Azure安全策略更新？揭秘SSH（密钥方式）连接失败的背后真相

平时都是用termius+私钥的方式ssh到azure的vm上进行操作维护，今天突然直接无法连接了，报错如下：

👤 Starting a new connection to: "20.228.249.246" port "22"

⚙️ Starting address resolution of "20.228.249.246"

⚙️ Address resolution finished

⚙️ Connecting to "20.228.249.246" port "22"

👤 Connection to "20.228.249.246" established

⚙️ Starting SSH session

⚙️ Remote server: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6

⚙️ Agreed KEX algorithm: ecdh-sha2-nistp256

⚙️ Agreed Host Key algorithm: ecdsa-sha2-nistp256

⚙️ Agreed server-to-client cipher: aes128-ctr MAC: hmac-sha2-256

⚙️ Agreed client-to-server cipher: aes128-ctr MAC: hmac-sha2-256

⚙️ Agreed client-to-server compression: none

⚙️ Agreed server-to-client compression: none

⚙️ Handshake finished

👤 Checking host key: 08:1b:c2:53:fb:08:7c:4e:1c:3f:c4:c1:a8:1a:23:00

👤 Host "20.228.249.246":"22" is known and matches

👤 Authenticating to "20.228.249.246":"22" as "dingdingtest"

⚙️ Available client authentication methods: publickey,password,keyboard-interactive

⚙️ Authentication that can continue: publickey

👤 Authenticating using publickey method

❗ Authentication failed (publickey)

⚙️ Partial success: no

⚙️ Authentication that can continue: publickey

😨 No more authentication methods to try

以为是密钥有问题了，到auzre上重新生成私钥下载下来再导入termius，还是报一样的错误，

通过auzre的shell连接到vm，sudo systemctl restart sshd，重启服务也不行，

sudo systemctl status sshd 看到ssh正常运行，但是有报错如下：

Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)

Active: active (running) since Sun 2024-04-21 19:27:10 CST; 6min ago

Docs: man:sshd(8)

man:sshd_config(5)

Process: 974948 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)

Main PID: 974950 (sshd)

Tasks: 1 (limit: 4623)

Memory: 1.7M

CPU: 89ms

CGroup: /system.slice/ssh.service

└─974950 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

Apr 21 19:27:10 dingdingtest sshd[974950]: Server listening on :: port 22.

Apr 21 19:27:10 dingdingtest systemd[1]: Started OpenBSD Secure Shell server.

Apr 21 19:27:48 dingdingtest sshd[974960]: Authentication refused: bad ownership or modes for directory /home/dingdingtest

权限有问题？这是什么妖魔鬼怪？用最新的Llama3查了一下，这家伙一会中文一会英文的，看来是标准的真洋鬼子，不过问题还是查到了，

SSH对用户主目录的权限有严格的要求，特别是当使用公钥认证时。如果用户主目录对其他用户开放了写权限，那么其他用户可能能够更改SSH配置或密钥，这会导致安全问题。因此，SSH会拒绝在主目录权限设置不正确的情况下进行公钥认证。

也就是需要把目录权限调整到只能ssh的账号自己访问，chmod go-w /home/dingdingtest 执行之后就好了，但是吊诡的是，这个目录权限确实调整过，但这是几个月前的事了，这几个月用的都好好的，怎么今天就突然出问题了？

也可能是微软又偷偷更新安全策略了？