V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
qping
V2EX  ›  CentOS

求助: ssh 远程无法登陆提示: Permission denied, please try again

  •  
  •   qping · 2021-06-04 16:23:54 +08:00 · 1520 次点击
    这是一个创建于 1028 天前的主题,其中的信息可能已经有所发展或是发生改变。

    使用密钥登陆是可以的,但是在别的机器上使用密码登陆就不行了。服务器系统版本是 Centos 7.8.2003.

    尝试过以下的步骤:

    1. 当 ssh 上服务器后,su - root 输入密码是可以的,排除密码错误的问题
    2. /etc/ssh/sshd_config 里面的 # PermitRootLogin yes 的 # 去掉并重启 systemctl restart sshd,还是不行
    3. /etc/ssh/sshd_config 里面的 PasswordAuthentication 值原来就是 yes
    4. setenforce 0 也不行
    5. 尝试查看安全日志 :/var/log/secure 发现不管是登陆成功还是失败,在里面都没有生成新的日志
    6. 查看 /etc/hosts.allow 和 /etc/hosts.deny 里面都没有配置东西
    7. 查看登陆日志:执行 last 命令发现有个 roo 用户(我没有打错,就是少一个 t),是不是有可能被攻击了?
    root     pts/1        170.3.69.2       Fri Jun  4 15:49   still logged in
    root     pts/1        170.3.69.2       Fri Jun  4 15:47 - 15:49  (00:01)
    root     pts/1        170.3.69.2       Fri Jun  4 15:46 - 15:47  (00:00)
    
    ...省略一些差不多的 ...
    
    roo      pts/0        :0               Wed Mar 24 12:23 - 12:24  (00:01)
    roo      pts/0        :0               Wed Mar 24 12:16 - 12:23  (00:07)
    roo      :0           :0               Wed Mar 24 12:10 - down   (00:14)
    reboot   system boot  3.10.0-1127.el7. Wed Mar 24 12:00 - 12:24  (00:24)
    

    既然使用密钥可以登陆的话,那网络问题应该排除了。实在没有办法了,有没有大佬能帮忙鉴定下问题出现在哪里?

    这个是使用密钥成功能登陆的日志( ssh -v -p 22 <ip 地址>):

    OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
    debug1: Reading configuration data /root/.ssh/config
    debug1: /root/.ssh/config line 40: Applying options for *
    debug1: Reading configuration data /etc/ssh/ssh_config
    debug1: /etc/ssh/ssh_config line 58: Applying options for *
    debug1: auto-mux: Trying existing master
    debug1: mux_client_request_session: master session id: 2
    Last login: Fri Jun  4 15:59:42 2021
    

    这个是在别的电脑上使用密码登陆失败的日志( ssh -v -p 22 <ip 地址>):

    OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
    debug1: Reading configuration data /root/.ssh/config
    debug1: /root/.ssh/config line 1: Applying options for *
    debug1: Reading configuration data /etc/ssh/ssh_config
    debug1: /etc/ssh/ssh_config line 58: Applying options for *
    debug1: auto-mux: Trying existing master
    debug1: Control socket "/root/.ssh/<这里是 ip>-22-root" does not exist
    debug1: Connecting to <这里是 ip> [<这里是 ip>] port 22.
    debug1: Connection established.
    debug1: permanently_set_uid: 0/0
    debug1: key_load_public: No such file or directory
    debug1: identity file /root/.ssh/<这里是 key 名称>.key type -1
    debug1: key_load_public: No such file or directory
    debug1: identity file /root/.ssh/<这里是 key 名称>.key-cert type -1
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_7.4
    debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
    debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
    debug1: Authenticating to <这里是 ip>:22 as 'root'
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug1: kex: algorithm: [email protected]
    debug1: kex: host key algorithm: ecdsa-sha2-nistp256
    debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
    debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
    debug1: kex: [email protected] need=64 dh_need=64
    debug1: kex: [email protected] need=64 dh_need=64
    debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
    debug1: Server host key: ecdsa-sha2-nistp256 SHA256:sQeFN1/GfQqAohAXEyndzeCStwG4wEcawUl3vZhwniw
    debug1: Host '<这里是 ip>' is known and matches the ECDSA host key.
    debug1: Found key in /root/.ssh/known_hosts:23
    debug1: rekey after 134217728 blocks
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug1: SSH2_MSG_NEWKEYS received
    debug1: rekey after 134217728 blocks
    debug1: SSH2_MSG_SERVICE_ACCEPT received
    debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    debug1: Next authentication method: gssapi-keyex
    debug1: No valid Key exchange context
    debug1: Next authentication method: gssapi-with-mic
    debug1: Unspecified GSS failure.  Minor code may provide more information
    No Kerberos credentials available (default cache: KEYRING:persistent:0)
    
    debug1: Unspecified GSS failure.  Minor code may provide more information
    No Kerberos credentials available (default cache: KEYRING:persistent:0)
    
    debug1: Next authentication method: publickey
    debug1: Trying private key: /root/.ssh/<这里是 key 名称>.key
    debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    debug1: Next authentication method: password
    root@<这里是 ip>'s password:
    debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    Permission denied, please try again.
    root@<这里是 ip>'s password:
    debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    Permission denied, please try again.
    root@<这里是 ip>'s password:
    debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    debug1: No more authentication methods to try.
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)
    
    第 1 条附言  ·  2021-06-07 09:45:26 +08:00
    今天一早试了下,已经好了。

    问了客户,应该是 ssh 的那个 ip 映射了两个服务器导致的。

    服了。
    7 条回复    2021-06-07 09:51:22 +08:00
    napsterwu
        1
    napsterwu  
       2021-06-04 17:02:02 +08:00 via iPhone
    1. 用 ssh -vvv
    2. 没太看懂你的步骤,是所有机器都可以用证书登陆成功,还是只有部分机器才能用证书登陆成功?
    3. 是部分机器用密码可以登陆成功,还是所有机器都无法用密码登陆成功?
    dier
        2
    dier  
       2021-06-04 17:14:42 +08:00
    1 、看一下尝试用密码登录的那台机器上是不是有正确密钥;
    2 、看一下被登录的机器里~/.ssh/known_hosts 文件里是不是有尝试用密码登录的这个机器的信息,删除试一下
    toaruScar
        3
    toaruScar  
       2021-06-04 20:40:38 +08:00 via iPhone
    你开了连接复用 auto-mux,“使用密钥成功能登陆”的那次不是因为用了密钥登陆,而是因为已经有一个 session 了而已
    qping
        4
    qping  
    OP
       2021-06-07 09:43:38 +08:00
    qping
        5
    qping  
    OP
       2021-06-07 09:43:55 +08:00
    感谢,已经好了
    dier
        6
    dier  
       2021-06-07 09:46:28 +08:00
    @qping 是怎么解决的?建议分享一下解决思路,如果以后有人遇到类似的问题找到这个帖子也许会有帮助
    qping
        7
    qping  
    OP
       2021-06-07 09:51:22 +08:00
    @dier #6 已经 append 了,我这边 ssh 的服务器,中间可能有几层网关、防火墙。 上周出问题的 ip 映射了两台服务器。
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   我们的愿景   ·   实用小工具   ·   2017 人在线   最高记录 6543   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 29ms · UTC 16:18 · PVG 00:18 · LAX 09:18 · JFK 12:18
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.