1.  操作系统版本

1)操作系统

cat /etc/issue

cat /etc/issue

CentOS release 6.6 (Final)

Kernel \r on an \m

cat /proc/version

cat /proc/version

Linux version 2.6.32-504.el6.x86_64 (mockbuild@c6b9.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-11) (GCC) ) #1 SMP Wed Oct 15 04:27:16 UTC 2014

2. 问题描述

1) 配置互信

172.172.230.210 下执行(root用户)

ssh-keygen -t rsa

ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.172.230.211

172.172.230.211 下执行(root用户)

ssh-keygen -t rsa

ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.172.230.210

2) 验证互信是否生效

在172.172.230.210上执行

ssh 172.172.230.211 hostname >>执行成功无需提供密码

在172.172.230.211 上执行

ssh 172.172.230.210 hostname

root@172.172.230.210's password:##但是在172.172.230.211上执行ssh连接172.172.230.210 时提示需要密码，互信没有生效。

3. 问题分析

3.1 可能会导致互信产生问题的原因有如下三个

1) 目录权限，文件权限

##以root用户为例，root目录，.ssh目录 权限不能为77*，authorized_keys文件权限应该为600

2) seliux

vi /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX=disabled

# enforcing - SELinux security policy is enforced.

# permissive - SELinux prints warnings instead of enforcing.

# disabled - No SELinux policy is loaded.

SELINUX=disabled

# SELINUXTYPE= can take one of these two values:

# targeted - Targeted processes are protected,

# mls - Multi Level Security protection.

SELINUXTYPE=targeted##selinux 设置为disabled

3) iptables

service iptables status

iptables: Firewall is not running.##iptables服务没有起，所以不是这个原因

3.2 查看172.172.230.210 的/var/log/secure日志

通过上面的分析我们大致可以判断应该是目录权限导致互信不生效了，接一下来我们查看一下/var/log/secure日志中有什么信息：

May 17 17:17:15 shaofei-test-mysql-01 sshd[24719]: Failed password for root from 172.172.230.211 port 17890 ssh2

May 17 17:17:17 shaofei-test-mysql-01 sshd[24719]: Failed password for root from 172.172.230.211 port 17890 ssh2

May 17 17:17:17 shaofei-test-mysql-01 sshd[24721]: Connection closed by 172.172.230.211

May 17 18:08:26 shaofei-test-mysql-01 sshd[25004]: Authentication refused: bad ownership or modes for directory /root

May 17 18:08:26 shaofei-test-mysql-01 sshd[25004]: Authentication refused: bad ownership or modes for directory /root

##日志中很清楚的反应了因为/root目录权限的问题，导致互信失败。后来发现172.172.230.210 上的/root 目录的权限为777，修改为700或者750问题解决

4. 解决方案

修改/root目录权限为 700 或者750，或者755