Ubuntu SSH 强制密钥登录：配置不生效的排查与修复

Ubuntu SSH 强制密钥登录配置不生效的排查与修复症状修改PasswordAuthentication yes并重启sshd客户端仍报Permission denied (publickey)。根因sshd 运行时配置由多个文件合并决定云镜像默认配置往往被/etc/ssh/sshd_config.d/50-cloud-init.conf中的PasswordAuthentication no覆盖或存在AuthenticationMethods限制。排查步骤1. 查看 sshd 运行时生效值sudosshd-T|grep-Epasswordauthentication|authenticationmethods|kbdinteractiveauthentication要求passwordauthentication yesauthenticationmethods输出为空无任何限制kbdinteractiveauthentication yes任何一项不符继续。2. 定位冲突配置文件sudogrep-rnPasswordAuthentication\|AuthenticationMethods/etc/ssh/sshd_config /etc/ssh/sshd_config.d/常见冲突源/etc/ssh/sshd_config.d/50-cloud-init.conf内含PasswordAuthentication no。3. 创建高优先级覆盖配置sudotee/etc/ssh/sshd_config.d/99-password-auth.confEOF PasswordAuthentication yes KbdInteractiveAuthentication yes EOF若步骤 1 中发现authenticationmethods非空追加一行以清空限制echoAuthenticationMethods password|sudotee-a/etc/ssh/sshd_config.d/99-password-auth.conf4. 语法检查并重启服务sudosshd-tsudosystemctl restartssh5. 确认用户密码可用sudopasswd-Susername状态必须为P密码已设置。若为L锁定执行sudo passwd -u username若为NP无密码执行sudo passwd username。6. 验证客户端支持的认证方式ssh-oPreferredAuthenticationspassword-vuserhost输出中应出现Authentications that can continue: password。常见错误与处理AuthenticationMethods publickey强制密钥→ 在步骤 3 覆盖为AuthenticationMethods password或直接注释原文件行。KbdInteractiveAuthentication no导致 PAM 密码认证失效→ 步骤 3 已覆盖。用户密码未设置或锁定→ 步骤 5 解决。sshd -T仍显示passwordauthentication no→ 检查/etc/ssh/sshd_config.d/下文件名的排序确保99-文件最晚加载。可用sudo sshd -T | grep -B1 passwordauthentication观察来源文件需 root 权限查看。恢复密钥认证运维后必做sudorm/etc/ssh/sshd_config.d/99-password-auth.confsudosystemctl restartssh