☰

SSH 连接问题：ssh_exchange_identification：连接被远程主机关闭

tag-icon • tag-icon ssh
SSH 连接问题：ssh_exchange_identification：连接被远程主机关闭

我在使用 sshdesktop1从（图中的红色箭头）连接到（参见下图）时遇到问题。server它总是说：

ssh_exchange_identification: Connection closed by remote host

desktop1我从或连接到服务器没有任何问题，连接到from或从to连接desktop2也没有任何问题，反之亦然。desktop2serverdesktop1desktop2

服务器和桌面之间的ssh连接问题1

我尝试通过创建临时 sshd 服务器来解决该问题，desktop1如下所示：

[desktop1]# $(which sshd) -Ddddp 4000

并从以下位置连接到它server：

[server]# ssh -v -p 4000 root@desktop1
OpenSSH_7.1p2, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 4000 desktop1
debug1: permanently_set_uid: 0/0
debug1: permanently_drop_suid: 0
debug1: identity file /root/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type 2
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.1
ssh_exchange_identification: Connection closed by remote host
#

这是行不通的。

但从 开始desktop2，连接工作正常：

[desktop2]# ssh -v -p 4000 root@desktop1
OpenSSH_7.1p2, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 4000 desktop1
debug1: permanently_set_uid: 0/0
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client [email protected] <implicit> none
debug1: kex: client->server [email protected] <implicit> none
debug1: kex: [email protected] need=64 dh_need=64
debug1: kex: [email protected] need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
[...]
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Last login: Mon Mar  7 15:24:05 2016 from 10.0.21.200
Environment:
  LANG=en_US.UTF-8
  USER=root
  LOGNAME=root
  HOME=/root
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
  MAIL=/var/mail/root
  SHELL=/bin/bash
  SSH_CLIENT=10.0.21.200 39150 4000
  SSH_CONNECTION=10.0.21.200 39150 10.0.21.204 4000
  SSH_TTY=/dev/pts/1
  TERM=xterm-256color
  DISPLAY=localhost:11.0
Running /usr/bin/xauth remove unix:11.0
/usr/bin/xauth add unix:11.0 MIT-MAGIC-COOKIE-1 2843404fd74f1294efce8c6bb786fd75

和上的文件/etc/ssh/sshd_config相同。desktop1desktop2

root 的公钥/私钥在server、desktop1和上是相同的desktop2。

所有 3 台机器上的权限都正常，如下所示：

# ll .ssh/
total 24
-rw-------  1 root root 1883 Nov  6 09:33 authorized_keys
-rw-------. 1 root root  668 Jan 26  2015 id_dsa
-rw-r--r--. 1 root root  620 Jan 26  2015 id_dsa.pub
-rw-------. 1 root root  887 Jan 26  2015 id_rsa
-rw-r--r--. 1 root root  240 Jan 26  2015 id_rsa.pub
-rw-r--r--. 1 root root 1893 Nov  5 10:31 known_hosts

Traceroute 从以下位置找到两个桌面server：

[server]# traceroute -T -p 22 desktop1
traceroute to desktop1 (10.0.21.204), 30 hops max, 60 byte packets
 1  gateway (10.0.21.30)  0.704 ms  0.874 ms  1.041 ms
 2  desktop1 (10.0.21.204)  0.325 ms  0.438 ms  0.407 m
[server]#
[server]# traceroute -T -p 22 desktop1
traceroute to desktop2 (10.0.21.200), 30 hops max, 60 byte packets
 1  gateway (10.0.21.30)  0.847 ms  0.985 ms  1.158 ms
 2  desktop2 (10.0.21.200)  0.286 ms  0.310 ms  0.314 ms

那么，这个 ID 交换问题的原因可能是什么：ssh_exchange_identification: Connection closed by remote host？

感谢您的帮助。

问候，富士。

答案1

您的问题可能是由以下原因引起的：

debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 4000 desktop1

编辑 /etc/ssh/ssh_config 并注释 ProxyCommand 行。我在将客户端加入 FreeIPA 时遇到过这种情况。

答案2

这是已知问题（可能在 中kernel），跟踪为rhbz#1313979

引导旧内核（例如kernel 4.3.5-300.fc23.x86_64）应该可以解决该问题（作为解决方法）。欢迎在此处或 bugzilla 中进行更多调查。

答案3

重新启动 dnsmasq 可解决此问题：

sudo launchctl stop homebrew.mxcl.dnsmasq
sudo launchctl start homebrew.mxcl.dnsmasq

相关内容