服务器实际上是 iSH 应用程序，一个在 i(Pad)OS 下运行的 prooted (?) Alpine Linux，它几乎完美无缺，我甚至可以从任何 macOS 或 Linux 终端通过 SSH 进入 iDevice。这是一个非常好的应用程序，很像一个类似的 Android 应用程序 Termux，它接受 ssh 和 sftp 请求。但是当我使用启用 SSH/SFTP 的文件浏览器（Linux 下的 Thunar 或 macOS 下的 Forklift）时，它拒绝连接。我记得过去在通过 SFTP 进入 Linux 服务器时遇到过类似的问题，但不记得我是如何解决的。
使用与否 SSH 密钥都没有区别。
当我在详细模式下运行 sftp 时，结果是：
armemac.local:~/scratch % sftp -v -P 22 [email protected]
OpenSSH_9.0p1, LibreSSL 3.3.6
debug1: Reading configuration data /Users/me/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to 192.168.0.11 [192.168.0.11] port 22.
debug1: Connection established.
debug1: identity file /Users/me/.ssh/id_rsa type 0
debug1: identity file /Users/me/.ssh/id_rsa-cert type -1
debug1: identity file /Users/me/.ssh/id_ecdsa type -1
debug1: identity file /Users/me/.ssh/id_ecdsa-cert type -1
debug1: identity file /Users/me/.ssh/id_ecdsa_sk type -1
debug1: identity file /Users/me/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /Users/me/.ssh/id_ed25519 type -1
debug1: identity file /Users/me/.ssh/id_ed25519-cert type -1
debug1: identity file /Users/me/.ssh/id_ed25519_sk type -1
debug1: identity file /Users/me/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /Users/me/.ssh/id_xmss type -1
debug1: identity file /Users/me/.ssh/id_xmss-cert type -1
debug1: identity file /Users/me/.ssh/id_dsa type 1
debug1: identity file /Users/me/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.0
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.6
debug1: compat_banner: match: OpenSSH_8.6 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.0.11:22 as 'root'
debug1: load_hostkeys: fopen /Users/me/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:DMet4OKiC2qzSCISNQrElbikS35uALIRhmM1BK6FII0
debug1: load_hostkeys: fopen /Users/me/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '192.168.0.11' is known and matches the ED25519 host key.
debug1: Found key in /Users/me/.ssh/known_hosts:159
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: agent returned 1 keys
debug1: Skipping ssh-dss key /Users/me/.ssh/id_dsa - corresponding algo not in PubkeyAcceptedAlgorithms
debug1: Will attempt key: ecdsa-sha2-nistp256 ECDSA SHA256:xn2CTvLgP6mlJ0+iZ52fvzUS3i5bxMLNvfMfBd9Q4aw agent
debug1: Will attempt key: /Users/me/.ssh/id_rsa RSA SHA256:Mh8uuwZwf0zVhPGPmZ/i7SVHlikZmAleGnj9kphNMts
debug1: Will attempt key: /Users/me/.ssh/id_ecdsa
debug1: Will attempt key: /Users/me/.ssh/id_ecdsa_sk
debug1: Will attempt key: /Users/me/.ssh/id_ed25519
debug1: Will attempt key: /Users/me/.ssh/id_ed25519_sk
debug1: Will attempt key: /Users/me/.ssh/id_xmss
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[email protected],ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected]>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: ecdsa-sha2-nistp256 ECDSA SHA256:xn2CTvLgP6mlJ0+iZ52fvzUS3i5bxMLNvfMfBd9Q4aw agent
debug1: Server accepts key: ecdsa-sha2-nistp256 ECDSA SHA256:xn2CTvLgP6mlJ0+iZ52fvzUS3i5bxMLNvfMfBd9Q4aw agent
Authenticated to 192.168.0.11 ([192.168.0.11]:22) using "publickey".
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: filesystem
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug1: client_input_hostkeys: searching /Users/me/.ssh/known_hosts for 192.168.0.11 / (none)
debug1: client_input_hostkeys: searching /Users/me/.ssh/known_hosts2 for 192.168.0.11 / (none)
debug1: client_input_hostkeys: hostkeys file /Users/me/.ssh/known_hosts2 does not exist
debug1: Remote: /root/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Remote: /root/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Sending environment.
debug1: channel 0: setting env LC_CTYPE = "UTF-8"
debug1: Sending subsystem: sftp
debug1: client_global_hostkeys_private_confirm: server used untrusted RSA signature algorithm ssh-rsa for key 0, disregarding
Learned new hostkey: ECDSA SHA256:5qJ/Mqnn7rX9cHd24TxMmwALdOYCFYZOuwXMDXToXJk
Adding new key for 192.168.0.11 to /Users/me/.ssh/known_hosts: ecdsa-sha2-nistp256 SHA256:5qJ/Mqnn7rX9cHd24TxMmwALdOYCFYZOuwXMDXToXJk
debug1: update_known_hosts: known hosts file /Users/me/.ssh/known_hosts2 does not exist
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype [email protected] reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2772, received 3336 bytes, in 0.9 seconds
Bytes per second: sent 3089.3, received 3717.8
debug1: Exit status 255
添加到~/.ssh/config
Host 192.168.0.11
UpdateHostKeys no
没有帮助，它只是忽略了信息debug1: client_global_hostkeys_private_confirm: server used untrusted RSA signature algorithm ssh-rsa for key 0, disregarding。
为什么它要求known_hosts2？
从 Debian Linux 客户端会出现类似的 RSA 密钥消息。
答案1
我不确定这是否能解决 Thunar/Forklift 问题，但我认为关键问题的根源在于此：
debug1: Local version string SSH-2.0-OpenSSH_9.0
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.6
讯息
debug1: client_global_hostkeys_private_confirm: server used untrusted RSA signature algorithm ssh-rsa for key 0, disregarding .
表明 iSH 对密钥使用 SHA-1 签名算法。这已于 2020 年 8 月 OpenSSH v.8.7 弃用：
OpenSSH 将在下一个版本中默认禁用 ssh-rsa 签名方案。
在 SSH 协议中，“ssh-rsa”签名方案使用 SHA-1 哈希算法与 RSA 公钥算法结合使用。现在可以1花费不到 5 万美元对 SHA-1 算法执行选择前缀攻击。
这并不意味着 RSA 密钥本身已被弃用，在当前版本中它们仅使用 SHA-2 算法：
- RFC8332 RSA SHA-2 签名算法 rsa-sha2-256/512。这些算法的优点是使用与
“ssh-rsa”相同的密钥类型，但使用安全的 SHA-2 哈希算法。这些算法自 OpenSSH 7.2 起已受支持，如果 客户端和服务器支持它们，
则已默认使用它们。
为了解决这个问题，你需要弄清楚如何让 iSH 使用 SHA-2 密钥。GitHub 页面似乎没什么帮助，但是 iSH 应用程序主页链接到开发人员的 Discord 服务器。我会向他们提出这个问题。