![SSH:从没有 shell 的用户进行 ProxyJump](https://linux22.com/image/202397/SSH%EF%BC%9A%E4%BB%8E%E6%B2%A1%E6%9C%89%20shell%20%E7%9A%84%E7%94%A8%E6%88%B7%E8%BF%9B%E8%A1%8C%20ProxyJump.png)
我有一个系统syncoid
用户
$ cat /etc/passwd
syncoid:x:993:990::/var/lib/syncoid:/run/current-system/sw/bin/nologin
使用以下 ssh 配置:
$ cat /var/lib/syncoid/.ssh/config
Host eve
User other
HostName 192.168.10.1
ProxyJump jumphost
IdentityFile /var/lib/syncoid/.ssh/eve-syncoid
Host jumphost
ForwardAgent yes
User me
HostName 192.168.1.1
IdentityFile /var/lib/syncoid/.ssh/eve-syncoid
我可以使用 来连接并登录 Jumphost sudo -u syncoid ssh jumphost
。但是,eve
与服务器的连接sudo -u syncoid ssh -vvv eve
会导致
OpenSSH_8.8p1, OpenSSL 1.1.1m 14 Dec 2021
debug1: Reading configuration data /var/lib/syncoid/.ssh/config
debug1: /var/lib/syncoid/.ssh/config line 1: Applying options for eve
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 5: Applying options for *
debug2: resolve_canonicalize: hostname 192.168.10.1 is address
debug1: Setting implicit ProxyCommand from ProxyJump: ssh -vvv -W '[%h]:%p' jumphost
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/var/lib/syncoid/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/var/lib/syncoid/.ssh/known_hosts2'
debug1: Executing proxy command: exec ssh -vvv -W '[192.168.10.1]:22' jumphost
debug1: identity file /var/lib/syncoid/.ssh/eve-syncoid type 0
debug1: identity file /var/lib/syncoid/.ssh/eve-syncoid-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.8
debug1: kex_exchange_identification: banner line 0: This account is currently not available.
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535
我是否需要具有 shell 的普通用户来执行 ProxyJump?
编辑:
- 无需 ProxyJump 即可通过 VPN登录
eve
,因此密钥和配置一切正确。 - 我创建了一个具有相同密钥/配置的普通用户,并且 ProxyJump 可以正常工作。
答案1
这实际上不是 ProxyJump 问题 - 该服务是一个强化的 systemd 服务,具有有限的 RootDirectory,因此它无法访问私有 ssh 密钥。
带有私钥的文件夹必须添加到BindReadonlyPaths
以下位置这个github评论
config.services.syncoid.service.serviceConfig.BindReadOnlyPaths = [
"/var/lib/syncoid/.ssh"
];
进一步评论后,这将得到解决通过这个拉取请求将来。
答案2
这实际上是 NixOS 中的syncoid服务定义过于严格的问题。我不得不覆盖
systemd.services."syncoid-rpool-user-home" = {
serviceConfig = {
ProtectHome = lib.mkForce false;
StateDirectory = lib.mkForce "";
RootDirectory = lib.mkForce "";
};
};