“key_load_public：没有这样的文件或目录”是什么意思？

Question

我一直在解决一个PubkeyAuthentication问题。当我使用详细模式时，我看到很多"key_load_public: no such file or directory"。

显然，这些键存在于文件系统上，因此该消息似乎没有通常的含义：

$ ls -al ~/.ssh/id_*
-rw-------  1 jwalton  staff   751 Feb  4  2013 id_dsa
-rw-------  1 jwalton  staff   608 Feb 18  2015 id_dsa.pub
-rw-------  1 jwalton  staff   314 Feb  4  2013 id_ecdsa
-rw-------  1 jwalton  staff   180 Feb 18  2015 id_ecdsa.pub
-rw-------  1 jwalton  staff   464 Aug 23 18:15 id_ed25519
-rw-------  1 jwalton  staff   103 Aug 23 18:15 id_ed25519.pub
-rw-------  1 jwalton  staff  2546 Feb  4  2013 id_rsa
-rw-------  1 jwalton  staff   572 Feb 18  2015 id_rsa.pub

，究竟是什么，做“key_load_public：没有这样的文件或目录”的意思吗？

---

我的.ssh/config文件有：

$ cat ~/.ssh/config
IdentityFile ~/.ssh/id_ed25519
IdentityFile ~/.ssh/id_ecdsa
IdentityFile ~/.ssh/id_dsa
IdentityFile ~/.ssh/id_rsa

添加*.pub扩展名无效。我尝试了有和没有，*.pub因为手册页对于需要指定哪个键是不明确的 - 公共或私有。（公钥是身份所需的全部；需要私钥来证明质询/响应中密钥的所有权）：

IdentityFile
    Specifies a file from which the user's DSA, ECDSA or DSA authen-
    tication identity is read...

---

$ ssh -v -p 1522 jwalton@192.168.1.11
OpenSSH_7.1p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /Users/jwalton/.ssh/config
debug1: Reading configuration data /usr/local/etc/ssh_config
debug1: Connecting to 192.168.1.11 [192.168.1.11] port 1522.
debug1: Connection established.
debug1: identity file /Users/jwalton/.ssh/id_ed25519.pub type 4
debug1: key_load_public: No such file or directory
debug1: identity file /Users/jwalton/.ssh/id_ed25519.pub-cert type -1
debug1: identity file /Users/jwalton/.ssh/id_ecdsa.pub type 3
debug1: key_load_public: No such file or directory
debug1: identity file /Users/jwalton/.ssh/id_ecdsa.pub-cert type -1
debug1: identity file /Users/jwalton/.ssh/id_dsa.pub type 2
debug1: key_load_public: No such file or directory
debug1: identity file /Users/jwalton/.ssh/id_dsa.pub-cert type -1
debug1: identity file /Users/jwalton/.ssh/id_rsa.pub type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/jwalton/.ssh/id_rsa.pub-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.1
...

Answer 1

它的字面意思是它所说的：没有 ssh 想要访问的文件或目录。

然而，它谈论中提到的文件下面，上面没有。您只有常规的公钥，但没有它们的 SSH证书（大概是因为您不需要它们）。但是，OpenSSH 将始终尝试加载.pub-cert每个身份密钥的关联文件。

如果您有兴趣，ssh-keygen(1) 手册讨论了创建 OpenSSH 证书颁发机构和签署证书的内容。（注意：这不使用 X.509，只使用 OpenSSH 自己的证书格式。）

通常，证书仅在您拥有大量用户（和/或服务器）但不想使用 Kerberos 时才有用。