我有位于不同位置的客户端和服务器，它们通过 IPSec 隧道连接，如果我尝试通过互联网从客户端 ssh 到服务器，一切都会正常。我尝试过从多个 Linux 和 Cygwin 安装，每个客户端都会发生同样的事情。当我尝试从客户端 ssh 到服务器的内部地址时，连接挂起并显示以下消息：
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
客户的最后一条消息是：
debug1: SSH2_MSG_KEXINIT sent
最初我以为这是由于客户端上的 ssh 版本过旧导致无法正确进行身份验证，但它在公共接口上工作正常。服务器接受来自同一 LAN 上的客户端的连接，没有任何问题。
客户端是 172.24.20.228/23 服务器是 192.168.2.24/24 和 ssh.domain.tld 公开。
调试信息：客户端公开：
$ ssh [email protected] -v -p 2222
OpenSSH_6.7p1, OpenSSL 1.0.1k 8 Jan 2015
debug1: Connecting to ssh.domain.tld [1.2.3.4] port 2222.
debug1: Connection established.
debug1: identity file /home/robbiecrash/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_rsa-cert type -1
debug1: identity file /home/robbiecrash/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr [email protected] none
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA KEY:KEY:KEY
debug1: Host '[1.2.3.4]:2222' is known and matches the ECDSA host key.
debug1: Found key in /home/robbiecrash/.ssh/known_hosts:9
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/robbiecrash/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Offering DSA public key: /home/robbiecrash/.ssh/id_dsa
debug1: Server accepts key: pkalg ssh-dss blen 434
debug1: Authentication succeeded (publickey).
Authenticated to ssh.domain.tld ([1.2.3.4]:2222).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
服务器没有显示任何意外情况。
客户端优于内部：
$ ssh [email protected] -vvv -p 2222
OpenSSH_6.7p1, OpenSSL 1.0.1k 8 Jan 2015
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.2.24 [192.168.2.24] port 2222.
debug1: Connection established.
debug1: identity file /home/robbiecrash/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_rsa-cert type -1
debug1: identity file /home/robbiecrash/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/robbiecrash/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.7
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: put_host_port: [192.168.2.24]:2222
debug3: load_hostkeys: loading entries for host "[192.168.2.24]:2222" from file "/home/robbiecrash/.ssh/known_hosts"
debug3: load_hostkeys: loaded 0 keys
debug1: SSH2_MSG_KEXINIT sent
然后它就永远挂在那里了。服务器显示以下内容：
root@thoth:/var/log# /usr/sbin/sshd -d -p 2222
debug1: sshd version OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type ECDSA
debug1: private host key: #2 type 3 ECDSA
debug1: private host key: #3 type 4 ED25519
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: rexec_argv[2]='-p'
debug1: rexec_argv[3]='2222'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 172.24.20.228 port 5448 on 192.168.2.24 port 2222
debug1: Client protocol version 2.0; client software version OpenSSH_6.7
debug1: match: OpenSSH_6.7 pat OpenSSH* compat 0x04000000
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3
debug1: permanently_set_uid: 104/65534 [preauth]
debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: client->server aes128-ctr [email protected] none [preauth]
debug1: kex: server->client aes128-ctr [email protected] none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
当我按 CTRL+C 客户端时退出：
Connection closed by 172.24.20.228 [preauth]
debug1: do_cleanup [preauth]
debug1: monitor_read_log: child log fd closed
debug1: do_cleanup
debug1: Killing privsep child 29528
答案1
在我看来MTU 问题。根据您的设置，有多种方法可以解决/缓解此问题。
如果你的路由器支持，最方便的方法可能是进行 MTU 限制。或者，你可以尝试设置较小的 MTU在服务器和客户端上 — — 尽管这并不理想。
（虽然我已经从艰苦的经历中知道了这一切，但我刚刚发现 SSH 设置了一个“不要分裂“数据包头中的位，这会加剧 MTU 问题）