服务器中的 nftables 阻止 SSH 登录（使用更强的 SSH 密钥）

Question

使用大型 SSH 密钥和使用 nftables 防火墙时的 SSH 连接，显然 SSH 需要稍长的时间来处理和通过各种组件，因此整个 SSH 身份验证过程需要更多时间，但我指定/配置的时间设置不够。

如果未启用/打开 nftables，从旧 macOS 计算机到 Server-3 的 SSH 连接通常大约需要大约 10 秒。（因此，当 nftables 未加载/运行时，我的初始时间设置为 20 或 18 秒就足够了）。
但是，当 nftables 在 SSH 服务器中加载并打开/启用时，旧的 macOS 计算机（以及服务器端 nftables 网络数据包过滤活动等）需要额外的 15 到 20 秒才能完成 SSH 身份验证过程。

这解决方案是: 增加超时/间隔/活动时间长度值（ServerAliveInterval 的+ServerAliveCountMax 和 ClientAliveInterval+最大客户端存活数),或者,删除超时设置（使用默认值），如下所示：

删除/禁用（或变成注释）这些行〜/ .ssh /配置macOS SSH 客户端计算机中的文件：

# ConnectTimeout 30
# ConnectTimeout 15
# ConnectTimeout 18
# ConnectionAttempts 1

更改了 ~/.ssh/config 文件中的以下设置/行：

来自：
ServerAliveInterval 20
ServerAliveCountMax 1
以上设置仅使连接保持活动状态 20 x 1 = 20 秒

到：

ServerAliveInterval 18  
ServerAliveCountMax 2

上述设置使连接保持活动状态 18 x 2 = 36 秒

并更改了以下设置/行/etc/ssh/sshd_configDebian-10 服务器计算机中的文件：

来自：
ClientAliveInterval 30
ClientAliveCountMax 1
以上设置仅使连接保持活动状态 30 x 1 = 30 秒

到：

ClientAliveInterval 18
ClientAliveCountMax 2

上述设置使连接保持活动状态 18 x 2 = 36 秒

来自 (macOS) 的记录信息：man ssh_config

ServerAliveCountMax
    Sets the number of server alive messages (see below) which may be
    sent without ssh(1) receiving any messages back from the server.
    If this threshold is reached while server alive messages are being
    sent, ssh will disconnect from the server, terminating the session.
    It is important to note that the use of server alive messages is
    very different from TCPKeepAlive (below).  The server alive messages
    are sent through the encrypted channel and therefore will not be
    spoofable.  The TCP keepalive option enabled by TCPKeepAlive is
    spoofable.  The server alive mechanism is valuable when the client
    or server depend on knowing when a connection has become inactive.

    The default value is 3.  If, for example, ServerAliveInterval (see
    below) is set to 15 and ServerAliveCountMax is left at the default,
    if the server becomes unresponsive, ssh will disconnect after
    approximately 45 seconds.

ServerAliveInterval
    Sets a timeout interval in seconds after which if no data has been
    received from the server, ssh(1) will send a message through the
    encrypted channel to request a response from the server.
    The default is 0, indicating that these messages will not be sent
    to the server.

ConnectionAttempts
    Specifies the number of tries (one per second) to make before exiting.
    The argument must be an integer.  This may be useful in scripts if
    the connection sometimes fails.  The default is 1.

ConnectTimeout
    Specifies the timeout (in seconds) used when connecting to the SSH
    server, instead of using the default system TCP timeout.  This value
    is used only when the target is down or really unreachable, not
    when it refuses the connection.

来自（Debian Server-3）的记录信息：man sshd_config

ClientAliveCountMax
    Sets the number of client alive messages which may be sent without
    sshd(8) receiving any messages back from the client.  If this threshold
    is reached while client alive messages are being sent, sshd will
    disconnect the client, terminating the session.  It is important to
    note that the use of client alive messages is very different from
    TCPKeepAlive.  The client alive messages are sent through the
    encrypted channel and therefore will not be spoofable.  The TCP
    keepalive option enabled by TCPKeepAlive is spoofable.
    The client alive mechanism is valuable when the client or server
    depend on knowing when a connection has become inactive.

    The default value is 3.  If ClientAliveInterval is set to 15, and
    ClientAliveCountMax is left at the default, unresponsive SSH clients
    will be disconnected after approximately 45 seconds.

ClientAliveInterval
    Sets a timeout interval in seconds after which if no data has been
    received from the client, sshd(8) will send a message through the
    encrypted channel to request a response from the client.  The default
    is 0, indicating that these messages will not be sent to the client.

通过上面几段中提到的更正设置，现在即使 nftables 处于 ON/enabled 状态，任何 SSH 客户端计算机都可以与 SSH 服务器连接。目前，在 nftables 防火墙打开/启用的情况下，通过 SSH 连接大约需要 35 到 45 秒。

我将不得不进一步微调这些设置/时间值，因为我想在 20 到 40 秒内重新创建另一个 SSH 隧道（在 Debian ssh- 之间）。客户端和 Debian ssh 服务器）。

Answer 1

使用大型 SSH 密钥和使用 nftables 防火墙时的 SSH 连接，显然 SSH 需要稍长的时间来处理和通过各种组件，因此整个 SSH 身份验证过程需要更多时间，但我指定/配置的时间设置不够。

如果未启用/打开 nftables，从旧 macOS 计算机到 Server-3 的 SSH 连接通常大约需要大约 10 秒。（因此，当 nftables 未加载/运行时，我的初始时间设置为 20 或 18 秒就足够了）。
但是，当 nftables 在 SSH 服务器中加载并打开/启用时，旧的 macOS 计算机（以及服务器端 nftables 网络数据包过滤活动等）需要额外的 15 到 20 秒才能完成 SSH 身份验证过程。

这解决方案是: 增加超时/间隔/活动时间长度值（ServerAliveInterval 的+ServerAliveCountMax 和 ClientAliveInterval+最大客户端存活数),或者,删除超时设置（使用默认值），如下所示：

删除/禁用（或变成注释）这些行〜/ .ssh /配置macOS SSH 客户端计算机中的文件：

# ConnectTimeout 30
# ConnectTimeout 15
# ConnectTimeout 18
# ConnectionAttempts 1

更改了 ~/.ssh/config 文件中的以下设置/行：

来自：
ServerAliveInterval 20
ServerAliveCountMax 1
以上设置仅使连接保持活动状态 20 x 1 = 20 秒

到：

ServerAliveInterval 18  
ServerAliveCountMax 2

上述设置使连接保持活动状态 18 x 2 = 36 秒

并更改了以下设置/行/etc/ssh/sshd_configDebian-10 服务器计算机中的文件：

来自：
ClientAliveInterval 30
ClientAliveCountMax 1
以上设置仅使连接保持活动状态 30 x 1 = 30 秒

到：

ClientAliveInterval 18
ClientAliveCountMax 2

上述设置使连接保持活动状态 18 x 2 = 36 秒

来自 (macOS) 的记录信息：man ssh_config

ServerAliveCountMax
    Sets the number of server alive messages (see below) which may be
    sent without ssh(1) receiving any messages back from the server.
    If this threshold is reached while server alive messages are being
    sent, ssh will disconnect from the server, terminating the session.
    It is important to note that the use of server alive messages is
    very different from TCPKeepAlive (below).  The server alive messages
    are sent through the encrypted channel and therefore will not be
    spoofable.  The TCP keepalive option enabled by TCPKeepAlive is
    spoofable.  The server alive mechanism is valuable when the client
    or server depend on knowing when a connection has become inactive.

    The default value is 3.  If, for example, ServerAliveInterval (see
    below) is set to 15 and ServerAliveCountMax is left at the default,
    if the server becomes unresponsive, ssh will disconnect after
    approximately 45 seconds.

ServerAliveInterval
    Sets a timeout interval in seconds after which if no data has been
    received from the server, ssh(1) will send a message through the
    encrypted channel to request a response from the server.
    The default is 0, indicating that these messages will not be sent
    to the server.

ConnectionAttempts
    Specifies the number of tries (one per second) to make before exiting.
    The argument must be an integer.  This may be useful in scripts if
    the connection sometimes fails.  The default is 1.

ConnectTimeout
    Specifies the timeout (in seconds) used when connecting to the SSH
    server, instead of using the default system TCP timeout.  This value
    is used only when the target is down or really unreachable, not
    when it refuses the connection.

来自（Debian Server-3）的记录信息：man sshd_config

ClientAliveCountMax
    Sets the number of client alive messages which may be sent without
    sshd(8) receiving any messages back from the client.  If this threshold
    is reached while client alive messages are being sent, sshd will
    disconnect the client, terminating the session.  It is important to
    note that the use of client alive messages is very different from
    TCPKeepAlive.  The client alive messages are sent through the
    encrypted channel and therefore will not be spoofable.  The TCP
    keepalive option enabled by TCPKeepAlive is spoofable.
    The client alive mechanism is valuable when the client or server
    depend on knowing when a connection has become inactive.

    The default value is 3.  If ClientAliveInterval is set to 15, and
    ClientAliveCountMax is left at the default, unresponsive SSH clients
    will be disconnected after approximately 45 seconds.

ClientAliveInterval
    Sets a timeout interval in seconds after which if no data has been
    received from the client, sshd(8) will send a message through the
    encrypted channel to request a response from the client.  The default
    is 0, indicating that these messages will not be sent to the client.

通过上面几段中提到的更正设置，现在即使 nftables 处于 ON/enabled 状态，任何 SSH 客户端计算机都可以与 SSH 服务器连接。目前，在 nftables 防火墙打开/启用的情况下，通过 SSH 连接大约需要 35 到 45 秒。

我将不得不进一步微调这些设置/时间值，因为我想在 20 到 40 秒内重新创建另一个 SSH 隧道（在 Debian ssh- 之间）。客户端和 Debian ssh 服务器）。

服务器中的 nftables 阻止 SSH 登录（使用更强的 SSH 密钥）

答案1

相关内容