![如何通过 ssh 进入 LXD 客户机?](https://linux22.com/image/1011273/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%20ssh%20%E8%BF%9B%E5%85%A5%20LXD%20%E5%AE%A2%E6%88%B7%E6%9C%BA%EF%BC%9F.png)
我有一个主持人带有 LXD 的机器(带有 Kubuntu 18.04 的 KVM)客人(基于ubuntu18.04镜像)。
我可以从客户机 ssh 到主机。
但尝试从主机 ssh 到客户机时会出现
权限被拒绝(公钥)
错误
重现步骤:
- lxc exec 进入客户机
- 使用 ubuntu 用户执行登录(以避免 root 权限问题)
- ssh 到主机 -成功
- 退出用户 ubuntu - 从访客退出
- 从主机 ssh 进入 ubuntu@guest -错误
我做错了什么?
以下是完整的会议记录
sysop@kvmneo4j:~$ lxc list
+----------+---------+-------------------+------+------------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+----------+---------+-------------------+------+------------+-----------+
| base1804 | RUNNING | 10.0.0.205 (eth0) | | PERSISTENT | 0 |
+----------+---------+-------------------+------+------------+-----------+
sysop@kvmneo4j:~$ lxc exec base1804 bash
root@base1804:~# exec login ubuntu
Password:
Last login: Wed Jan 2 18:58:10 UTC 2019 on UNKNOWN
Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-43-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Wed Jan 2 19:02:28 UTC 2019
System load: 1.69 Processes: 22
Usage of /home: unknown Users logged in: 0
Memory usage: 1% IP address for eth0: 10.0.0.205
Swap usage: 0%
Get cloud support with Ubuntu Advantage Cloud Guest:
http://www.ubuntu.com/business/services/cloud
0 packages can be updated.
0 updates are security updates.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
ubuntu@base1804:~$ ssh [email protected]
[email protected]'s password:
Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-43-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
* Canonical Livepatch is available for installation.
- Reduce system reboots and improve kernel security. Activate at:
https://ubuntu.com/livepatch
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Wed Jan 2 19:58:42 2019 from 10.0.0.205
sysop@kvmneo4j:~$ logout
Connection to 10.0.0.1 closed.
ubuntu@base1804:~$ logout
sysop@kvmneo4j:~$ ssh -v [email protected]
OpenSSH_7.6p1 Ubuntu-4ubuntu0.1, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 10.0.0.205 [10.0.0.205] port 22.
debug1: Connection established.
debug1: identity file /home/sysop/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/sysop/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sysop/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sysop/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sysop/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sysop/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sysop/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/sysop/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1 Ubuntu-4ubuntu0.1
debug1: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.0.0.205:22 as 'ubuntu'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:i0Ezo01qJyhIue4PIRobOw/qKuvDW/7OJZzgB0X5jGM
debug1: Host '10.0.0.205' is known and matches the ECDSA host key.
debug1: Found key in /home/sysop/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:EfYKpv5N+M8YBgCFjjy3P9M0jYt7DObq9ApoZ0G8qL4 /home/sysop/.ssh/id_rsa
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/sysop/.ssh/id_dsa
debug1: Trying private key: /home/sysop/.ssh/id_ecdsa
debug1: Trying private key: /home/sysop/.ssh/id_ed25519
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey).
sysop@kvmneo4j:~$
答案1
公钥可用于身份验证。
- 将公钥添加到容器上的授权密钥:
cat <public_key_file_on_host> | lxc exec <container> -- sh -c "cat >> /home/ubuntu/.ssh/authorized_keys"
- 重新启动 ssh 守护进程:
lxc exec <container> -- systemctl restart ssh
- 以 ubuntu 身份通过 ssh 进入容器
ssh ubuntu@<container_ip>
笔记:
- 例如
<public_key_file_on_host>
:(~/.ssh/id_rsa.pub
或者用 生成一个新的ssh-keygen -t rsa
) <container_ip>
可以通过以下方式获得lxc list
- 要直接使用容器名称而不是 IP,请尝试
sudo systemd-resolve --interface=lxdbr0 --set-dns=`ip -f inet addr show dev lxdbr0 | grep -Po 'inet \K[\d.]+'` --set-domain=lxd
ssh ubuntu@<container>.lxd
答案2
默认情况下,所有容器的 Ubuntu映像都在其 SSH 配置中lxd
设置。PasswordAuthentication no
您需要直接进入容器并编辑配置root
。
(1)lxc shell CONTAINER-NAME
将会把你丢进一个root
shell 中。
(2)nano /etc/ssh/sshd_config
将使用nano
文本编辑器打开该文件。
(3)找到该线PasswordAuthentication no
并将其设置为yes
。
(4)Ctrl+W写入文件,Ctrl+X关闭文件。
(5)使用 . 重新启动 SSH 服务systemctl restart ssh
(如果提示您没有权限,请将其添加sudo
到命令前面)
现在您应该能够从主机系统通过 SSH 进入容器。
答案3
从客人处尝试:
ssh -A host
然后从主机:
ssh final-destination
“-A”将您的代理从客户机转发到主机。