SELinux - Script загрузил ключи SSH на удаленный сервер, но не могу подключиться через SSH

Я написал этот скрипт, который теперь отлично работает в системах без установленного SElinux.

echo Enter server IP:
read server
scp /home/Zenoss/.ssh/authorized_keys random@$server:/home/random
sshpass -p randompassword  ssh -t  random@$server sudo -i 'useradd zenoss; sudo mkdir /home/zenoss/.ssh; sudo mv /home/random/authorized_keys /home/zenoss/.ssh/;
sudo chmod 700 /home/zenoss/.ssh;
sudo chmod 600 /home/zenoss/.ssh/authorized_keys;
sudo chown -R zenoss /home/zenoss/.ssh;
sudo chgrp -R zenoss /home/zenoss/.ssh;
exit'

Итак, на серверах без SElinux скрипт работает, а затем Zenoss может войти на удаленный сервер через SSH и начать мониторинг . Однако в системах с включенным SELinux скрипт работает, но Zenoss не может подключиться по SSH к удаленному серверу, отладочная информация показывает, что он не видит файл authorized_keys, который был успешно настроен.

OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Connecting to ***** port 22.
debug1: Connection established.
debug1: identity file /home/zenoss/.ssh/id_rsa type 1
debug1: identity file /home/zenoss/.ssh/id_rsa-cert type -1
debug1: identity file /home/zenoss/.ssh/id_dsa type 2
debug1: identity file /home/zenoss/.ssh/id_dsa-cert type -1
debug1: identity file /home/zenoss/.ssh/id_ecdsa type -1
debug1: identity file /home/zenoss/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/zenoss/.ssh/id_ed25519 type -1
debug1: identity file /home/zenoss/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: curve25519-sha256@libssh.org need=16 dh_need=16
debug1: kex: curve25519-sha256@libssh.org need=16 dh_need=16
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA ***************
The authenticity of host '******' can't be established.
ECDSA key fingerprint is **************************
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '*******' (ECDSA) to the list of known hosts.
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Unspecified GSS failure.  Minor code may provide more information


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/zenoss/.ssh/id_rsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Offering DSA public key: /home/zenoss/.ssh/id_dsa
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Trying private key: /home/zenoss/.ssh/id_ecdsa
debug1: Trying private key: /home/zenoss/.ssh/id_ed25519
debug1: Next authentication method: password
zenoss@****s password: 

Кто-нибудь знает, что вызывает это и как я могу обойти эту проблему, отключение SELinux не является вариантом.

KR

1
задан 16 March 2017 в 12:58
1 ответ

Скорее всего, контекст файла .ssh и .ssh/authorized_keys ошибочен. Выполните sudo restorecon -R -v /home/zenoss/.ssh и повторите попытку.

.
1
ответ дан 3 December 2019 в 23:32

Теги

Похожие вопросы