SSH连接GCP

Question

我看到了僵局.我尝试通过SSH连接到创建的VM，但没有结果。已将以下条目添加到terraform

provisioner "remote-exec" {
  inline = [
    "/bin/echo -e \"${element(random_string.password.*.result, count.index)}\n${element(random_string.password.*.result, count.index)}\" | /usr/bin/passwd root"
 ]
connection {
  type            = "ssh"
  user            = "root"
  private_key     = file(var.privat_google_key)
  agent           = false
  timeout         = "5m"
  host            = google_compute_instance.webserver[count.index].network_interface[0].access_config[0].nat_ip
 }
}

...

resource "google_compute_project_metadata_item" "ssh-keys" {
  key   = "ssh-keys"
  value = file(var.pub_google_key)
}

实例中添加了ssh-keys。

当我完成的时候，我得到了

google_compute_instance.webserver[0] (remote-exec): Connecting to remote host via SSH...
google_compute_instance.webserver[0] (remote-exec):   Host: 1.1.1.1
google_compute_instance.webserver[0] (remote-exec):   User: root
google_compute_instance.webserver[0] (remote-exec):   Password: false
google_compute_instance.webserver[0] (remote-exec):   Private key: true
google_compute_instance.webserver[0] (remote-exec):   Certificate: false
google_compute_instance.webserver[0] (remote-exec):   SSH Agent: false
google_compute_instance.webserver[0] (remote-exec):   Checking Host Key: false
google_compute_instance.webserver[0]: Still creating... [5m0s elapsed]


Error: timeout - last error: SSH authentication failed (root@35.247.121.86:22): ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

当我尝试从终端通过ssh连接时，我得到

ssh -i [PATH_TO_PRIVATE_KEY] [USERNAME]@[EXTERNAL_IP_ADDRESS]

root@1.1.1.1: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

我尝试了不同的选项来添加密钥，但我总是被禁止访问主机。会出什么问题呢？

Answer 1

默认情况下，根用户的SSH在GCP上处于禁用状态。您必须使用特定用户进行连接，您仍将拥有root权限。如果您一定要使用不推荐的根帐户进行连接，我建议您使用预先构建的镜像或启动脚本，您可以按照here的说明启用它，但我不会在此回答中涵盖。

因此，要在Terraform上实现与特定用户的连接，您需要：

1. 在TF

中更改连接用户配置

connection {
  user            = "alexey"
  ...
}

按照所述的here.格式，将元数据SSH密钥更改为包含用户名和公钥的

ssh-rsa [KEY_VALUE] [USERNAME]