主页 / server / 问题

问题[rsa](server)

Martin Hope
philolegein
Asked: 2021-10-02 22:36:55 +0800 CST
  • 4

我正在尝试诊断 OpenDKIM 验证错误（请参阅此问题）。在野兽的肚子里，我正试图确保生成的密钥实际上是正确的。

我正在生成我的密钥opendkim-genkey -r -d example.com。这会生成两个文件。一个是 RSA 私钥（文件default.private）：

-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDJy9S18vHtrIQNep9PogJfrKNLKKf2VSOvUwOzItlWkY3cRCFx
scSNjfC4QHREcMeUuNO78wvQ+oOk+exLdyl2BggcA659Wi6v8X/+awLXpa9sB6vi
GPi8Zx560GbZu6jGLlEzcOaGDCYqdUxZIdAaOICDORFa3XAywHi87eQPMwIDAQAB
AoGAVSjAvnwlHqEEJVAPNSLwj4Gic9BXeXwakB2fXRSi1YadcEwMNRfJE9fHs2n3
5v4VK60IJbP+05U0wwV5c6t5AgZqpP0GBW8CKUr3BwaF2cJbd+uOXlAm4cx6/S1E
Ocoku0c/vrr3mkO41IuBkB+FRm0y7WXFi7e7M32Tictt0CkCQQDzE08wRLNXxkaM
LyUDMvCtlNzACcmkU73NAHDHhwtrJMMLp7q/s4VIDbmhysoNBblNHJQvA/7zVd13
1CGxbh8/AkEA1IajRLNJ6XTuv9RmK1622BDWix4ogEvbev/zR8ti2JifO6A5gv+L
na5hVAATo563pWjtNZW3sAVKqN7juN5HDQJAP1xKKP/Pa9LQMtxbHoFZwTVrcVdb
y0zUzaoOu8PU0yHrAY/AGxY1aLnDKIxOrKRQT+xiJ/s3qsA4EXMnMTPOSwJBAK5N
dl6EBRyZsK5YDyuG1MNEnBEhPOpsTKgGf4rkfj9SfVYzxLdxyxoZyO1R2smZBNl+
wv3tuud8j40MsQwQEYkCQBCzH+1IaxoMsSggutvEvqz2SqkFbD5rq/+uL6P6xyYg
PHCYIWomK8zOlmnO+bfbRIzQb7I81vOFq2sr0yQLK+0=
-----END RSA PRIVATE KEY-----

一个生成 DKIM DNS 条目，我假设它包含公钥：

default._domainkey  IN  TXT ( "v=DKIM1; k=rsa; s=email; "
      "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJy9S18vHtrIQNep9PogJfrKNLKKf2VSOvUwOzItlWkY3cRCFxscSNjfC4QHREcMeUuNO78wvQ+oOk+exLdyl2BggcA659Wi6v8X/+awLXpa9sB6viGPi8Zx560GbZu6jGLlEzcOaGDCYqdUxZIdAaOICDORFa3XAywHi87eQPMwIDAQAB" )  ; ----- DKIM key default for example.com

我假设“p=”条目是公钥，但如果是，我不知道如何验证它们是否匹配。我想我可以用 来做到这一点ssh-keygen -y -f default.private，但是，它的输出与 DNS 条目的“p =”部分中的输出明显不同（它甚至不是相同的长度）：

# ssh-keygen -y -f default.private 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDJy9S18vHtrIQNep9PogJfrKNLKKf2VSOvUwOzItlWkY3cRCFxscSNjfC4QHREcMeUuNO78wvQ+oOk+exLdyl2BggcA659Wi6v8X/+awLXpa9sB6viGPi8Zx560GbZu6jGLlEzcOaGDCYqdUxZIdAaOICDORFa3XAywHi87eQPMw==

那么，这里发生了什么？ssh-keygen 不是正确的方法吗（也许我应该用 OpenSSL 做点什么？）？“p=”不是公钥吗？或者，事实上，我的私钥和公钥不匹配？

谢谢！

PS，作为一个可能无关的旁白，我假设由 opendkim 生成的公钥对于前 34 个字符总是相同的MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ——并且总是以IDAQAB.

rsa openssl opendkim ssh-keys
Martin Hope
Omera
Asked: 2021-06-08 00:34:21 +0800 CST
  • 0

我正在尝试使用 ansible ad-hoc 测试与几个网络设备的连接，Ansible 安装在 Ubuntu 20.04.2 LTS 上。

问题：SSH 不工作，因为设备的密钥交换方法只有 ssh-RSA，服务器不支持。试图强制执行 ssh-RSA 但我知道它不可用，因为它没有作为密码协商的密钥交换方法之一发送。

Ansible_输出：

    (venv) omera@sandbox:~/code/ansible/play_06$ ansible all -m ping
edge_02 | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Unable to negotiate with 192.168.1.201 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1",
    "unreachable": true
}
edge_01 | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Unable to negotiate with 192.168.1.200 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1",
    "unreachable": true
}
core_01 | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: Unable to negotiate with 192.168.1.202 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1",
    "unreachable": true

edge_02_debug_output：

Edge_02#

    *Jun  7 07:49:14.738: SSH0: starting SSH control process
    *Jun  7 07:49:14.738: SSH0: sent protocol version id SSH-1.99-Cisco-1.25
    *Jun  7 07:49:14.741: SSH0: protocol version id is - SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.2
    *Jun  7 07:49:14.741: SSH2 0: Server certificate trustpoint not found. Skipping hostkey algo = x509v3-ssh-rsa
    *Jun  7 07:49:14.741: SSH2 0: kexinit sent: hostkey algo = ssh-rsa
    *Jun  7 07:49:14.741: SSH2 0: kexinit sent: encryption algo = aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
    *Jun  7 07:49:14.741: SSH2 0: kexinit sent: mac algo = hmac-sha1,hmac-sha1-96
    *Jun  7 07:49:14.741: SSH2 0: SSH2_MSG_KEXINIT sent
    *Jun  7 07:49:14.741: SSH2 0: SSH2_MSG_KEXINIT received
    *Jun  7 07:49:14.741: SSH2 0: kex: client->server enc:aes128-ctr mac:hmac-sha1 
    *Jun  7 07:49:14.741: SSH2 0: kex: server->client enc:aes128-ctr mac:hmac-sha1 
    *Jun  7 07:49:14.741: %SSH-3-NO_MATCH: No matching kex algorithm found: client curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c server diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

我担心的是是否可以将 RSA 设置为 ubuntu 上的密钥交换方法（ansible 正在使用 sshpass）？

ii  sshpass  1.06-1   amd64  Non-interactive ssh password authentication
ssh rsa ansible cipher
Martin Hope
Inquisitive
Asked: 2021-01-19 22:03:11 +0800 CST
  • 0

这个问题的灵感来自这个线程

假设场景，对于上下文如下：

  1. SSH 服务器，无论是路由器、防火墙等，都首先在私有 + 安全环境中进行配置，然后再进行部署。SSH 密钥是在此环境中的服务器上本地生成的。
  2. SSH 服务器有自己的 ACL，用于拒绝来自除我们主机之外的任何东西的连接
  3. 主机将是具有多个用户的 Linux 机器

标准方法可能是使用 PKI，并在所有用户帐户上安装受信任的 CA，并部署本地 SCEP 服务器等。但取而代之的是，谨慎的做法是：

  1. 在安全环境中，并在配置时，将服务器的 RSA 指纹导入known_hosts我们主机的容器（或存储它的任何地方，我对 Linux 还不太熟悉），使用ssh-keyscan -H x.x.x.x >> ~/.ssh/known_hosts

  2. 在该主机上的用户之间共享/镜像该 RSA 指纹容器

  3. 配置主机/每个用户在出现以下提示时拒绝/丢弃/拒绝连接，以便

The authenticity of host '[hostname] ([IP address])' can't be established. RSA key fingerprint is [key fingerprint]. Are you sure you want to continue connecting (yes/no)?

  1. 他们无法连接到任何未完成此过程的服务器，然后
  2. 对于无法实施上述过程+限制但仍需要远程配置的情况，也许创建一个单独的沙盒用户，以便主要更常用的密码不会被可能的假 SSH 服务器破坏。
linux ssh rsa pki ssh-keys
Martin Hope
d-_-b
Asked: 2020-12-09 00:15:12 +0800 CST
  • 2

我在 Windows 10 上。需要 ssh 到 Linux CentOS 服务器。尝试 Putty 和 Windows SSH（在功能中打开。Powershell？）。

使用 PuttyGen，我生成了一个私有和公共 RSA 密钥对 - rsa 和 rsa.pub ，没有任何密码。这两个文件都在我的桌面上。server333 在 C:\Users\johndoe.ssh\known_hosts 中有一个条目。我的 Windows PC 上的 .ssh 目录中没有其他文件或目录。公钥也被复制到linux盒子的/home/johndoe/.ssh/authorized_keys

我试过ssh -i rsa -vvv server333了，但它不起作用。这是日志：

c:\Users\johndoe\Desktop>ssh -i rsa -vvv server333
OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5
debug3: Failed to open file:C:/Users/johndoe/.ssh/config error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_config error:2
debug2: resolving "server333" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to server333 [1.2.3.4] port 22.
debug1: Connection established.
key_load_public: invalid format
debug1: identity file rsa type -1
debug3: Failed to open file:c:/Users/johndoe/Desktop/rsa-cert error:2
debug3: Failed to open file:c:/Users/johndoe/Desktop/rsa-cert.pub error:2
debug1: key_load_public: No such file or directory
debug1: identity file rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to server333:22 as 'corp\\johndoe'
debug3: hostkeys_foreach: reading file "C:\\Users\\johndoe/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from server333
debug3: Failed to open file:C:/Users/johndoe/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa,[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
debug2: ciphers stoc: [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
debug2: MACs ctos: [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
debug2: MACs stoc: [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: rsa-sha2-512
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ssh-rsa SHA256:abcd
debug3: hostkeys_foreach: reading file "C:\\Users\\johndoe/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from server333
debug3: Failed to open file:C:/Users/johndoe/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug3: hostkeys_foreach: reading file "C:\\Users\\johndoe/.ssh/known_hosts"
debug3: record_hostkey: found key type RSA in file C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from 1.2.3.4
debug3: Failed to open file:C:/Users/johndoe/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug1: Host 'server333' is known and matches the RSA host key.
debug1: Found key in C:\\Users\\johndoe/.ssh/known_hosts:1
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug3: unable to connect to pipe \\\\.\\pipe\\openssh-ssh-agent, error: 2
debug1: pubkey_prepare: ssh_get_authentication_socket: The socket is not connected
debug2: key: rsa (0000000000000000), explicit
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 53
debug3: input_userauth_banner
NOTICE TO USERS
=============================================================================
This is an official computer system and is the property of
ACME, Inc. It is for authorized users only. Unauthorized users are
prohibited. Users (authorized or unauthorized) have no explicit or
implicit expectation of privacy. Any or all uses of this system may be
subject to one or more of the following actions: interception,
monitoring, recording, auditing, inspection and disclosing to security
personnel and law enforcement personnel, as well as authorized officials
of other agencies, both domestic and foreign. By using this system, the
user consents to these actions. Unauthorized or improper use of this
system may result in administrative disciplinary action and civil and
criminal penalties. By accessing this system you indicate your awareness
of and consent to these terms and conditions of use. Discontinue access
immediately if you do not agree to the conditions stated in this notice.
=============================================================================
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: rsa
debug3: sign_and_send_pubkey: RSA SHA256:zyxw
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
debug3: failed to open file:c:/dev/tty error:3
debug1: read_passphrase: can't open /dev/tty: No such file or directory
corp\johndoe@server333's password:
windows linux centos ssh rsa
Martin Hope
Chacko Mathew
Asked: 2020-09-02 10:23:46 +0800 CST
  • 1

服务器日志

Options error: Unrecognized option or missing or extra parameter(s) in server.ovpn:4: cert (2.4.9) Use --help for more information.

服务器配置

server 192.168.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
ca ca.crt
cert serverport 1194
proto udp

任何人都可以帮助解决这个问题吗？

dev tun
server 192.168.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
ca ca.crt
cert serverVPN.crt
key serverVPN.key
dh dh1024.pem
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
client-to-client
log-append /var/log/openvpn
group daemon
daemon
verb 3.crt
key server.key
dh dh1024.pem
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
client-to-client
log-append /var/log/openvpn
group daemon
daemon
verb 3
openvpn rsa public-key
Martin Hope
hatted
Asked: 2018-12-16 08:28:39 +0800 CST
  • 4

我想将 id_rsa 文件转换为 ppk 文件。我发现有很多网站教授“如何在 MAC 中将 ppk 转换为 rsa”，但反之则不然。有没有办法将 rsa 私钥转换为 ppk 供 Windows 从 MAC 使用？

rsa
Martin Hope
Matt B
Asked: 2017-03-17 02:58:57 +0800 CST
  • 1

我编写了这个脚本，它现在可以在没有安装 SElinux 的系统上完美运行。

echo Enter server IP:
read server
scp /home/Zenoss/.ssh/authorized_keys random@$server:/home/random
sshpass -p randompassword  ssh -t  random@$server sudo -i 'useradd zenoss; sudo mkdir /home/zenoss/.ssh; sudo mv /home/random/authorized_keys /home/zenoss/.ssh/;
sudo chmod 700 /home/zenoss/.ssh;
sudo chmod 600 /home/zenoss/.ssh/authorized_keys;
sudo chown -R zenoss /home/zenoss/.ssh;
sudo chgrp -R zenoss /home/zenoss/.ssh;
exit'

所以在没有 SElinux 的服务器上，脚本可以运行，然后 Zenoss 可以通过 SSH 登录到远程服务器并开始监控。但是在启用 SELinux 的系统上，脚本可以工作，但 Zenoss 无法通过 SSH 连接到远程服务器，调试信息显示它没有看到已成功设置的 authorized_keys 文件。

OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Connecting to ***** port 22.
debug1: Connection established.
debug1: identity file /home/zenoss/.ssh/id_rsa type 1
debug1: identity file /home/zenoss/.ssh/id_rsa-cert type -1
debug1: identity file /home/zenoss/.ssh/id_dsa type 2
debug1: identity file /home/zenoss/.ssh/id_dsa-cert type -1
debug1: identity file /home/zenoss/.ssh/id_ecdsa type -1
debug1: identity file /home/zenoss/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/zenoss/.ssh/id_ed25519 type -1
debug1: identity file /home/zenoss/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr [email protected] none
debug1: kex: client->server aes128-ctr [email protected] none
debug1: kex: [email protected] need=16 dh_need=16
debug1: kex: [email protected] need=16 dh_need=16
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA ***************
The authenticity of host '******' can't be established.
ECDSA key fingerprint is **************************
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '*******' (ECDSA) to the list of known hosts.
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/zenoss/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Offering DSA public key: /home/zenoss/.ssh/id_dsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /home/zenoss/.ssh/id_ecdsa
debug1: Trying private key: /home/zenoss/.ssh/id_ed25519
debug1: Next authentication method: password
zenoss@****s password:

有谁知道这是什么原因以及我如何解决它，禁用 SELinux 不是一个选项。

韩国

linux bash ssh rsa selinux
Martin Hope
raju
Asked: 2016-12-15 08:13:54 +0800 CST
  • 5

我无法使用公钥对登录。我确实可以使用密码访问。以下是服务器端和客户端的日志。为什么我无法登录？

type=CRYPTO_KEY_USER msg=audit(1481731455.027:102046): user pid=8859 uid=0 auid=0 ses=6158 msg='op=destroy kind=session fp=? direction=both spid=8860 suid=74 rport=59031 laddr=XX.XXX.XX.XXX lport=22  exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=? res=success'
type=USER_ERR msg=audit(1481731455.028:102047): user pid=8859 uid=0 auid=0 ses=6158 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=YY.YYY.YY.YYY addr=YY.YYY.YY.YYY terminal=ssh res=failed'
type=CRYPTO_KEY_USER msg=audit(1481731455.028:102048): user pid=8859 uid=0 auid=0 ses=6158 msg='op=destroy kind=server fp=6f:21:ce:5c:81:10:5e:63:db:32:54:71:80:bf:99:97 direction=? spid=8859 suid=0  exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1481731455.028:102049): user pid=8859 uid=0 auid=0 ses=6158 msg='op=destroy kind=server fp=d7:a6:59:60:99:86:45:95:69:79:bf:ea:8a:fa:0a:46 direction=? spid=8859 suid=0  exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=? res=success'
type=USER_LOGIN msg=audit(1481731455.028:102050): user pid=8859 uid=0 auid=0 ses=6158 msg='op=login acct="user" exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=ssh res=failed'
type=CRYPTO_KEY_USER msg=audit(1481731455.707:102051): user pid=8862 uid=0 auid=0 ses=6158 msg='op=destroy kind=server fp=6f:21:ce:5c:81:10:5e:63:db:32:54:71:80:bf:99:97 direction=? spid=8862 suid=0  exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1481731455.707:102052): user pid=8862 uid=0 auid=0 ses=6158 msg='op=destroy kind=server fp=d7:a6:59:60:99:86:45:95:69:79:bf:ea:8a:fa:0a:46 direction=? spid=8862 suid=0  exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=? res=success'
type=CRYPTO_SESSION msg=audit(1481731455.708:102053): user pid=8861 uid=0 auid=0 ses=6158 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=8862 suid=74 rport=59032 laddr=XX.XXX.XX.XXX lport=22  exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=? res=success'
type=CRYPTO_SESSION msg=audit(1481731455.708:102054): user pid=8861 uid=0 auid=0 ses=6158 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=8862 suid=74 rport=59032 laddr=XX.XXX.XX.XXX lport=22  exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=? res=success'
type=USER_AUTH msg=audit(1481731455.764:102055): user pid=8861 uid=0 auid=0 ses=6158 msg='op=pubkey acct="user" exe="/usr/sbin/sshd" hostname=? addr=YY.YYY.YY.YYY terminal=ssh res=failed'

以下是客户端的日志

OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /home/user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to XX.XXX.XX.XXX [XX.XXX.XX.XXX] port 22.
debug1: Connection established.
debug1: identity file /home/user/.ssh/identity type -1
debug1: identity file /home/user/.ssh/identity-cert type -1
debug1: identity file /home/user/.ssh/id_rsa type 1
debug1: identity file /home/user/.ssh/id_rsa-cert type -1
debug1: identity file /home/user/.ssh/id_dsa type -1
debug1: identity file /home/user/.ssh/id_dsa-cert type -1
debug1: identity file /home/user/.ssh/id_ecdsa type -1
debug1: identity file /home/user/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'XX.XXX.XX.XXX' is known and matches the RSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:6
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+                           =====================                             +
+                           !!! C A U T I O N !!!                             +
+                           =====================                             +
+                                                                             +
+               This system is for the use of authorized users only.          +
+       Individuals using this computer system without authority, or in       +
+       excess of their authority, are subject to having all of their         +
+       activities on this system monitored and recorded by system            +
+       personnel.                                                            +
+       In the course of monitoring individuals improperly using this         +
+       system, or in the course of system maintenance, the activitie         +
+       of authorized users may also be monitored.                            +
+       Anyone using this system expressly consents to such monitoring        +
+       and is advised that if such monitoring reveals possible               +
+       evidence of criminal activity, system personnel may provide the       +
+       evidence of such monitoring to law enforcement officials.             +
+                                                                             +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/user/.ssh/identity
debug1: Offering public key: /home/user/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/user/.ssh/id_dsa
debug1: Trying private key: /home/user/.ssh/id_ecdsa
debug1: Next authentication method: password
[email protected]'s password:

可能是什么原因？不过，我无法从服务器日志中获得太多收益。

linux authentication ssh rsa
Martin Hope
Buzkie
Asked: 2016-06-24 10:25:07 +0800 CST
  • 0

我正在尝试使用我的应用程序 SFTP 客户端测试连接来连接到 MF，但出现错误：

SFTP 用户别名 GLDFundingEngine_User 测试失败。详细信息： Session.connect: java.security.InvalidAlgorithmParameterException: Prime size 必须是 64 的倍数，并且只能从 512 到 2048（含）

这是一个内置客户端，所以我对它没有太多控制权。我测试了这两个键，它们应该很好：

ssh-keygen -lf intserv.rsa.pub
2048

ssh-keygen -lf GLDFundingEngine_XXXXXXXXXXXXXXXXXXXX_22_rsa.pub
1024

这个错误可能指向其他东西吗？搜索堆栈交换只是指向我无法更改的不同 SSH 库。

谢谢

sftp rsa
Martin Hope
Florent
Asked: 2016-04-15 23:47:05 +0800 CST
  • 2

我正在寻找 EJBCA 用于生成一般私钥的方法（CA、Sub-Ca、证书......）。

例如，假设您想要 RSA 2048 密钥大小。生成过程是否全部在 EJBCA 应用程序中完成？他们是否依赖基于 Java EE 的应用服务器随机生成（在我的例子中是 Jboss）？本地实现的随机数生成是否存在链接，例如在 Linux /dev/(u)random 上？

熵的水平是多少，他们保证一个吗？

rsa pki random-number-generator entropy-pool