我的问题：我无法从我的 Arco Linux PC 连接到外部 SSH 服务器（“Uberspace”和“GitHub”），如果我尝试连接到内部 SSH 服务器，它可以工作，但会退回到密码身份验证。
我使用以下 SSH 客户端/服务器进行测试。
- 本地 SSH 客户端（LinuxPC、MBP、Banana、
- 本地 SSH 服务器（Banana (192.168.1.57) 和 MBP (192.168.1.22)）和
- 用于测试的远程 SSH 服务器（Uberspace (185.26.156.188) 和 GitHub）
我做了以下事情：
通过 ssh-copy-id 将公钥从 LinuxPC 和 MBP 传递到 Banana，并使用其 Web 界面传递到 Uberspace 和 GitHub。从 LinuxPC 到 Uberspace 的 ssh-copy-id 应该是可能的，但会抛出“网络无法访问”。
然后我尝试通过 SSH 密钥身份验证进行连接，结果如下：
LinuxPC -> MBP：即使我之前成功地 ssh-copy-id，仍要求输入密码。密码有效。
LinuxPC -> 香蕉：即使我之前成功地 ssh-copy-id，仍要求输入密码。密码有效。
LinuxPC -> Uberspace：连接被拒绝/网络无法访问
LinuxPC-> GitHub： 连接被拒绝
MBP -> 香蕉: 可以使用公钥验证
MBP -> 优步空间: 可以使用公钥验证
MBP-> GitHub: 可以使用公钥验证
香蕉 -> Uberspace（网络不可达，连接被拒绝）
香蕉 -> MBP（与公钥身份验证一起工作正常）
香蕉 -> GitHub（连接被拒绝）
所以看起来是这样的...
- 外部 SSH 服务器（Uberspace、GitHub）可通过公钥身份验证（来自 MBP）从我的内网连接
- LinuxPC 能够通过密码验证连接到内部服务器（MBP 和 Banana）
- 我无法使用公钥身份验证从 LinuxPC 进行 SSH
- 我无法通过 SSH 从 LinuxPC 连接到外部服务器
我的防火墙已关闭，LinuxPC 和 MBP 连接到同一个路由器 (FritzBox)。路由器中没有特定的设置，因此它对于 LinuxPC、MBP 和 Banana 的行为应该相同。
这ssh_配置来自 LinuxPC 的内容位于本文末尾。是否有遗漏或错误的地方。我没有更改内容。
任何提示或指导都很好
非常感谢！
细节：
香蕉 -> Uberspace
bananapi@BANANA ~ $ ssh -v [email protected]
OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to elst.uberspace.de [185.26.156.188] port 22.
debug1: connect to address 185.26.156.188 port 22: Connection refused
debug1: Connecting to elst.uberspace.de [2a00:d0c0:200:0:b9:1a:9c:8e] port 22.
debug1: connect to address 2a00:d0c0:200:0:b9:1a:9c:8e port 22: Network is unreachable
ssh: connect to host elst.uberspace.de port 22: Network is unreachable
bananapi@BANANA ~ $ ssh-copy-id [email protected]
ssh: connect to host elst.uberspace.de port 22: Network is unreachable
bananapi@BANANA ~ $ nc -vz 95.143.172.245 22
nc: connect to 95.143.172.245 port 22 (tcp) failed: Connection refused
bananapi@BANANA ~ $ nc -vz 185.26.156.188 22
nc: connect to 185.26.156.188 port 22 (tcp) failed: Connection refused
香蕉 -> MBP（好的）
bananapi@BANANA ~ $ ssh-copy-id [email protected]
Now try logging into the machine, with "ssh '[email protected]'", and check in:
~/.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
bananapi@BANANA ~ $ ssh [email protected]
Last login: Tue Jan 12 15:05:18 2021 from 192.168.1.57
The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
LinuxPC -> MBP（仅限密码）
[xxx@Linux-PC ~]$ ssh-copy-id [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxx/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
[xxx@Linux-PC ~]$ ssh [email protected]
Enter passphrase for key '/home/xxx/.ssh/id_rsa':
Password:
Last login: Tue Jan 12 15:34:19 2021 from 192.168.1.54
The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
xxxs-MBP:~ xxx$
注意：即使我之前上传了公钥，它也会要求输入密码
LinuxPC -> Uberspace
[xxx@Linux-PC ~]$ ssh-copy-id [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxx/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: ERROR: ssh: connect to host elst.uberspace.de port 22: Network is unreachable
[xxx@Linux-PC ~]$ ssh -v [email protected]
OpenSSH_8.4p1, OpenSSL 1.1.1i 8 Dec 2020
debug1: Reading configuration data /home/xxx/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to elst.uberspace.de [185.26.156.188] port 22.
debug1: connect to address 185.26.156.188 port 22: Connection refused
debug1: Connecting to elst.uberspace.de [2a00:d0c0:200:0:b9:1a:9c:8e] port 22.
debug1: connect to address 2a00:d0c0:200:0:b9:1a:9c:8e port 22: Network is unreachable
ssh: connect to host elst.uberspace.de port 22: Network is unreachable
[xxx@Linux-PC pw]$ nc -vz 95.143.172.245 22
vega.uberspace.de [95.143.172.245] 22 (ssh): Verbindungsaufbau abgelehnt
(means connection rejected)
[xxx@Linux-PC pw]$ nc -vz 185.26.156.188 22
elst.uberspace.de [185.26.156.188] 22 (ssh): Verbindungsaufbau abgelehnt
(means connection rejected)
LinuxPC -> 香蕉（即使 pub key 上传成功也要求输入密码）
[xxx@Linux-PC ~]$ ssh-copy-id -f [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xxx/.ssh/id_rsa.pub"
Enter passphrase for key '/home/xxx/.ssh/id_rsa':
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
[xxx@Linux-PC ~]$ ssh -v [email protected]
OpenSSH_8.4p1, OpenSSL 1.1.1i 8 Dec 2020
debug1: Reading configuration data /home/xxx/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to 192.168.1.57 [192.168.1.57] port 22.
debug1: Connection established.
debug1: identity file /home/xxx/.ssh/id_rsa type 0
debug1: identity file /home/xxx/.ssh/id_rsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_dsa type -1
debug1: identity file /home/xxx/.ssh/id_dsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/xxx/.ssh/id_ed25519 type -1
debug1: identity file /home/xxx/.ssh/id_ed25519-cert type -1
debug1: identity file /home/xxx/.ssh/id_ed25519_sk type -1
debug1: identity file /home/xxx/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/xxx/.ssh/id_xmss type -1
debug1: identity file /home/xxx/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4+deb7u2
debug1: match: OpenSSH_6.0p1 Debian-4+deb7u2 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.1.57:22 as 'bananapi'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes128-ctr MBP: [email protected] compression: none
debug1: kex: client->server cipher: aes128-ctr MBP: [email protected] compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:q+j2dQzHWPbthWX4VCK4UK7GDwccoGGZZDSBr4Hl4HE
debug1: Host '192.168.1.57' is known and matches the ECDSA host key.
debug1: Found key in /home/xxx/.ssh/known_hosts:1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 4294967296 blocks
debug1: Will attempt key: /home/xxx/.ssh/id_rsa RSA SHA256:XDOacvuprzkByJY1ZpGjZN2anPeYVeNkN7v5P6TuBBw
debug1: Will attempt key: /home/xxx/.ssh/id_dsa
debug1: Will attempt key: /home/xxx/.ssh/id_ecdsa
debug1: Will attempt key: /home/xxx/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519
debug1: Will attempt key: /home/xxx/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/xxx/.ssh/id_xmss
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/xxx/.ssh/id_rsa RSA SHA256:XDOacvuprzkByJY1ZpGjZN2anPeYVeNkN7v5P6TuBBw
debug1: Server accepts key: /home/xxx/.ssh/id_rsa RSA SHA256:XDOacvuprzkByJY1ZpGjZN2anPeYVeNkN7v5P6TuBBw
Enter passphrase for key '/home/xxx/.ssh/id_rsa':
debug1: Trying private key: /home/xxx/.ssh/id_dsa
debug1: Trying private key: /home/xxx/.ssh/id_ecdsa
debug1: Trying private key: /home/xxx/.ssh/id_ecdsa_sk
debug1: Trying private key: /home/xxx/.ssh/id_ed25519
debug1: Trying private key: /home/xxx/.ssh/id_ed25519_sk
debug1: Trying private key: /home/xxx/.ssh/id_xmss
debug1: Next authentication method: password
[email protected]'s password:
debug1: Authentication succeeded (password).
Authenticated to 192.168.1.57 ([192.168.1.57]:22).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: pledge: network
Linux BANANA 3.4.103 #1 SMP PREEMPT Thu Dec 18 13:07:12 CST 2014 armv7l
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
bananapi@BANANA ~ $
MBP -> Uberspace（好的）
xxxs-MBP:~ xxx$ ssh-copy-id -f [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/xxx/.ssh/id_rsa.pub"
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
xxxs-MBP:~ xxx$ ssh [email protected]
Last login: Tue Jan 12 14:21:29 2021 from 212.18.221.64
Welcome to Uberspace 7!
Current version: 7.8.1.0
Manual: https://manual.uberspace.de/en/
Watch out for changes at: https://manual.uberspace.de/en/changelog.html
Follow us on Twitter for updates: https://twitter.com/ubernauten
Is something unclear or does not work as expected?
=> check the server status: https://is.uberspace.online
=> reach out to our team: [email protected]
[xxxnc@elst ~]$
/etc/ssh/ssh_config
# $OpenBSD: ssh_config,v 1.35 2020/07/17 03:43:42 dtucker Exp $
# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.
# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.
# Site-wide defaults for some commonly used options. For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.
# Host *
# ForwardAgent no
# ForwardX11 no
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# IdentityFile ~/.ssh/id_ecdsa
# IdentityFile ~/.ssh/id_ed25519
# Port 22
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,[email protected]
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
# ProxyCommand ssh -q -W %h:%p gateway.example.com
# RekeyLimit 1G 1h
# UserKnownHostsFile ~/.ssh/known_hosts.d/%k
答案1
解决了。路由器阻止了连接。我没想到笔记本电脑（Wifi）和个人电脑（LAN）有不同的设置。