linux – 为什么SSHD挂在“服务器接受密钥”

前端之家收集整理的这篇文章主要介绍了linux – 为什么SSHD挂在“服务器接受密钥”前端之家小编觉得挺不错的,现在分享给大家,也给大家做个参考。
我使用公钥认证一年来一直没有问题.

没有对客户端或服务器的ssh配置进行任何更改.现在,ssh连接永远不会完成或失败,它们只是挂起.以下是尝试连接时的调试输出

  1. OpenSSH_6.0p1 Debian-3ubuntu1,OpenSSL 1.0.1c 10 May 2012
  2. debug1: Reading configuration data /home/jivan/.ssh/config
  3. debug1: Reading configuration data /etc/ssh/ssh_config
  4. debug1: /etc/ssh/ssh_config line 19: Applying options for *
  5. debug1: Connecting to <host> [<ip>] port <port>.
  6. debug1: Connection established.
  7. debug1: identity file .ssh/id_rsa.pub type 1
  8. debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
  9. debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
  10. debug1: identity file .ssh/id_rsa.pub-cert type -1
  11. debug1: Remote protocol version 2.0,remote software version OpenSSH_5.8p1 Debian-7ubuntu1
  12. debug1: match: OpenSSH_5.8p1 Debian-7ubuntu1 pat OpenSSH_5*
  13. debug1: Enabling compatibility mode for protocol 2.0
  14. debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3ubuntu1
  15. debug1: SSH2_MSG_KEXINIT sent
  16. debug1: SSH2_MSG_KEXINIT received
  17. debug1: kex: server->client aes128-ctr hmac-md5 none
  18. debug1: kex: client->server aes128-ctr hmac-md5 none
  19. debug1: sending SSH2_MSG_KEX_ECDH_INIT
  20. debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
  21. debug1: Server host key: ECDSA 81:63:05:0c:39:6b:77:d7:a2:25:93:30:80:f1:ba:0e
  22. debug1: Host '[<host>]:<port>' is known and matches the ECDSA host key.
  23. debug1: Found key in /home/jivan/.ssh/known_hosts:39
  24. debug1: ssh_ecdsa_verify: signature correct
  25. debug1: SSH2_MSG_NEWKEYS sent
  26. debug1: expecting SSH2_MSG_NEWKEYS
  27. debug1: SSH2_MSG_NEWKEYS received
  28. debug1: Roaming not allowed by server
  29. debug1: SSH2_MSG_SERVICE_REQUEST sent
  30. debug1: SSH2_MSG_SERVICE_ACCEPT received
  31. debug1: Authentications that can continue: publickey,password
  32. debug1: Next authentication method: publickey
  33. debug1: Offering RSA public key: .ssh/id_rsa.pub
  34. debug1: Server accepts key: pkalg ssh-rsa blen 279

服务器日志:

  1. Feb 24 12:02:38 balance sshd[5734]: debug1: Forked child 6745.
  2. Feb 24 12:02:38 balance sshd[6745]: Set /proc/self/oom_score_adj to 0
  3. Feb 24 12:02:38 balance sshd[6745]: debug1: rexec start in 5 out 5 newsock 5 pip
  4. e 7 sock 8
  5. Feb 24 12:02:38 balance sshd[6745]: debug1: inetd sockets after dupping: 3,3
  6. Feb 24 12:02:38 balance sshd[6745]: Connection from 207.204.228.55 port 57967
  7. Feb 24 12:02:38 balance sshd[6745]: debug1: Client protocol version 2.0; client
  8. software version OpenSSH_6.0p1 Debian-3ubuntu1
  9. Feb 24 12:02:38 balance sshd[6745]: debug1: match: OpenSSH_6.0p1 Debian-3ubuntu1
  10. pat OpenSSH*
  11. Feb 24 12:02:38 balance sshd[6745]: debug1: Enabling compatibility mode for prot
  12. ocol 2.0
  13. Feb 24 12:02:38 balance sshd[6745]: debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1
  14. Feb 24 12:02:39 balance sshd[6745]: debug1: PAM: initializing for "jivan"
  15. Feb 24 12:02:39 balance sshd[6745]: debug1: PAM: setting PAM_RHOST to "207.204.228.55"
  16. Feb 24 12:02:39 balance sshd[6745]: debug1: PAM: setting PAM_TTY to "ssh"
  17. Feb 24 12:02:40 balance sshd[6745]: debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
  18. Feb 24 12:02:40 balance sshd[6745]: debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
  19. Feb 24 12:02:40 balance sshd[6745]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
  20. Feb 24 12:02:40 balance sshd[6745]: debug1: trying public key file /home/jivan/.ssh/authorized_keys
  21. Feb 24 12:02:40 balance sshd[6745]: debug1: fd 4 clearing O_NONBLOCK
  22. Feb 24 12:02:40 balance sshd[6745]: debug1: matching key found: file /home/jivan/.ssh/authorized_keys,line 1
  23. Feb 24 12:02:40 balance sshd[6745]: Found matching RSA key: 5f:8c:76:ad:48:6a:f5:73:03:6a:36:13:c0:ea:3b:45
  24. Feb 24 12:02:40 balance sshd[6745]: debug1: restore_uid: 0/0

任何想法可能是什么问题?

更新:
问题在开始时神秘地停止了.仍然对可能导致这种情况的任何见解感兴趣.

解决方法

这通常是由反向DNS问题引起的;这一周发生在我的旧服务器上.你是正确的调用sshd -d,但反向DNS问题不会真正变得明显,除非你用sshd -ddd运行它,以便你看到debug3的输出.

虽然反向DNS问题并不总是导致事情严重失败,但如果与连接尝试相关的足够DNS查找失败(即所有DNS服务器完全不可用,或者相关区域/反向区域足够超时),在某些配置下,完全锁定对系统的ssh访问就足够了.如果服务器不耐烦并丢弃连接,则设置客户端超时的高低并不重要.

猜你在找的Linux相关文章