Permissions 0644 for '/home/linuxidc/.ssh/id_rsa' are too open 解决
Permissions 0644 for '/home/linuxidc/.ssh/id_rsa' are too open 解决
1、问题：
前几天我在的Linux Mint 主机bkjia.com的Virtualbox 上新安装了一个Fedora27 系统，主机名取名为fefora。
将本地.ssh目录上传到fedora上：
bkjia@bkjia.com ~ $ scp -r .ssh bkjia@fedora:~/
id_rsa.pub 100% 397 0.4KB/s 00:00
known_hosts 100% 6547 6.4KB/s 00:00
id_rsa 100% 1675 1.6KB/s 00:00
bkjia@bkjia.com ~ $登录到主机fedora上，
bkjia@bkjia.com ~ $ ssh bkjia@fedora
Last login: Sat Dec 30 15:45:36 2017 from 192.168.1.4
bkjia@redora ~ $
切换到目录~/~/Public/project/com/gitee下，将clone Spring boot 项目源码:
bkjia@redora ~ $ cd Public/project/com/gitee/
bkjia@redora ~/Public/project/com/gitee $ ll
total 8
drwxrwxr-x. 2 bkjia lwk 4096 Dec 30 16:07 .
drwxrwxr-x. 3 bkjia lwk 4096 Dec 30 15:54 ..
bkjia@redora ~/Public/project/com/gitee $
bkjia@redora ~/Public/project/com/gitee $ git clone git@github.com:spring-projects/spring-boot.git
Cloning into 'spring-boot'...
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/bkjia/.ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "/home/bkjia/.ssh/id_rsa": bad permissions
Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
bkjia@redora ~/Public/project/com/gitee $
2、解决办法
经查资料，发现已经有人找到了问题的解决办法：
仔细阅读了一下ssh文档和这句提示，大概的意思时ssh的私有密钥的权限开放尺度太大了，可以供人随意>欣赏了，ssh自身的策略关闭了ssh。
解决方案：将权限由0644降低为0600
chmod 0600 ~/.ssh/id_rsa
这时回过头来查看~/.ssh目录下相关文件的权限：
bkjia@redora ~/.ssh $ ll
total 28
drwx------. 2 bkjia lwk 4096 Dec 29 18:26 .
drwx------. 10 bkjia lwk 4096 Dec 30 15:21 ..
-rw-------. 1 bkjia lwk 397 Dec 29 16:15 authorized_keys
-rw-r--r--. 1 bkjia lwk 1675 Dec 30 16:08 id_rsa
-rw-r--r--. 1 bkjia lwk 397 Dec 30 16:08 id_rsa.pub
-rw-r--r--. 1 bkjia lwk 6547 Dec 30 16:08 known_hosts
bkjia@redora ~/.ssh $
果然如此，现根据上面的提示将id_rsa、id_rsa.pub、known_hosts的权限修改为只有自己可以读写。
bkjia@redora ~/.ssh $ chmod go+r id_rsa*
bkjia@redora ~/.ssh $ chmod go+r known_hosts
bkjia@redora ~/.ssh $ ll
total 28
drwx------. 2 bkjia lwk 4096 Dec 29 18:26 .
drwx------. 10 bkjia lwk 4096 Dec 30 15:21 ..
-rw-------. 1 bkjia lwk 397 Dec 29 16:15 authorized_keys
-rw-------. 1 bkjia lwk 1675 Dec 30 16:08 id_rsa
-rw-------. 1 bkjia lwk 397 Dec 30 16:08 id_rsa.pub
-rw-------. 1 bkjia lwk 6547 Dec 30 16:08 known_hosts
切换目录到~/Public/project/com/gitee，继续clone
bkjia@redora ~ $ cd Public/project/com/gitee/
bkjia@redora ~/Public/project/com/gitee $ git clone git@github.com:spring-projects/spring-boot.git
Cloning into 'spring-boot'...
remote: Counting objects: 318361, done.
remote: Compressing objects: 100% (323/323), done.至此问题解决。
3、总结
出现这种情况主要还是由于初学者不熟悉Linux操作命令而导致的，如果能熟练使用ssh-copy-id就不会出现这样的问题，具体命令如下：
bkjia@bkjia.com ~ $ ssh-copy-id -i ~/.ssh/id_rsa.pub bkjia@fedora
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/bkjia/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
bkjia@Ubuntu's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'bkjia@fedora'"
and check to make sure that only the key(s) you wanted were added.
bkjia@bkjia.com ~ $
评论暂时关闭