Gitlab返回digitalocean服务器的Permission denied (publickey,passwor

Question

我正在尝试在DigitalOcean水滴上实现我的dockerized Django应用程序的CD。

我的.gitlab-ci.yml:

image:
name: docker/compose:1.29.1
entrypoint: [""]
services:
- docker:dind
stages:
- build
- deploy
variables:
DOCKER_HOST: tcp://docker:2375
DOCKER_DRIVER: overlay2
before_script:
- export IMAGE=$CI_REGISTRY/$CI_PROJECT_NAMESPACE/$CI_PROJECT_NAME
- export WEB_IMAGE=$IMAGE/web:web
- export NGINX_IMAGE=$IMAGE/nginx:nginx
- apk add --no-cache openssh-client bash
- chmod +x ./setup_env.sh
- bash ./setup_env.sh
- docker login -u $CI_REGISTRY_USER -p $CI_JOB_TOKEN $CI_REGISTRY
build:
stage: build
script:
- docker pull $IMAGE/web:web || true
- docker pull $IMAGE/web:nginx || true
- docker-compose -f docker-compose.prod.yml build
- docker push $IMAGE/web:web
- docker push $IMAGE/nginx:nginx
deploy:
stage: deploy
script:
- mkdir -p ~/.ssh
- echo "$PRIVATE_KEY" | tr -d 'r' > ~/.ssh/id_rsa
- cat ~/.ssh/id_rsa
- chmod 700 ~/.ssh/id_rsa
- eval "$(ssh-agent -s)"
- ssh-add ~/.ssh/id_rsa
- ssh-keyscan -H 'gitlab.com' >> ~/.ssh/known_hosts
- chmod +x ./deploy.sh
- scp  -o StrictHostKeyChecking=no -r ./.env ./docker-compose.prod.yml root@$DO_PUBLIC_IP_ADDRESS:/Pythonist.org
- bash ./deploy.sh
only:
- master

我已经将我的公钥复制到生产服务器(DO滴)。构建作业成功，但部署阶段失败，出现以下错误:

$ chmod 700 ~/.ssh/id_rsa
$ eval "$(ssh-agent -s)"
Agent pid 26
$ ssh-add ~/.ssh/id_rsa
Identity added: /root/.ssh/id_rsa ([e-mail])
$ ssh-keyscan -H 'gitlab.com' >> ~/.ssh/known_hosts
$ chmod +x ./deploy.sh
$ scp  -o StrictHostKeyChecking=no -r ./.env ./docker-compose.prod.yml root@$DO_PUBLIC_IP_ADDRESS:/Pythonist.org
Warning: Permanently added '143.198.103.99' (ECDSA) to the list of known hosts.
Permission denied, please try again.
Permission denied, please try again.
root@143.198.103.99: Permission denied (publickey,password).
lost connection
Cleaning up project directory and file based variables
00:01
ERROR: Job failed: exit code 1

Answer 1

官方流程是"如何上传SSH公钥到现有水滴"，但它通常涉及username，而不是root。

虽然您的管道可能以root身份执行(如Identity added: /root/.ssh/id_rsa消息所建议的)，但您的scp应该使用DO远程用户，而不是远程DOroot帐户):您将公钥添加到远程~/.ssh/authorized_keys的相同帐户用户名

:

username@$DO_PUBLIC_IP_ADDRESS:/Pythonist.org
# not
root@$DO_PUBLIC_IP_ADDRESS:/Pythonist.org

Answer 2

在数字海洋服务器上尝试以下操作:

cat ~/.ssh/id_rsa.pub

并将公钥复制到授权密钥

nano ~/.ssh/authorized_keys

then change permission

chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_rsa