我一直在ssh'ing这个盒子没有问题一年使用公钥authentication。
没有对客户端或服务器的sshconfiguration进行更改。 现在,SSH连接永远不会完成或失败,他们只是挂起。 以下是尝试连接时的debugging输出:
OpenSSH_6.0p1 Debian-3ubuntu1, OpenSSL 1.0.1c 10 May 2012 debug1: Reading configuration data /home/jivan/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to <host> [<ip>] port <port>. debug1: Connection established. debug1: identity file .ssh/id_rsa.pub type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file .ssh/id_rsa.pub-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1 Debian-7ubuntu1 debug1: match: OpenSSH_5.8p1 Debian-7ubuntu1 pat OpenSSH_5* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3ubuntu1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA 81:63:05:0c:39:6b:77:d7:a2:25:93:30:80:f1:ba:0e debug1: Host '[<host>]:<port>' is known and matches the ECDSA host key. debug1: Found key in /home/jivan/.ssh/known_hosts:39 debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering RSA public key: .ssh/id_rsa.pub debug1: Server accepts key: pkalg ssh-rsa blen 279
服务器日志:
Feb 24 12:02:38 balance sshd[5734]: debug1: Forked child 6745. Feb 24 12:02:38 balance sshd[6745]: Set /proc/self/oom_score_adj to 0 Feb 24 12:02:38 balance sshd[6745]: debug1: rexec start in 5 out 5 newsock 5 pip e 7 sock 8 Feb 24 12:02:38 balance sshd[6745]: debug1: inetd sockets after dupping: 3, 3 Feb 24 12:02:38 balance sshd[6745]: Connection from 207.204.228.55 port 57967 Feb 24 12:02:38 balance sshd[6745]: debug1: Client protocol version 2.0; client software version OpenSSH_6.0p1 Debian-3ubuntu1 Feb 24 12:02:38 balance sshd[6745]: debug1: match: OpenSSH_6.0p1 Debian-3ubuntu1 pat OpenSSH* Feb 24 12:02:38 balance sshd[6745]: debug1: Enabling compatibility mode for prot ocol 2.0 Feb 24 12:02:38 balance sshd[6745]: debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1 Feb 24 12:02:39 balance sshd[6745]: debug1: PAM: initializing for "jivan" Feb 24 12:02:39 balance sshd[6745]: debug1: PAM: setting PAM_RHOST to "207.204.228.55" Feb 24 12:02:39 balance sshd[6745]: debug1: PAM: setting PAM_TTY to "ssh" Feb 24 12:02:40 balance sshd[6745]: debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 Feb 24 12:02:40 balance sshd[6745]: debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 Feb 24 12:02:40 balance sshd[6745]: debug1: temporarily_use_uid: 1000/1000 (e=0/0) Feb 24 12:02:40 balance sshd[6745]: debug1: trying public key file /home/jivan/.ssh/authorized_keys Feb 24 12:02:40 balance sshd[6745]: debug1: fd 4 clearing O_NONBLOCK Feb 24 12:02:40 balance sshd[6745]: debug1: matching key found: file /home/jivan/.ssh/authorized_keys, line 1 Feb 24 12:02:40 balance sshd[6745]: Found matching RSA key: 5f:8c:76:ad:48:6a:f5:73:03:6a:36:13:c0:ea:3b:45 Feb 24 12:02:40 balance sshd[6745]: debug1: restore_uid: 0/0
任何想法可能是什么问题?
更新:问题一开始就神秘地停了下来。 仍然对任何可能造成这种情况的洞察力感兴趣。
这通常是由反向DNS的问题引起的; 这周刚刚发生在我的一台旧服务器上。 你是正确的调用sshd -d ,但是反向DNS问题不会真正变得明显,除非你用sshd -ddd来运行它,以便看到debug3的输出。
虽然反向DNS问题并不总是使事情备份,如果足够的DNS查询有关的连接尝试失败(即所有DNS服务器是完全不可用,或足够的相关区域/反向区域超时),在一些configuration下,完全lockingssh访问系统就足够了。 如果服务器不耐烦并且断开连接,那么设置客户端超时的次数并不重要。
我也遇到过这个问题,但是现在轮到客户说话了。 在这种情况下,这似乎是由于gpg-agent的存在(在ssh-agent-support模式下运行)。 杀死它或ssh-add -D它允许恢复ssh连接。
虽然上面的情况很可能与DNS有关,但是我一直在经历着一些摊位
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
它也不一致。 它走了,做了:
KexAlgorithms diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
我怀疑IPv6隧道真正的起源是有限的MTU,但我还没有validation这一点。 Google发现这个问题。