![无法解释的读取错误 w/hosts.allow 仅主机名查找](https://linux22.com/image/1032607/%E6%97%A0%E6%B3%95%E8%A7%A3%E9%87%8A%E7%9A%84%E8%AF%BB%E5%8F%96%E9%94%99%E8%AF%AF%20w%2Fhosts.allow%20%E4%BB%85%E4%B8%BB%E6%9C%BA%E5%90%8D%E6%9F%A5%E6%89%BE.png)
昨天,我因错误“ kex_exchange_identification: read: Connection reset by peer
”而被锁定在服务器之外,通过 KVM 连接后,我立即找到了原因,即主机名hosts.allow
虽然匹配,但匹配失败。
sshd[717775]: warning: /etc/hosts.allow, line 10: can't verify hostname:
getaddrinfo (<correct-host.com>, AF_INET) failed
sshd[717775]: refused connect from <x.x.x.x> (x.x.x.x)
同样的情况也会发生在不同位置的不同 ISP 上,虽然也被允许但由于同样的原因被拒绝。
然而,奇怪的是,每个 ISP 条目的第 10 行和第 11 行都被报告为"line 10" in /var/log/auth.log
连接失败 —— 请注意,第 10 行之前或之后没有任何字符(包括空格)可能导致其“不可读”并导致第 11 行无法读取。
请注意,使用传统格式“ sshd: .isp1.com .isp2.com
”时主机仍然会失败(我这样配置的唯一原因是如果我想要的话,可以逐行更改每个主机的服务访问)。
如上所述,无论列出的主机顺序如何或我从哪个域连接,它都无法读取第一个未注释的行(10):
sshd[3626087]: warning: /etc/hosts.allow, line 10: can't verify hostname: getaddrinfo(different-but-correct-host.com), AF_INET) failed
sshd[717775]: refused connect from <x.x.x.x> (<x.x.x.x>)
请注意,IP xxxx 也是正确的,反向 DNS 会完整解析主机名,包括解析和允许连接所需的“.isp1.com”和“.isp2.com”域。如果我更改主机的顺序,则不会有任何区别 - 第 10 行首先失败,并且不允许任何连接。它会允许IP 条目。
我可以通过hosts.allow
列出入站连接的 IP 地址进行连接 - 这具体与 DNS 有关,但目前提供商不存在已知的 DNS 故障;我已经测试了不同的 DNS 提供商,据我所知,它也能正常工作。
此配置已按配置运行了好几个月,唯一的变化是其主资源和 ESM 资源的更新。我认为问题就出在这里,因为 DNS 似乎可以运行。
我记得在问题发生之前最后一次成功登录时,应用了更新:
Log started: 2024-03-15 06:50:32
(Reading database ... ^M(Reading database ... 5%^M(Reading database ... 10%^M(Reading database ... 15%^M(Reading database ... 20%^M(Reading database ... 25%^M(Reading database ... 30%^M(Reading database ... 35%^M(Reading database ... 40%^M(Reading database ... 45%^M(Reading database ... 50%^M(Reading database ... 5>
Preparing to unpack .../libexpat1-dev_2.4.7-1ubuntu0.3_amd64.deb ...
Unpacking libexpat1-dev:amd64 (2.4.7-1ubuntu0.3) over (2.4.7-1ubuntu0.2) ...
Preparing to unpack .../libexpat1_2.4.7-1ubuntu0.3_amd64.deb ...
Unpacking libexpat1:amd64 (2.4.7-1ubuntu0.3) over (2.4.7-1ubuntu0.2) ...
Setting up libexpat1:amd64 (2.4.7-1ubuntu0.3) ...
Setting up libexpat1-dev:amd64 (2.4.7-1ubuntu0.3) ...
Processing triggers for libc-bin (2.35-0ubuntu3.6) ...
Log ended: 2024-03-15 06:50:52
有可能它之前已经更新过:
Log started: 2024-03-13 18:34:36
(Reading database ... ^M(Reading database ... 5%^M(Reading database ... 10%^M(Reading database ... 15%^M(Reading database ... 20%^M(Reading database ... 25%^M(Reading database ... 30%^M(Reading database ... 35%^M(Reading database ... 40%^M(Reading database ... 45%^M(Reading database ... 50%^M(Reading database ... 5>
Preparing to unpack .../ubuntu-advantage-tools_31.2~22.04_all.deb ...
Unpacking ubuntu-advantage-tools (31.2~22.04) over (30~22.04) ...
^[[1mdpkg:^[[0m ^[[1;33mwarning:^[[0m unable to delete old directory '/var/lib/ubuntu-advantage': Directory not empty
^[[1mdpkg:^[[0m ^[[1;33mwarning:^[[0m unable to delete old directory '/etc/ubuntu-advantage': Directory not empty
Selecting previously unselected package ubuntu-pro-client.
Preparing to unpack .../ubuntu-pro-client_31.2~22.04_amd64.deb ...
Unpacking ubuntu-pro-client (31.2~22.04) ...
Setting up ubuntu-pro-client (31.2~22.04) ...
Setting up ubuntu-advantage-tools (31.2~22.04) ...
Processing triggers for man-db (2.10.2-1) ...
Log ended: 2024-03-13 18:35:09
Log started: 2024-03-13 18:42:57
(Reading database ... ^M(Reading database ... 5%^M(Reading database ... 10%^M(Reading database ... 15%^M(Reading database ... 20%^M(Reading database ... 25%^M(Reading database ... 30%^M(Reading database ... 35%^M(Reading database ... 40%^M(Reading database ... 45%^M(Reading database ... 50%^M(Reading database ... 5>
Preparing to unpack .../ubuntu-pro-client-l10n_31.2~22.04_amd64.deb ...
Unpacking ubuntu-pro-client-l10n (31.2~22.04) over (30~22.04) ...
Setting up ubuntu-pro-client-l10n (31.2~22.04) ...
Log ended: 2024-03-13 18:43:12
Log started: 2024-03-13 18:43:35
(Reading database ... ^M(Reading database ... 5%^M(Reading database ... 10%^M(Reading database ... 15%^M(Reading database ... 20%^M(Reading database ... 25%^M(Reading database ... 30%^M(Reading database ... 35%^M(Reading database ... 40%^M(Reading database ... 45%^M(Reading database ... 50%^M(Reading database ... 5>
Preparing to unpack .../apache2-utils_2.4.52-1ubuntu4.8_amd64.deb ...
Unpacking apache2-utils (2.4.52-1ubuntu4.8) over (2.4.52-1ubuntu4.7) ...
Setting up apache2-utils (2.4.52-1ubuntu4.8) ...
Processing triggers for man-db (2.10.2-1) ...
Log ended: 2024-03-13 18:43:41
如果有人知道为什么会发生这种情况,我想修复它,因为只有两个来自两个 ISP 的连接需要通过 ssh 进行连接,其余的连接被明确拒绝hosts.deny
。由于无论格式如何,只有与 DNS 相关的条目没有被正确解析(看起来是这样),我留下的线索很少。
裸 IP 可以工作,但是连接主机没有静态 IP,因此遗憾的是,它不能以首选方式使用。