☰

无法通过 WAN 进行 ssh

tag-icon • tag-icon networking server 20.04 openssh
无法通过 WAN 进行 ssh

系统：

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.6 LTS
Release:    20.04
Codename:   focal

Openssh 版本：

$ ssh -V
OpenSSH_8.2p1 Ubuntu-4ubuntu0.9, OpenSSL 1.1.1f  31 Mar 2020

问题：

我正在尝试设置 SSH，以便可以通过 WAN（即 Internet）访问它。它在 LAN 上运行没有问题：

% ssh 10.81.1.222 -p 22           
Enter passphrase for key '/Users/userid/.ssh/id_rsa':

但是当我尝试通过 WAN 时失败了。我使用的是 Linksys Velop 网状路由器。我已确认：

  • 我的路由器上的端口 22 被转发到我的服务器 @10.81.1.222 上的端口 22
  • 我的外部 IP 地址使用https://api.ipify.org/
  • 使用“sudo ufw status” ufw 处于非活动状态
  • 服务器@10.81.1.222 已连接互联网（我可以 ping cnn.com）

我尝试了两个不同的互联网提供商：我的 Android 手机作为热点和 Xfinity。后者超时（我读到其他人最近使用 Xfinity 的 ssh 时遇到了问题），前者导致连接被拒绝。我的 ISP 是 AT&T。

Xfinity：

% ssh -v my_userid@###.###.###.### -p 22 
OpenSSH_8.6p1, LibreSSL 3.3.6
debug1: Reading configuration data /Users/my_userid/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to ###.###.###.### [###.###.###.###] port 22.
debug1: connect to address ###.###.###.### port 22: Operation timed out
ssh: connect to host ###.###.###.### port 22: Operation timed out

安卓：

% ssh -v my_userid@###.###.###.### -p 22
OpenSSH_8.6p1, LibreSSL 3.3.6
debug1: Reading configuration data /Users/my_userid/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to ###.###.###.### [###.###.###.###] port 22.
debug1: connect to address ###.###.###.### port 22: Connection refused
ssh: connect to host ###.###.###.### port 22: Connection refused

笔记：

当连接到 Android 时，我的手机仍然连接到路由器，因此它继续起作用：

% ssh 10.81.1.222 -p 22

连接到 Xfinity 并断开手机与路由器的连接后，ping 外部 IP 地址失败：

% ping ###.###.###.###
PING ###.###.###.### (###.###.###.###): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2

有什么建议么？

我在排除故障时清除了 openssh 并重新安装，因此我当前正在使用默认的 sshd_config，但为了完整性我将其粘贴到这里。

#       $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile     .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem       sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

答案1

哎呀！

我已经正确配置了 Linksys 路由器，但我完全忘记了 ISP 的路由器。一旦我将该路由器配置为端口转发到 Linksys 路由器，情况就会好转。

我开始遇到这个问题：

kex_exchange_identification: read: Connection reset by peer

我忘记很久以前在 /etc/hosts.allow 中设置了条目。我将它们替换为：

sshd : ALL

现在一切都很好，除了我的自尊心！

相关内容