端口已打开,但我无法 ssh 访问它

端口已打开,但我无法 ssh 访问它

我公司的电脑位于防火墙后面,我想连接到我的远程服务器。端口已打开,但我无法连接到它,有人知道根本原因吗?

从我公司的 PC 连接到我的远程服务器:

# telnet my-server 2221
Trying x.x.x.x...
Connected to my-server.
Escape character is '^]'.
^C^C^C
# nc -vzw5 my-server 2221
Connection to my-server 2221 port [tcp/rockwell-csp1] succeeded!
# ssh -vvv my-server -p 2221
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /root/.ssh/config
debug1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to my-server [x.x.x.x] port 2221.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/identity-cert type -1
debug3: Not a RSA1 key file /root/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /root/.ssh/id_rsa type 1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
^C

该过程将永远卡住。

但同时,我检查远程服务器状态,我可以清楚地看到连接已经建立:

# netstat -at
tcp        0    402 myserver:ssh             x.x.x.x:11307     ESTABLISHED

过了一会儿,连接状态会变为FIN_WAIT1,然后关闭:

 # netstat -at
    tcp        0    402 myserver:ssh             x.x.x.x:11307     FIN_WAIT1

客户端发起连接请求时,服务器端进行Tcpdump:

# tcpdump -i ppp0 port 2221 -vv
tcpdump: listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
12:09:01.408239 IP (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    server_ip.2221 > client_ip.20999: Flags [S.], cksum 0x21e6 (correct), seq 2805531925, ack 581774329, win 14400, options [mss 1452,sackOK,TS val 9959078 ecr 74287789,nop,wscale 4], length 0
12:09:01.424747 IP (tos 0x0, ttl 50, id 41302, offset 0, flags [DF], proto TCP (6), length 52)
    client_ip.20999 > server_ip.2221: Flags [.], cksum 0x8711 (correct), seq 1, ack 1, win 457, options [nop,nop,TS val 74287802 ecr 9959078], length 0
12:09:01.448272 IP (tos 0x10, ttl 64, id 62398, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5dba (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9959082 ecr 74287802], length 402
12:09:01.674641 IP (tos 0x10, ttl 64, id 62399, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5da3 (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9959105 ecr 74287802], length 402
12:09:01.904523 IP (tos 0x10, ttl 64, id 62400, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5d8c (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9959128 ecr 74287802], length 402
12:09:02.364225 IP (tos 0x10, ttl 64, id 62401, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5d5e (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9959174 ecr 74287802], length 402
12:09:03.283694 IP (tos 0x10, ttl 64, id 62402, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5d02 (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9959266 ecr 74287802], length 402
12:09:05.122593 IP (tos 0x10, ttl 64, id 62403, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5c4a (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9959450 ecr 74287802], length 402
12:09:08.810407 IP (tos 0x10, ttl 64, id 62404, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5ad9 (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9959819 ecr 74287802], length 402
12:09:15.006311 IP (tos 0x10, ttl 64, id 17769, offset 0, flags [DF], proto TCP (6), length 52)
    server_ip.2221 > client_ip.4708: Flags [F.], cksum 0x0499 (correct), seq 1497941342, ack 2936162453, win 900, options [nop,nop,TS val 9960438 ecr 74001029], length 0
12:09:16.176090 IP (tos 0x10, ttl 64, id 62405, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x57f8 (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9960556 ecr 74287802], length 402
12:09:30.927316 IP (tos 0x10, ttl 64, id 62406, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x5234 (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9962032 ecr 74287802], length 402
12:10:00.429743 IP (tos 0x10, ttl 64, id 62407, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x46ac (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9964984 ecr 74287802], length 402
12:10:59.354673 IP (tos 0x10, ttl 64, id 62408, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x2fa4 (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9970880 ecr 74287802], length 402
12:12:57.364324 IP (tos 0x10, ttl 64, id 62409, offset 0, flags [DF], proto TCP (6), length 454)
    server_ip.2221 > client_ip.20999: Flags [P.], cksum 0x0184 (correct), seq 1:403, ack 1, win 900, options [nop,nop,TS val 9982688 ecr 74287802], length 402
12:14:01.653934 IP (tos 0x10, ttl 64, id 62410, offset 0, flags [DF], proto TCP (6), length 52)
    server_ip.2221 > client_ip.20999: Flags [F.], cksum 0x0e69 (correct), seq 403, ack 1, win 900, options [nop,nop,TS val 9989120 ecr 74287802], length 0

答案1

debug1: Connection established.
[...]
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
^C

当客户端连接到 SSH 服务器时,第一个数据交换是服务器和客户端相互发送版本字符串。 OpenSSH 客户端通常会在身份文件列表之后立即记录此信息,例如在我的系统中:

[...]
debug1: identity file /home/devuser/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2

您的客户端从未记录从服务器接收 SSH 版本字符串。可能发生以下三件事之一:

  1. 防火墙或类似的东西会阻止或丢弃从服务器到客户端的 TCP 数据包。
  2. 客户端正在连接到 SSH 服务器,但出现故障。
  3. 客户端正在连接到 ssh 服务器以外的其他服务器。

您需要在服务器上解决此问题。 OpenSSH 服务器通过 syslog 进行日志记录。您应该首先检查 syslog 日志,看看 sshd 是否记录了有关连接尝试的任何内容。

答案2

也许你的钥匙有问题?您可以尝试使用用户名和密码登录,以确保它不是密钥。如果 sshd 设置为仅接受密钥,则这将不起作用。这是一个例子

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -p 2221 username@my-server

答案3

检查您的文件的权限~/.ssh/authorized_keys。他们应该是0600。

检查主 (~) 目录的权限,而不仅仅是目录~/.ssh

或者,您可以创建一组新的密钥并尝试:

  • ssh-keygen -t rsa
  • Enter file in which to save the key (/home/demo/.ssh/id_rsa):Enter
  • Enter passphrase (empty for no passphrase):Enter

它看起来像这样:

ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/demo/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/demo/.ssh/id_rsa.
Your public key has been saved in /home/demo/.ssh/id_rsa.pub.
The key fingerprint is:
4a:dd:0a:c6:35:4e:3f:ed:27:38:8c:74:44:4d:93:67 demo@a
The key's randomart image is:
+--[ RSA 2048]----+
|          .oo.   |
|         .  o.E  |
|        + .  o   |
|     . = = .     |
|      = S = .    |
|     o + = +     |
|      . o + o .  |
|           . o   |
|                 |
+-----------------+

钥匙id_rsa将是:

-----BEGIN RSA PRIVATE KEY-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END RSA PRIVATE KEY-----

检查其完整性并重试。

相关内容