前因
自以為已經非常熟練的使用ssh密鑰對登陸服務器的我球凰，居然也翻車了……
昨天在服務器上開了一個新的用戶，卻發(fā)現無論怎么樣也沒辦法登陸神僵！
后果
今天早上又想起了這個人生污點雁刷，查了一下，確定原來是文件權限的問題保礼，必須要給定如下的權限才可以沛励。
之所以忘記了這個設定，是的炮障，我回憶起了一開始用的時候的確是要配置文件權限的目派。是因為最近用的大多數我都用的默認權限，沒有出問題胁赢，如下圖企蹭。
可能版本不同？
調查
這個時候, 如果你想準確且快速的得到答案, 那么就去翻閱以下Linux的ssh手冊[1]:
總結
我在外網, 找到了一個人做的對于常用配置文件的總結性表格[2]:
+------------------------+-------------------------------------+-------------+-------------+
| Directory or File | Man Page | Recommended | Mandatory |
| | | Permissions | Permissions |
+------------------------+-------------------------------------+-------------+-------------+
| ~/.ssh/ | There is no general requirement to | 700 | |
| | keep the entire contents of this | | |
| | directory secret, but the | | |
| | recommended permissions are | | |
| | read/write/execute for the user, | | |
| | and not accessible by others. | | |
+------------------------+-------------------------------------+-------------+-------------+
| ~/.ssh/authorized_keys | This file is not highly sensitive, | 600 | |
| | but the recommended permissions are | | |
| | read/write for the user, and not | | |
| | accessible by others | | |
+------------------------+-------------------------------------+-------------+-------------+
| ~/.ssh/config | Because of the potential for abuse, | | 600 |
| | this file must have strict | | |
| | permissions: read/write for the | | |
| | user, and not accessible by others. | | |
| | It may be group-writable provided | | |
| | that the group in question contains | | |
| | only the user. | | |
+------------------------+-------------------------------------+-------------+-------------+
| ~/.ssh/identity | These files contain sensitive data | | 600 |
| ~/.ssh/id_dsa | and should be readable by the user | | |
| ~/.ssh/id_rsa | but not accessible by others | | |
| | (read/write/execute) | | |
+------------------------+-------------------------------------+-------------+-------------+
| ~/.ssh/identity.pub | Contains the public key for | 644 | |
| ~/.ssh/id_dsa.pub | authentication. These files are | | |
| ~/.ssh/id_rsa.pub | not sensitive and can (but need | | |
| | not) be readable by anyone. | | |
+------------------------+-------------------------------------+-------------+-------------+
參考
- ^OpenBSD manual page - ssh(1) https://man.openbsd.org/ssh
- ^Permissions on private key in .ssh folder? https://superuser.com/questions/215504/permissions-on-private-key-in-ssh-folder
