Linux 做 SSH 免密连接 Windows 踩坑记录

做 Linux SSH 免密连接 Windows 10 时踩到个坑，按照教程做了以下操作：

1. 把 Linux 上生成的 id_rsa.pub 复制到了 Windows 10 下的C:/Users/<用户名>/authorized_keys；
2. 修改C:\ProgramData\ssh\sshd_config，注释以下两行

   # Match Group administrators
   #        AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
   

   去掉注释并修改以下三行

   PubkeyAuthentication yes
   AuthorizedKeysFile	.ssh/authorized_keys
   PasswordAuthentication yes
   

3. 在服务中重启OpenSSH SSH Server

但 Linux SSH 连接 Windows 10 仍然需要输入密码。

输入 ssh -vvv <username>@<hostname> 查看详细信息，如下图所示

debug1: Found key in /root/.ssh/known_hosts:3
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /root/.ssh/id_rsa (0x55e2db0f5e30)
debug2: key: /root/.ssh/id_dsa ((nil))
debug2: key: /root/.ssh/id_ecdsa ((nil))
debug2: key: /root/.ssh/id_ed25519 ((nil))
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /root/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_ecdsa
debug3: no such identity: /root/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_ed25519
debug3: no such identity: /root/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: userauth_kbdint: disable: no info_req_seen
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey,keyboard-interactive).

问题大概出在这里

debug1: Offering RSA public key: /root/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51

折腾一下午找到解决方案如下：

修改vim /etc/ssh/sshd_config, 去掉以下行注释并修改为no

StrictModes no

在服务中重启 OpenSSH SSH Server 即可，测试免密登录成功。

网上找到的原因是如果 StrictModes 为 yes 必需保证存放公钥的文件夹的拥有与登录用户名相同，但我看.ssh的拥有者确实是与登录用户名相同的。Windows的权限机制不是太了解，以后会再研究下。