FIPS対応クラスタでSSH公開鍵認証が失敗する

最後の更新
PDFとして保存

Views:: 266

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: CORE

Last Updated:

環境

FIPS（連邦情報処理標準）が有効なONTAP 9
SSH公開鍵認証

問題

FIPSが有効なクラスタでSSH公開鍵認証が失敗します。

root@linuxhost:/root/.ssh# ssh -vvv admin@cluster01

OpenSSH_8.0p1, OpenSSL 1.1.1k FIPS 25 Mar 2021

debug1: Reading configuration data /root/.ssh/config

debug1: /root/.ssh/config line 1: Applying options for *

debug3: kex names ok: [diffie-hellman-group1-sha1]

debug1: /root/.ssh/config line 8: Applying options for cluster01

debug1: Reading configuration data /usr/local/etc/ssh_config

debug3: kex names ok: [diffie-hellman-group1-sha1]

debug2: resolving "cluster01" port 22

debug2: ssh_connect_direct

debug1: Connecting to cluster01 [xxx.xxx.xx.x] port 22.

debug1: Connection established.

...

debug2: KEX algorithms: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

debug2: host key algorithms: ecdsa-sha2-nistp256

debug2: ciphers ctos: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc

debug2: ciphers stoc: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc

...

debug1: Will attempt key: /root/.ssh/cluster01 RSA SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX explicit

debug2: pubkey_prepare: done

debug3: send packet: type 5

debug3: receive packet: type 7

debug1: SSH2_MSG_EXT_INFO received

debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>

debug3: receive packet: type 6

debug2: service_accept: ssh-userauth

debug1: SSH2_MSG_SERVICE_ACCEPT received

debug3: send packet: type 50

debug3: receive packet: type 53

debug3: input_userauth_banner

Access restricted to authorized users

debug3: receive packet: type 51

debug1: Authentications that can continue: publickey,password,keyboard-interactive

debug3: start over, passed a different list publickey,password,keyboard-interactive

debug3: preferred publickey,keyboard-interactive,password

debug3: authmethod_lookup publickey

debug3: remaining preferred: keyboard-interactive,password

debug3: authmethod_is_enabled publickey

debug1: Next authentication method: publickey

debug1: Offering public key: /root/.ssh/cluster01 RSA SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX explicit

debug3: send packet: type 50

debug2: we sent a publickey packet, wait for reply

debug3: receive packet: type 51

debug1: Authentications that can continue: publickey,password,keyboard-interactive

debug2: we did not send a packet, disable method

debug3: authmethod_lookup keyboard-interactive

debug3: remaining preferred: password

debug3: authmethod_is_enabled keyboard-interactive

debug1: Next authentication method: keyboard-interactive

debug2: userauth_kbdint

debug3: send packet: type 50

debug2: we sent a keyboard-interactive packet, wait for reply

debug3: receive packet: type 60

debug2: input_userauth_info_req

debug2: input_userauth_info_req: num_prompts 1