GitLab私有服务器SSH连接报错：Permission denied (publickey)

问题背景 #

• 已部署GitLab 15.1服务器，可通过RSA密钥对、22002端口SSH连接服务器进行管理，一切正常。
• 生成ed25519密钥对并将公钥添加到GitLab网页端后，执行ssh -T myuser@gitlab.mydomain.com返回：

Permission denied (publickey)

调试日志 #

执行ssh -Tvvv myuser@gitlab.mydomain.com得到以下日志：

OpenSSH_9.0p1 Debian-1+b1, OpenSSL 3.0.4 21 Jun 2022
debug1: Reading configuration data /home/tasseb/.ssh/config
debug1: /home/tasseb/.ssh/config line 19: Applying options for gitlab-kb
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to gitlab.mydomain.com [160.53.247.6] port 22002.
debug1: Connection established.
debug1: identity file /home/tasseb/.ssh/id_ed25519-gitlab type 3
debug1: identity file /home/tasseb/.ssh/id_ed25519-gitlab-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.0p1 Debian-1+b1
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.4p1 Debian-5+deb11u1
debug1: compat_banner: match: OpenSSH_8.4p1 Debian-5+deb11u1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to gitlab.mydomain.com:22002 as 'sbe'
debug1: load_hostkeys: fopen /home/tasseb/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:ofs8tNkzOxuU5AwC2VYbFGPXfERPKXGOFrTatb8hV78
tlab.mydomain.com]:22002
debug1: load_hostkeys: fopen /home/tasseb/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '[gitlab.mydomain.com]:22002' is known and matches the ED25519 host key.
debug1: Found key in /home/tasseb/.ssh/known_hosts:4
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: ssh_fetch_identitylist: agent contains no identities
debug1: Will attempt key: /home/tasseb/.ssh/id_ed25519-gitlab ED25519 SHA256:7BtjWt7Ysd40SJ1xX1sBlZb7PJqUW5K2NhxDBvtIgfY explicit 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/tasseb/.ssh/id_ed25519-gitlab ED25519 SHA256:7BtjWt7Ysd40SJ1xX1sBlZb7PJqUW5K2NhxDBvtIgfY explicit
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
sbe@gitlab.mydomain.com: Permission denied (publickey).

排查与解决步骤 #

日志显示客户端已正确提交ed25519密钥，但服务器未接受，按以下步骤逐一排查：

• 核对公钥完整性
  本地公钥文件/home/tasseb/.ssh/id_ed25519-gitlab.pub的内容，必须和GitLab网页端添加的公钥完全一致，包括开头的ssh-ed25519标识、中间的密钥字符串、末尾的注释（邮箱或自定义标识），不能有多余空格、换行或截断。

• 确认GitLab用户匹配
  日志显示认证用户为sbe，需确保GitLab网页端添加公钥的账户就是sbe，而非其他用户。

• 修复密钥文件权限
  SSH对密钥文件权限要求严格，执行以下命令设置正确权限：

  chmod 600 /home/tasseb/.ssh/id_ed25519-gitlab
  chmod 644 /home/tasseb/.ssh/id_ed25519-gitlab.pub
  chmod 700 /home/tasseb/.ssh
  

• 验证SSH配置正确性
  检查/home/tasseb/.ssh/config中gitlab-kb的配置项，确保用户、端口、密钥文件路径均正确：

  Host gitlab-kb
    HostName gitlab.mydomain.com
    Port 22002
    User sbe
    IdentityFile ~/.ssh/id_ed25519-gitlab
  

  测试时直接使用配置的Host别名：ssh -T gitlab-kb，避免手动输入错误。

• 查看服务器端认证日志
  登录GitLab服务器，查看/var/log/auth.log（Debian/Ubuntu）或/var/log/secure（RHEL/CentOS），搜索sbe或SSH认证相关条目，获取服务器端拒绝认证的具体原因。

• 临时关闭SELinux测试（若适用）
  若服务器开启SELinux，可能阻断SSH密钥认证，临时关闭测试：

  setenforce 0
  

  测试正常后，再配置SELinux规则或永久关闭。

内容的提问来源于stack exchange，提问作者tasseb