几周前开始的一个恼人的问题，现在让我发疯了！
在家里，我有一个作为文件服务器的Ubuntu 10.04.03盒子。 我通过rsync从networking外部的其他盒子备份东西。 当我连接到这个文件服务器，从我的笔记本电脑，我转发的SSH代理：
root@fileserver:~# env | grep SSH_AUTH SSH_AUTH_SOCK=/tmp/ssh-IumRLB2628/agent.2628 有这个盒子，也运行10.04.03，我不能连接。 所有其他工作正常，我的SSH密钥没有被转发probs，但这一台服务器就不会有它。 这就是我的意思：
root@fileserver:~# ssh the-problematic-server -v OpenSSH_5.3p1 Debian-3ubuntu7, OpenSSL 0.9.8k 25 Mar 2009 debug1: Reading configuration data /root/.ssh/config debug1: Applying options for myserver debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to the-problematic-server [nnnn] port 22. debug1: connect to address nnnn port 22: Connection timed out ssh: connect to host the-problematic-server port 22: Connection timed out
从相同的文件服务器到不同的盒子，使用相同的转发ssh-agent：
root@fileserver:~# ssh the-good-server -v debug1: Reading configuration data /root/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to the-good-server [nnnn] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/identity type -1 debug1: identity file /root/.ssh/id_rsa type -1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3p1 Debian-3ubuntu7 debug1: match: OpenSSH_5.3p1 Debian-3ubuntu7 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'the-good-server.net' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:10 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv THE FORWARDED KEY debug1: Offering public key: /Users/gerhard/.ssh/calista_rsa <<<<<< THE FORWARDED KEY ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ THE FORWARDED KEY debug1: Server accepts key: pkalg ssh-rsa blen 277 debug1: Authentication succeeded (publickey). debug1: channel 0: new [client-session] debug1: Requesting [email protected] debug1: Entering interactive session. debug1: Requesting authentication agent forwarding. debug1: Sending environment. debug1: Sending env LANG = en_US.UTF-8 Linux the-good-server 2.6.32-32-generic #62-Ubuntu SMP Wed Apr 20 21:52:38 UTC 2011 x86_64 GNU/Linux Ubuntu 10.04.3 LTS
而现在，从顶部的樱桃，从我刚刚连接到的服务器…
root@the-good-server:~# ssh the-problematic-server -v OpenSSH_5.3p1 Debian-3ubuntu7, OpenSSL 0.9.8k 25 Mar 2009 debug1: Reading configuration data /root/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to the-problematic-server [nnnn] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/identity type -1 debug1: identity file /root/.ssh/id_rsa type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3p1 Debian-3ubuntu7 debug1: match: OpenSSH_5.3p1 Debian-3ubuntu7 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'the-problematic-server' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:1 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: client_input_channel_open: ctype [email protected] rchan 2 win 65536 max 16384 debug1: channel 1: new [authentication agent connection] debug1: confirm [email protected] debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv THE FORWARDED KEY AGAIN debug1: Offering public key: /Users/gerhard/.ssh/calista_rsa <<<<<< THE FORWARDED KEY AGAIN ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ THE FORWARDED KEY AGAIN debug1: Server accepts key: pkalg ssh-rsa blen 277 debug1: channel 1: FORCE input drain debug1: Authentication succeeded (publickey). debug1: channel 0: new [client-session] debug1: Requesting [email protected] debug1: Entering interactive session. debug1: channel 1: free: authentication agent connection, nchannels 2 debug1: Requesting authentication agent forwarding. debug1: Sending environment. debug1: Sending env LANG = en_US Linux the-problematic-server 2.6.34.6-64 #3 SMP Fri Sep 17 16:06:38 UTC 2010 x86_64 GNU/Linux Ubuntu 10.04.3 LTS
我也尝试了不同的用户btw，同样的事情发生时，我试图从文件服务器连接。 没有任何东西login到该“有问题的服务器”框的auth.log，所以它似乎甚至没有到达sshd部分。
我在这里真的没有什么想法了，我正在寻找更明智，更尖锐的印章。 干杯!
root@problematic-server:~# ifconfig eth0 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:188.165.229.62 Bcast:188.165.229.255 Mask:255.255.255.0 inet6 addr: fe80::225:90ff:fe13:b3a0/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:4021584924 errors:169 dropped:4562 overruns:0 frame:169 TX packets:6302335682 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2467184127845 (2.4 TB) TX bytes:8418184173437 (8.4 TB) Memory:febe0000-fec00000 eth0:0 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:94.23.121.1 Bcast:94.23.121.1 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:febe0000-fec00000 eth0:1 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:94.23.152.36 Bcast:94.23.152.36 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:febe0000-fec00000 eth0:2 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:178.32.58.3 Bcast:178.32.58.3 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:febe0000-fec00000
几个arping结果：
root@problematic-server:~# arping -D -I eth0 -c 2 188.165.229.62 ARPING 188.165.229.62 from 0.0.0.0 eth0 Sent 2 probes (2 broadcast(s)) Received 0 response(s) root@opteron16:~# arping -D -I eth0:0 -c 2 94.23.121.1 ARPING 94.23.121.1 from 0.0.0.0 eth0:0 Sent 2 probes (2 broadcast(s)) Received 0 response(s)
root@fileserver:~# ip route list 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2 default via 192.168.1.1 dev eth0 metric 100 root@problematic-server:~# ip route list 188.165.229.0/24 dev eth0 proto kernel scope link src 188.165.229.62 default via 188.165.229.254 dev eth0 metric 100
root@fileserver:~# dig problematic-server ; <<>> DiG 9.7.0-P1 <<>> problematic-server ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36025 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;problematic-server. IN A ;; ANSWER SECTION: problematic-server. 1016 IN A 188.165.229.62 ;; Query time: 26 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Sep 29 09:32:50 2011 ;; MSG SIZE rcvd: 58
root@fileserver:~# arping -c 5 188.165.229.62 ARPING 188.165.229.62 --- 188.165.229.62 statistics --- 5 packets transmitted, 0 packets received, 100% unanswered
这可能是一个新的networking问题。 检查你是否可以ping的盒子。 检查防火墙（iptables），看看是否阻止你的主机。 检查/etc/hosts.*文件，看它是否被拒绝。
查看您的主机或您连接的主机是否可能存在IP冲突。 你可以在主机上做一个“arping”，看看你是否能得到多个硬件地址。
你在做链路聚合还是你有两个主机的多个网卡？ 这可能是一个路由问题。
[更新]从filserver到problematic-server的路线看起来有些问题。 无论出于何种原因，数据无法在这些networking之间路由。 你运行路由这个stream量的networking路由器吗？ 听起来像你的路由器的问题。
这似乎并不像一般的networking连接问题那样是SSH代理问题。 因此，通常的诊断步骤适用于ping，tcpdump，检查防火墙等。
这仍然没有解决…从启用防火墙的LAN路由器login：
Local User (MAC=00-17-31-F2-63-7D): 192.168.1.2:57335 -> 188.165.229.62:22 (TCP) [FW_Session][Pass][304/15000][@S:R=13:1, 192.168.1.2:57335->188.165.229.62:22] [FILTER][Pass][lan->wan, 0:11:58.990][@S:R=13:1, 192.168.1.2:57335->188.165.229.62:22][TCP][HLen=20, TLen=60, Flag=S, Seq=1090671344, Ack=0, Win=5840]
没有防火墙：
Local User (MAC=00-17-31-F2-63-7D): 192.168.1.2:57336 -> 188.165.229.62:22 (TCP)
我所得到的是：
debug1: Connecting to 188.165.229.62 [188.165.229.62] port 22. debug1: connect to address 188.165.229.62 port 22: Connection timed out ssh: connect to host 188.165.229.62 port 22: Connection timed out
我可以ping和traceroute地址罚款。 我可以从同一个家庭局域网内的笔记本电脑连接。 两台机器上都没有运行防火墙。 我被难住了@ACase。