Closed yuhongwei380 closed 1 year ago
你都有pve了,pve的console进去看看日志和系统日志不行吗,以及consol里ssh -vvv localhost试试
目前发现是xshell 无法ssh 连接到自编译新版本 的问题,用cmd 和 terminal可以ssh访问;xshell 可以正常ssh 到5.15.28 版本的;case 先关了;我自己再排查看看吧
应该是client 的ssh的密钥算法和op里的不匹配
害,我也不知道哪儿出问题了;新编了一个版本,发现又没法 cmd 和terminal访问了;感觉是网络层面的问题或者是ssh 这边的问题,之前遇到了centos8 ssh 无法ssh,是因为ipqos 影响到。我们是访问ipsec 对端的 op;
你找个局域网的大型linux,或者你的pve,ssh -vvvv 看下调试信息
root@OpenWrt:~# ssh localhost ssh: Connection to root@localhost:22 exited: Connect failed: Connection refused
大局域网内是可以ssh 的,跨ipsec-vpn的访问就有问题了;对端也有和OP一样网段的linux,可以正常ssh到;
同局域网,ssh调试信息如下,IP我隐去了;
[vesoft@localhost ~]$ ssh -vvv root@192.168.15.x
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug2: resolving "192.168.15.252" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 192.168.15.x [192.168.15.x] port 22.
debug1: Connection established.
debug1: identity file /home/vesoft/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/vesoft/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/vesoft/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/vesoft/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/vesoft/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/vesoft/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/vesoft/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/vesoft/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version dropbear
debug1: no match: dropbear
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.15.x:22 as 'root'
debug3: hostkeys_foreach: reading file "/home/vesoft/.ssh/known_hosts"
debug3: record_hostkey: found key type ED25519 in file /home/vesoft/.ssh/known_hosts:126
debug3: load_hostkeys: loaded 1 keys from 192.168.15.x
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-ed25519-cert-v01@openssh.com,ssh-ed25519
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,kexguess2@matt.ucc.asn.au
debug2: host key algorithms: ssh-ed25519,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes256-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes256-ctr
debug2: MACs ctos: hmac-sha1,hmac-sha2-256
debug2: MACs stoc: hmac-sha1,hmac-sha2-256
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:
你这是ipsec 的段冲突了吧。。。,你ssh的不是你的op,最简单就是你curl下你op的web或者telnet op的tcp端口,你在op上抓包
ispec 段没冲突的哈;我是用的同局域网的ssh 到这台15.X的OP上,-vvv打印信息; 你说的是 curl op的 web地址;然后我op tcpdump 抓包是吗
通过ipsec测下看看
我贴的两个图,上面那个图是端A-OP 的抓包,下面的那个图 是ipsec 的另外一端B(我的主机wsl)curl 的op 的web地址,本身就是通过ipsec-vpn了
我今天把op的版本降级回我们今年22-3月编译的版本kernel 5.15.28,直接本地就ssh上了 @zhangguanzhang ;我对比了 昨天编译版本的和我3月版本的差别,跟ssh相关的dropbear的版本升级了,我把5.15.28 的dropbear 更新到 2022.82-2 就可以稳定复现无法直接ssh 连接上的故障了。
🤔你用windows 安装个git bash,然后用它的的ssh试试呢
ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa xxx
还是一样的
ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -vvvv xxx
目前是这个状态,我感觉还是跟 IPQos 这个有关
我看了下dropbear 2022.82版本的release note, 这个版本默认把AF21 作为dscp 的默认;优先级 (tty) 流量现在设置为 AF21“交互式”。 这个问题会导致我的ssh 连接故障的原因; 因为这个问题我们在centos8 的openssh8.0 上也曾遇到了这个故障。
上面-vvv的IP_TOS
我搜索了下搜不到有用的信息
🤔也就是说搞了个另类的qos吗
你搜 IPQos ssh 这种可能会更有相关信息;
我到dropbear 那个项目下提出这个问题了,作者表示后续会出一个选项,用来避免这样的情况。https://github.com/mkj/dropbear/issues/193
👍很棒
反馈bug/问题模板,提建议请删除
1.关于你要提交的问题
ssh相关问题 Q:是否搜索了issue (使用 "x" 选择)
2. 详细叙述
(1) 具体问题
A:近期编译固件发现新版本的固件编译出来,我qm import 到pve上,发现op发现ssh 拒绝连接,web UI正常登录;ssh -vvv localhost 也是 拒绝连接;
(2) 路由器型号和固件版本
A:X86版本;虚拟机,5.15.58
(3) 详细日志
A:ssh连接,提示拒绝连接;