求助： ssh 远程无法登陆提示： Permission denied, please try again

[qping]

使用密钥登陆是可以的，但是在别的机器上使用密码登陆就不行了。服务器系统版本是 Centos 7.8.2003.

尝试过以下的步骤：

1. 当 ssh 上服务器后，su - root 输入密码是可以的，排除密码错误的问题
2. /etc/ssh/sshd_config 里面的 # PermitRootLogin yes 的 # 去掉并重启 systemctl restart sshd，还是不行
3. /etc/ssh/sshd_config 里面的 PasswordAuthentication 值原来就是 yes
4. setenforce 0 也不行
5. 尝试查看安全日志 ：/var/log/secure 发现不管是登陆成功还是失败，在里面都没有生成新的日志
6. 查看 /etc/hosts.allow 和 /etc/hosts.deny 里面都没有配置东西
7. 查看登陆日志：执行 last 命令发现有个 roo 用户(我没有打错，就是少一个 t)，是不是有可能被攻击了？

root     pts/1        170.3.69.2       Fri Jun  4 15:49   still logged in
root     pts/1        170.3.69.2       Fri Jun  4 15:47 - 15:49  (00:01)
root     pts/1        170.3.69.2       Fri Jun  4 15:46 - 15:47  (00:00)

...省略一些差不多的 ...

roo      pts/0        :0               Wed Mar 24 12:23 - 12:24  (00:01)
roo      pts/0        :0               Wed Mar 24 12:16 - 12:23  (00:07)
roo      :0           :0               Wed Mar 24 12:10 - down   (00:14)
reboot   system boot  3.10.0-1127.el7. Wed Mar 24 12:00 - 12:24  (00:24)

既然使用密钥可以登陆的话，那网络问题应该排除了。实在没有办法了，有没有大佬能帮忙鉴定下问题出现在哪里？

这个是使用密钥成功能登陆的日志（ ssh -v -p 22 <ip 地址>）：

OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /root/.ssh/config
debug1: /root/.ssh/config line 40: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: auto-mux: Trying existing master
debug1: mux_client_request_session: master session id: 2
Last login: Fri Jun  4 15:59:42 2021

这个是在别的电脑上使用密码登陆失败的日志（ ssh -v -p 22 <ip 地址>）：

OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /root/.ssh/config
debug1: /root/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: auto-mux: Trying existing master
debug1: Control socket "/root/.ssh/<这里是 ip>-22-root" does not exist
debug1: Connecting to <这里是 ip> [<这里是 ip>] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/<这里是 key 名称>.key type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/<这里是 key 名称>.key-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Authenticating to <这里是 ip>:22 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: [email protected] need=64 dh_need=64
debug1: kex: [email protected] need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:sQeFN1/GfQqAohAXEyndzeCStwG4wEcawUl3vZhwniw
debug1: Host '<这里是 ip>' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:23
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: KEYRING:persistent:0)

debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: KEYRING:persistent:0)

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/<这里是 key 名称>.key
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: password
root@<这里是 ip>'s password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
Permission denied, please try again.
root@<这里是 ip>'s password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
Permission denied, please try again.
root@<这里是 ip>'s password:
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)

今天一早试了下，已经好了。

问了客户，应该是 ssh 的那个 ip 映射了两个服务器导致的。

服了。

[napsterwu]

1. 用 ssh -vvv
2. 没太看懂你的步骤，是所有机器都可以用证书登陆成功，还是只有部分机器才能用证书登陆成功？
3. 是部分机器用密码可以登陆成功，还是所有机器都无法用密码登陆成功？

[dier]

1 、看一下尝试用密码登录的那台机器上是不是有正确密钥；
2 、看一下被登录的机器里~/.ssh/known_hosts 文件里是不是有尝试用密码登录的这个机器的信息，删除试一下

[toaruScar]

你开了连接复用 auto-mux，“使用密钥成功能登陆”的那次不是因为用了密钥登陆，而是因为已经有一个 session 了而已

[qping]

@napsterwu #1
@dier #2
@toaruScar #3

[qping]

感谢，已经好了

[dier]

@qping 是怎么解决的？建议分享一下解决思路，如果以后有人遇到类似的问题找到这个帖子也许会有帮助

[qping]

@dier #6 已经 append 了，我这边 ssh 的服务器，中间可能有几层网关、防火墙。 上周出问题的 ip 映射了两台服务器。