我在 Windows Server 2019 上设置了 OpenSSH 7.7。截至撰写本文时，该盒子已更新。昨天下班时，我测试了使用 SFTP 连接到该盒子，使用管理员帐户和为供应商创建的受限帐户，两者都能够连接和传输文件。
今天早上，我尝试使用 SFTP 登录，但两次登录均因身份验证错误而被拒绝。如果我尝试从命令行使用 ssh，也会发生同样的事情。sshd_log条目只是说
3416 2021-08-18 10:25:08.957 Connection from XX.XX.XX.XX port 48119 on 172.31.49.52 port 22
3416 2021-08-18 10:25:10.754 Failed password for invalid user don-admin from XX.XX.XX.XX port 48119 ssh2
3416 2021-08-18 10:25:10.832 Connection closed by invalid user don-admin XX.XX.XX.XX port 48119 [preauth]
（顺便说一下，管理员帐户与我用于 RDP 进入盒子的帐户相同，所以我确定帐户没有被意外更改或禁用。）我尝试重新启动OpenSSH SSH 服务器和OpenSSH 身份验证代理服务，但无效。
当然，我昨晚没有更改任何东西。我检查了昨晚是否有任何自动更新，结果没有，而且自动更新已禁用，正如我所希望的那样。此框尚未投入生产，据我在安全事件日志中看到，在我的连接之间没有其他人类用户登录。
然后，大约 50 分钟后，我还没有做任何更改，sshd_log对于部分（但不是全部） SFTP 尝试，条目已更改为如下形式：
4628 2021-08-18 10:53:54.007 Connection from XX.XX.XX.XX port 34996 on 172.31.49.52 port 22
4628 2021-08-18 10:53:55.538 Failed publickey for sftpuser from XX.XX.XX.XX port 34996 ssh2: ED25519 SHA256:xxxxxxxxxxxxxxxx
4628 2021-08-18 10:53:55.694 Accepted password for sftpuser from XX.XX.XX.XX port 34996 ssh2
4628 2021-08-18 10:53:55.726 User child is on pid 3612
2860 2021-08-18 10:54:01.398 Connection from XX.XX.XX.XX port 43896 on 172.31.49.52 port 22
2860 2021-08-18 10:54:01.960 Failed password for invalid user sftpuser from XX.XX.XX.XX port 43896 ssh2
2860 2021-08-18 10:54:02.038 Connection closed by invalid user sftpuser XX.XX.XX.XX port 43896 [preauth]
然后，大约 25 分钟后，在我未做任何更改的情况下，SFTP 的一切又开始正常工作。昨天早上也发生了同样的情况，但由于当时我还在调整配置，所以我假设这是原因；但现在我想是这个原因造成的。这几乎就像 OpenSSH 需要在早上醒来并预热才能正常工作一样。
由于一旦我们投入生产，SFTP 站点就需要供我们的供应商日常使用，因此我真的需要弄清楚发生了什么以及如何解决它，但我完全不知道这里还有什么可以看的。有人可以提出解释吗，或者至少可以尝试下一步如何诊断这个问题？
[更新]
几个小时后，我还没有做任何更改，连接就再次停止工作，并且再次尝试遇到身份验证错误。
[更新]
这里有调试失败尝试的级别日志条目：
2924 2021-08-18 16:57:59.653 debug1: inetd sockets after dupping: 3, 3
2924 2021-08-18 16:57:59.653 Connection from 97.115.151.126 port 47632 on 172.31.49.52 port 22
2924 2021-08-18 16:57:59.653 debug1: Client protocol version 2.0; client software version FileZilla_3.55.1
2924 2021-08-18 16:57:59.653 debug1: no match: FileZilla_3.55.1
2924 2021-08-18 16:57:59.653 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
2924 2021-08-18 16:57:59.685 debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
2924 2021-08-18 16:57:59.685 debug1: SSH2_MSG_KEXINIT sent [preauth]
2924 2021-08-18 16:57:59.731 debug1: SSH2_MSG_KEXINIT received [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: algorithm: curve25519-sha256 [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: host key algorithm: ssh-ed25519 [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
2924 2021-08-18 16:57:59.731 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
2924 2021-08-18 16:57:59.809 debug1: rekey after 4294967296 blocks [preauth]
2924 2021-08-18 16:57:59.809 debug1: SSH2_MSG_NEWKEYS sent [preauth]
2924 2021-08-18 16:57:59.809 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
2924 2021-08-18 16:57:59.903 debug1: SSH2_MSG_NEWKEYS received [preauth]
2924 2021-08-18 16:57:59.903 debug1: rekey after 4294967296 blocks [preauth]
2924 2021-08-18 16:57:59.903 debug1: KEX done [preauth]
2924 2021-08-18 16:57:59.981 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method none [preauth]
2924 2021-08-18 16:57:59.981 debug1: attempt 0 failures 0 [preauth]
2924 2021-08-18 16:57:59.981 debug1: user n matched group list solutionwhere at line 86
2924 2021-08-18 16:57:59.981 debug1: get_passwd: LookupAccountName() failed: 1332.
2924 2021-08-18 16:57:59.981 debug1: Can't match group at line 93 because user n does not exist
2924 2021-08-18 16:58:00.059 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method publickey [preauth]
2924 2021-08-18 16:58:00.059 debug1: attempt 1 failures 0 [preauth]
2924 2021-08-18 16:58:00.059 debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog [preauth]
2924 2021-08-18 16:58:00.138 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method keyboard-interactive [preauth]
2924 2021-08-18 16:58:00.138 debug1: attempt 2 failures 1 [preauth]
2924 2021-08-18 16:58:00.138 debug1: keyboard-interactive devs [preauth]
2924 2021-08-18 16:58:00.138 debug1: auth2_challenge: user=wisdomwhere-sftp devs= [preauth]
2924 2021-08-18 16:58:00.138 debug1: kbdint_alloc: devices '' [preauth]
2924 2021-08-18 16:58:00.231 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method password [preauth]
2924 2021-08-18 16:58:00.231 debug1: attempt 3 failures 2 [preauth]
2924 2021-08-18 16:58:00.231 debug1: Windows authentication failed for user: NOUSER domain: . error: 1326
2924 2021-08-18 16:58:00.231 Failed password for invalid user wisdomwhere-sftp from 97.115.151.126 port 47632 ssh2
2924 2021-08-18 16:58:00.309 Connection closed by invalid user wisdomwhere-sftp 97.115.151.126 port 47632 [preauth]
2924 2021-08-18 16:58:00.309 debug1: do_cleanup [preauth]
2924 2021-08-18 16:58:00.309 debug1: monitor_read_log: child log fd closed
2924 2021-08-18 16:58:00.309 debug1: do_cleanup
2924 2021-08-18 16:58:00.309 debug1: Killing privsep child 3476
以下是调试几分钟后，成功连接的级别日志条目（请记住，有不两次尝试之间两端的配置发生变化）：
3188 2021-08-18 17:15:43.726 debug1: inetd sockets after dupping: 3, 3
3188 2021-08-18 17:15:43.726 Connection from 97.115.151.126 port 43761 on 172.31.49.52 port 22
3188 2021-08-18 17:15:43.726 debug1: Client protocol version 2.0; client software version FileZilla_3.55.1
3188 2021-08-18 17:15:43.726 debug1: no match: FileZilla_3.55.1
3188 2021-08-18 17:15:43.726 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
3188 2021-08-18 17:15:43.758 debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
3188 2021-08-18 17:15:43.758 debug1: SSH2_MSG_KEXINIT sent [preauth]
3188 2021-08-18 17:15:43.804 debug1: SSH2_MSG_KEXINIT received [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: algorithm: curve25519-sha256 [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: host key algorithm: ssh-ed25519 [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
3188 2021-08-18 17:15:43.804 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
3188 2021-08-18 17:15:43.883 debug1: rekey after 4294967296 blocks [preauth]
3188 2021-08-18 17:15:43.883 debug1: SSH2_MSG_NEWKEYS sent [preauth]
3188 2021-08-18 17:15:43.883 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
3188 2021-08-18 17:15:43.976 debug1: SSH2_MSG_NEWKEYS received [preauth]
3188 2021-08-18 17:15:43.976 debug1: rekey after 4294967296 blocks [preauth]
3188 2021-08-18 17:15:43.976 debug1: KEX done [preauth]
3188 2021-08-18 17:15:44.054 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method none [preauth]
3188 2021-08-18 17:15:44.054 debug1: attempt 0 failures 0 [preauth]
3188 2021-08-18 17:15:44.054 debug1: user wisdomwhere-sftp matched group list solutionwhere at line 86
3188 2021-08-18 17:15:44.054 debug1: user wisdomwhere-sftp does not match group list administrators at line 93
3188 2021-08-18 17:15:44.133 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method publickey [preauth]
3188 2021-08-18 17:15:44.133 debug1: attempt 1 failures 0 [preauth]
3188 2021-08-18 17:15:44.133 debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog [preauth]
3188 2021-08-18 17:15:44.133 debug1: trying public key file C:\\Users\\wisdomwhere-sftp\\.ssh/authorized_keys
3188 2021-08-18 17:15:44.133 debug1: Could not open authorized keys 'C:\\Users\\wisdomwhere-sftp\\.ssh/authorized_keys': No such file or directory
3188 2021-08-18 17:15:44.133 Failed publickey for wisdomwhere-sftp from 97.115.151.126 port 43761 ssh2: ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog
3188 2021-08-18 17:15:44.211 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method keyboard-interactive [preauth]
3188 2021-08-18 17:15:44.211 debug1: attempt 2 failures 1 [preauth]
3188 2021-08-18 17:15:44.211 debug1: keyboard-interactive devs [preauth]
3188 2021-08-18 17:15:44.211 debug1: auth2_challenge: user=wisdomwhere-sftp devs= [preauth]
3188 2021-08-18 17:15:44.211 debug1: kbdint_alloc: devices '' [preauth]
3188 2021-08-18 17:15:44.289 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method password [preauth]
3188 2021-08-18 17:15:44.289 debug1: attempt 3 failures 2 [preauth]
3188 2021-08-18 17:15:44.304 Accepted password for wisdomwhere-sftp from 97.115.151.126 port 43761 ssh2
3188 2021-08-18 17:15:44.304 debug1: monitor_child_preauth: wisdomwhere-sftp has been authenticated by privileged process
3188 2021-08-18 17:15:44.304 debug1: monitor_read_log: child log fd closed
3188 2021-08-18 17:15:44.320 User child is on pid 5716
第 22 行是它们分歧的地方...失败的尝试不再引用user wisdomwhere-sftp并开始引用user n。这可能是什么原因造成的？
答案1
这似乎是一个漏洞在Windows 版本的 OpenSSH。我建议升级到 Win32-OpenSSH 版本 8.0.0.1 或更新版本。