无法使用 gitbash SSH 进入 aws ec2 实例：权限被拒绝答案

【问题标题】：unable to SSH into aws ec2 instance with gitbash: permission denied无法使用 gitbash SSH 进入 aws ec2 实例：权限被拒绝
【发布时间】：2022-01-13 01:49:17
【问题描述】：

我在尝试 ssh 到我的 aws ec2 实例时遇到权限被拒绝错误 - centos 使用 Windows gitbash 使用有效的私钥 (.pem) 文件。调试日志如下。

OpenSSH_8.1p1, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to ec2-#####.ap-south-1.compute.amazonaws.com [####] port 22.
debug1: Connection established.
debug1: identity file mbrace.pem type -1
debug1: identity file mbrace.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com:22 as 'centos'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5Qu3MuE9zz27Ywx1d+dQyZwaC8KN/khaRLIRSUVLZ6s
debug1: Host 'ec2-13-126-107-143.ap-south-1.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /c/Users/####/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: mbrace.pem  explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: publickey
debug1: Trying private key: mbrace.pem
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
centos@ec2-######.ap-south-1.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

另一个参考文件 knownhosts 文件内容如下 .ssh/config/known_hosts

ec2-13-126-107-143.ap-south-1.compute.amazonaws.com,13.126.107.143 ecdsa-sha2-nistp256 
AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz..........

更新

根据 VONC 的建议，使用 ssh-key gen 工具创建了一个新的密钥对，该工具生成了一个 .pub 文件，随后成功地将密钥导入了 aws ec2。再次尝试该命令时，权限被拒绝是相同的结果，尽管日志有所变化。以下是日志：

$ ssh -i "C:/Users/mbrace/.ssh/mbrace2.pem" centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com -v
    OpenSSH_8.1p1, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com [13.126.107.143] port 22.
debug1: Connection established.
debug1: identity file C:/Users/mbrace/.ssh/mbrace2.pem type -1
debug1: identity file C:/Users/mbrace/.ssh/mbrace2.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com:22 as 'centos'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5Qu3MuE9zz27Ywx1d+dQyZwaC8KN/khaRLIRSUVLZ6s
debug1: Host 'ec2-13-126-107-143.ap-south-1.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /c/Users/mbrace/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: C:/Users/mbrace/.ssh/mbrace2.pem  explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: publickey
debug1: Trying private key: C:/Users/mbrace/.ssh/mbrace2.pem
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

尝试了论坛中提供的所有方法，包括更改 .ssh 文件夹和 .pem 文件的权限，但没有用。请指导我们哪里出错了。

更新 2

正如您所提到的，重新创建了没有任何扩展名“mbrace2”的密钥，并在“密钥对”下成功地将 .pub 密钥导入 ec2。现在，当我们再次尝试 ssh 进入服务器时，我们遇到了同样的错误（权限被拒绝）。根据其他答案，我也尝试将密钥的权限更改为 400,500,600 但状态没有变化。

另外，当我们在最后添加这段代码 ^^^ (.no pub) 时，它给了我这个错误：

bash: syntax error near unexpected token `('. So had to run the earlier said command without it.

请指导我们哪里出错。

更新 3 如您所问，这是命令及其相应的输出。

命令

$ ssh -i "C:/Users/mbrace/.ssh/mbrace2" centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com -Tv

输出

OpenSSH_8.1p1, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com [13.126.107.143] port 22.
debug1: Connection established.
debug1: identity file C:/Users/mbrace/.ssh/mbrace2 type 0
debug1: identity file C:/Users/mbrace/.ssh/mbrace2-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com:22 as 'centos'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5Qu3MuE9zz27Ywx1d+dQyZwaC8KN/khaRLIRSUVLZ6s
debug1: Host 'ec2-13-126-107-143.ap-south-1.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /c/Users/mbrace/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: C:/Users/mbrace/.ssh/mbrace2 RSA SHA256:+47/xVuTP15NDpN+2OZbSOIfQ9umTAi6P+i8vufO6q8 explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: publickey
debug1: Offering public key: C:/Users/mbrace/.ssh/mbrace2 RSA SHA256:+47/xVuTP15NDpN+2OZbSOIfQ9umTAi6P+i8vufO6q8 explicit
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

【问题讨论】：

标签： amazon-ec2 ssh git-bash private-key openssh

【解决方案1】：

将尝试密钥：mbrace.pem 显式

这意味着您有一个/c/Users/####/.ssh/config 文件，它在IndentityFile 中明确引用了mbrace.pem 文件。
您需要确保遵循“EC2: Connect to your Linux instance using SSH”（模拟ssh -i /path/my-key-pair.pem my-instance-user-name@my-instance-public-dns-name）：

远程用户（SSH 配置文件中的 User 字段）是正确的 (my-instance-user-name)
密钥（IdentityFile 中的私有 mbrace.pem）通过其完整路径引用（~/.ssh/mbrace.pem 有效，即使在 Windows 上也是如此）
匹配的公钥在.ssh/authorized_keys file on the instance 中可见。
inbound SSH traffic from your IP address to your instance is enabled

要测试一个新的密钥，你需要使用它的私钥：

ssh -i "C:/Users/mbrace/.ssh/mbrace2" my-instance-user-name@my-instance-public-dns-name -v
                                 ^^^ (no .pub)

【讨论】：

所有先决条件都匹配。我已经使用 putty 很长时间了，使用相同的凭据和 .pem 文件没有任何问题。关于这个身份文件/c/Users/####/.ssh/config，我携带了knownhosts文件（问题中给出的内容），它实际上并不携带mbrace.pem文件的路径。告诉我们如何插入。
@Ahamed 在您的 Windows 会话中是否有与 SSH 相关的环境变量？
@Ahamed 此外，最近的 Windows 发行版不需要 putty。尝试使用ssh-keygen -t rsa -m PEM -P "" -f ~/.ssh/mbrace2 重新生成密钥，并将 mbrace2.pub 导出到 EC2 (docs.aws.amazon.com/AWSEC2/latest/UserGuide/…)
不，windows 中没有 SSH 环境变量。关于重新生成 .pem 密钥并导出到 ec2，它不会干扰我用来使用 putty SSH 进入服务器的现有 .pem 文件。
已编辑问题，请检查。