debug2:
> kex_parse_kexinit:  debug2:
> kex_parse_kexinit: first_kex_follows 0
> debug2: kex_parse_kexinit: reserved 0 
> debug2: mac_setup: found hmac-md5
> debug1: kex: server->client aes128-cbc
> hmac-md5 none debug2: mac_setup: found
> hmac-md5 debug1: kex: client->server
> aes128-cbc hmac-md5 none debug1:
> SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192)
> sent debug1: expecting
> SSH2_MSG_KEX_DH_GEX_GROUP debug2:
> dh_gen_key: priv key bits set: 128/256
> debug2: bits set: 508/1024 debug1:
> SSH2_MSG_KEX_DH_GEX_INIT sent debug1:
> expecting SSH2_MSG_KEX_DH_GEX_REPLY
> debug3: check_host_in_hostfile:
> filename /root/.ssh/known_hosts
> debug3: check_host_in_hostfile: match
> line 1 debug3: check_host_in_hostfile:
> filename /root/.ssh/known_hosts
> debug3: check_host_in_hostfile: match
> line 2 debug1: Host
> 'planetlab1.csee.usf.edu' is known and
> matches the RSA host key. debug1:
> Found key in /root/.ssh/known_hosts:1
> debug2: bits set: 535/1024 debug1:
> ssh_rsa_verify: signature correct
> debug2: kex_derive_keys debug2:
> set_newkeys: mode 1 debug1:
> SSH2_MSG_NEWKEYS sent debug1:
> expecting SSH2_MSG_NEWKEYS debug2:
> set_newkeys: mode 0 debug1:
> SSH2_MSG_NEWKEYS received debug1:
> SSH2_MSG_SERVICE_REQUEST sent debug2:
> service_accept: ssh-userauth debug1:
> SSH2_MSG_SERVICE_ACCEPT received
> debug2: key: /home/keven/.ssh/id_rsa
> (0xb80c9878) debug1: Authentications
> that can continue:
> publickey,keyboard-interactive debug3:
> start over, passed a different list
> publickey,keyboard-interactive debug3:
> preferred
> gssapi-keyex,gssapi-with-mic,gssapi,publickey,keyboard-interactive,password
> debug3: authmethod_lookup publickey
> debug3: remaining preferred:
> keyboard-interactive,password debug3:
> authmethod_is_enabled publickey
> debug1: Next authentication method:
> publickey debug1: Offering public key:
> /home/keven/.ssh/id_rsa debug3:
> send_pubkey_test debug2: we sent a
> publickey packet, wait for reply
> debug1: Authentications that can
> continue:
> publickey,keyboard-interactive debug2:
> we did not send a packet, disable
> method debug3: authmethod_lookup
> keyboard-interactive debug3: remaining
> preferred: password debug3:
> authmethod_is_enabled
> keyboard-interactive debug1: Next
> authentication method:
> keyboard-interactive debug2:
> userauth_kbdint debug2: we sent a
> keyboard-interactive packet, wait for
> reply debug1: Authentications that can
> continue:
> publickey,keyboard-interactive debug3:
> userauth_kbdint: disable: no
> info_req_seen debug2: we did not send
> a packet, disable method debug1: No
> more authentication methods to try.
> Permission denied
> (publickey,keyboard-interactive).

- Progress Programmer

---

这应该移动到ServerFault。 - Jim Mitchener

我看到了调试输出，但在问题描述中没有证据表明你尝试在程序中实现这个功能（例如libssl等）。 - Tim Post

我的解决方案是：去掉逗号分隔符周围的空格，一切都会正常工作。我试图使authorized_keys中的“command = ...”条目生效。 - arkod

在这种情况下可能会有两个问题。1. 您的私钥权限不正确，即权限为000或其他不允许读取的权限；2. 远程机器的authorized_keys权限不正确，即权限为000或其他不允许读取的权限。解决方法是将这两个文件的权限都设置为chmod 600，如下所示deo的答案。 - H S Rathore

Answer 1

您可能需要仔细检查authorized_keys文件的权限：

$ chmod 600 ~/.ssh/authorized_keys

较新版本的SSH服务器在这方面非常挑剔。

- déo

---

这个回答应该被精选。在讨论“Permission denied (publickey)”问题时，几乎每一个回答都提到了配置文件，但实际上这也可能是问题所在。 - justhalf

目标用户不能在其主目录上拥有组写权限，这会在sshd的日志中显示“身份验证被拒绝：/home/username目录的所有权或模式不正确”。 - user3338098

在这种情况下可能会有两个问题。

1. 您的私钥权限不正确，即权限为000或其他不允许读取的权限 或者，2. 远程机器的authorized_keys权限不正确，即权限为000或其他不允许读取的权限 解决方案是将这两个文件的权限都更改为chmod 600。

- H S Rathore

除了这个解决方案，我还需要更改 .ssh 文件夹的权限：chmod 700 ~/.ssh/ - otidh

Answer 2

你需要更改远程服务器上的 sshd_config 文件（可能位于 /etc/ssh/sshd_config 中）。

更改

PasswordAuthentication no

转化为

PasswordAuthentication yes

然后重启sshd守护进程。

- Geir Freysson

---

终于！在标准的Raspbian上，PasswordAuthentication已被设置为no。 - cjsimon

你的意思是将PasswordAuthentication设置为yes后，问题就解决了吗？ - user1169587

如果您使用的是Windows系统，并且出现“Permission denied (publickey,keyboard-interactive)”错误，则可能无法像此处所述那样正常使用“PasswordAuthentication yes”：https://dev59.com/p8Dqa4cB1Zd3GeqPcWKm - yedririkka

Answer 3

该服务器首先尝试使用公钥进行身份验证。如果不起作用（我猜您还没有设置），则会退而求其次使用“键盘交互”方式。然后应该会要求您输入密码，可能是您没有正确输入密码。您看到了密码提示吗？

- ire_and_curses

---

我已经设置了公钥。而且，它根本不提示我输入密码。 - Progress Programmer

对于这些问题，有什么解决方案吗？我现在也正在经历类似的痛苦，希望这个问题能得到一些答案... - Brett Rigby

我不小心设置了错误的私钥权限 (--w-------)。使用 ssh-add -L 命令来查看是否已经设置了一个密钥，如果没有，则使用 ssh-add 命令添加它。 - mile