家里一台2011年的老机器（Acer x3960，i5-2300, 8G RAM, 120G SSD）放了很久没有用，现在突然有需求在墙外部署一台机器给国内的小伙伴用。这机器老归老，比t2.micro还是强得多。收拾一下，装个ubuntu准备接客，发挥余热。
因为放在家里，用电视当显示器，想着哪天没事自己还会在本地用一下，再加上那么多年和CDNS、SNPS厮混的X window情节，就装了个桌面版ubuntu。
安装没有问题，配置上线也没有问题，装上ZeroTier，加入私网，不用在费心去做uPnP的路由器端口映射打洞。
上线后需要解决几个问题：
- 开通ssh服务，加入ssh key。略过
- 修改suder
sudu visudo
加入下面这一行
ubuntu ALL=(ALL) NOPASSWD: ALL
参考 https://askubuntu.com/questions/147241/execute-sudo-without-password - 奇怪的密码登录
做完上面两步，远程可以正常ssh免密码登录，第一次用ansible playbook配置环境也全部成功。
但是，日常使用却时不时提示输入密码，很奇怪。有时要求输入，有时直接进去。自己用也就算了，小伙伴们用起来很难受，而且还有ansible呢。
开始debug：
ssh 登录时使用-v 选项，打印log，(敏感信息略过)
$ ssh -v [email protected]
OpenSSH_7.4p1, LibreSSL 2.5.0
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 53: Applying options for *
debug1: Connecting to 10.10.10.10 [10.10.10.10] port 22.
debug1: Connection established.
debug1: identity file /Users/perebor/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.10.10.10:22 as 'ubuntu'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: compression: none
debug1: kex: client->server cipher: [email protected] MAC: compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
debug1: Host '10.10.10.10' is known and matches the ECDSA host key.
debug1: Found key in /Users/perebor/.ssh/known_hosts:66
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/perebor/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/perebor/.ssh/id_dsa
debug1: Trying private key: /Users/perebor/.ssh/id_ecdsa
debug1: Trying private key: /Users/perebor/.ssh/id_ed25519
debug1: Next authentication method: password
[email protected]'s password:
发现问题是本地ssh client会使用不同的key尝试登录，但是三次以后服务器就返回提示输入密码。
因为服务器上sshd里面有密码登录这个选项。那我们关上他就好了。
到/etc/ssh/sshd_config 里面，把PasswordAuthentication改成no，
# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no
然后重启ssh服务
sudo service ssh restart
再次登录，直接进入。
$ ssh -v [email protected]
OpenSSH_7.4p1, LibreSSL 2.5.0
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 53: Applying options for *
debug1: Connecting to 10.10.10.10 [10.10.10.10] port 22.
debug1: Connection established.
debug1: identity file /Users/perebor/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/perebor/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.10.10.10:22 as 'ubuntu'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: compression: none
debug1: kex: client->server cipher: [email protected] MAC: compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
debug1: Host '10.10.10.10' is known and matches the ECDSA host key.
debug1: Found key in /Users/perebor/.ssh/known_hosts:66
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/perebor/.ssh/id_rsa
debug1: Server accepts key: pkalg rsa-sha2-512 blen 535
debug1: Authentication succeeded (publickey).
Authenticated to 10.10.10.10 ([10.10.10.10]:22).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype [email protected] want_reply 0
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.10.0-33-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
0 packages can be updated.
0 updates are security updates.