☰

SSH：从没有 shell 的用户进行 ProxyJump

tag-icon • tag-icon ssh openssh ssh-tunneling
SSH：从没有 shell 的用户进行 ProxyJump

我有一个系统syncoid用户

$ cat /etc/passwd
syncoid:x:993:990::/var/lib/syncoid:/run/current-system/sw/bin/nologin

使用以下 ssh 配置：

$ cat /var/lib/syncoid/.ssh/config
Host eve
  User other
  HostName 192.168.10.1
  ProxyJump jumphost
  IdentityFile /var/lib/syncoid/.ssh/eve-syncoid
Host jumphost
  ForwardAgent yes
  User me
  HostName 192.168.1.1
  IdentityFile /var/lib/syncoid/.ssh/eve-syncoid

我可以使用 来连接并登录 Jumphost sudo -u syncoid ssh jumphost。但是，eve与服务器的连接sudo -u syncoid ssh -vvv eve会导致

OpenSSH_8.8p1, OpenSSL 1.1.1m  14 Dec 2021
debug1: Reading configuration data /var/lib/syncoid/.ssh/config
debug1: /var/lib/syncoid/.ssh/config line 1: Applying options for eve
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 5: Applying options for *
debug2: resolve_canonicalize: hostname 192.168.10.1 is address
debug1: Setting implicit ProxyCommand from ProxyJump: ssh -vvv -W '[%h]:%p' jumphost
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/var/lib/syncoid/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/var/lib/syncoid/.ssh/known_hosts2'
debug1: Executing proxy command: exec ssh -vvv -W '[192.168.10.1]:22' jumphost
debug1: identity file /var/lib/syncoid/.ssh/eve-syncoid type 0
debug1: identity file /var/lib/syncoid/.ssh/eve-syncoid-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.8
debug1: kex_exchange_identification: banner line 0: This account is currently not available.
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

我是否需要具有 shell 的普通用户来执行 ProxyJump？

编辑：

  • 无需 ProxyJump 即可通过 VPN登录eve，因此密钥和配置一切正确。
  • 我创建了一个具有相同密钥/配置的普通用户，并且 ProxyJump 可以正常工作。

答案1

这实际上不是 ProxyJump 问题 - 该服务是一个强化的 systemd 服务，具有有限的 RootDirectory，因此它无法访问私有 ssh 密钥。

带有私钥的文件夹必须添加到BindReadonlyPaths以下位置这个github评论

config.services.syncoid.service.serviceConfig.BindReadOnlyPaths = [ 
  "/var/lib/syncoid/.ssh" 
];

进一步评论后，这将得到解决通过这个拉取请求将来。

答案2

这实际上是 NixOS 中的syncoid服务定义过于严格的问题。我不得不覆盖

systemd.services."syncoid-rpool-user-home" = {
    serviceConfig = {
      ProtectHome = lib.mkForce false;
      StateDirectory = lib.mkForce "";
      RootDirectory = lib.mkForce "";
    };
};

相关内容