Я наткнулся на кучу документации по этой проблеме в google / stack. но не нашел никакого решения
У меня в локальной сети есть ssh-сервер raspberry pi, с которого я хочу использовать ssh из Интернета (вне локальной сети).
Я могу использовать ssh локально (LAN), но если ssh использует общедоступный IP-адрес / открытый порт (изнутри LAN / из моего офиса), он отказывает в соединении.
топология моей сети-
ISP ______(ethernet)> tpLink Router (port forwarded) --------- > raspberry pi (wifi connected with static ip)
I ' Я легко могу подключиться к ssh-серверу локально с паролем. но когда ssh с моим общедоступным IP-адресом (из LAN / вне LAN с использованием putty)
ssh -v pi@public.ip -p 8291 или pi@public.ip порт 8291
, он застревает на ": Строка локальной версии SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 "
и через одну или две минуты выдает « ssh_exchange_identification: соединение закрыто удаленным хостом »
другие открытые порты дают тот же результат, но Быстрее.
(подробности)
ssh -v pi@public.ip -p 8291
OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g 1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to public.ip [public.ip] port 8291.
debug1: Connection established. # that does mean connection established once
debug1: identity file /home/ph03n1x/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ph03n1x/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2 # gets stuck at this stage even with -vvv no debug messgage and ends with following
ssh_exchange_identification: Connection closed by remote host
Я проверил свой сервер auth.log, похоже, нет никаких следов попытки регистрации. вот несколько полезных деталей моей сети netstat -tupan:
sudo netstat -tupan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8291 0.0.0.0:* LISTEN 1094/sshd
tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 1094/sshd
tcp 0 92 192.168.0.117:8291 ESTABLISHED 939/sshd: pi [priv]
udp 0 0 0.0.0.0:68 0.0.0.0:* 394/dhcpcd
udp 0 0 192.168.0.101:123 0.0.0.0:* 515/ntpd
udp 0 0 192.168.0.117:123 0.0.0.0:* 515/ntpd # raspberry pi with static ip
udp 0 0 127.0.0.1:123 0.0.0.0:* 515/ntpd
udp 0 0 0.0.0.0:123 0.0.0.0:* 515/ntpd
udp 0 0 0.0.0.0:5353 0.0.0.0:* 378/avahi-daemon: r
udp 0 0 0.0.0.0:48445 0.0.0.0:* 378/avahi-daemon: r
udp6 0 0 fe80::1c85:89ee:956:123 :::* 515/ntpd
udp6 0 0 ::1:123 :::* 515/ntpd
udp6 0 0 :::123 :::* 515/ntpd
udp6 0 0 :::5353 :::* 378/avahi-daemon: r
udp6 0 0 :::51513 :::* 378/avahi-daemon: r
Конфигурация sshd:
# Package generated configuration file
# See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
#Port 22
# changed to following ===============
Port 8291
Port 8000
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
# should I listen of the gateway 192.168.0.1 ?? ? ?
ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024
# Logging
SyslogFacility AUTH
LogLevel INFO
# Authentication:
LoginGraceTime 120
PermitRootLogin without-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes
# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
# is there anything to do with this ? ? ?
#MaxStartups 10:30:60
#Banner /etc/issue.net
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
журнал авторизации после удаленной попытки, а затем у меня ssh из локальной сети ubuntu box, который зарегистрирован здесь (подробности):
Aug 7 08:06:59 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Aug 7 08:06:59 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Aug 7 08:17:01 raspberrypi CRON[1329]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 7 08:17:01 raspberrypi CRON[1329]: pam_unix(cron:session): session closed for user root
Aug 7 08:36:33 raspberrypi sshd[956]: Received disconnect from 192.168.0.13: 11: disconnected by user
Aug 7 08:36:33 raspberrypi sshd[939]: pam_unix(sshd:session): session closed for user pi
Aug 7 08:36:33 raspberrypi systemd-logind[372]: Removed session c3.
Aug 7 08:36:50 raspberrypi sshd[1374]: Connection closed by 192.168.0.13 [preauth]
Aug 7 08:17:05 raspberrypi systemd-logind[360]: New seat seat0.
Aug 7 08:17:05 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8000.
Aug 7 08:17:05 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8291.
Aug 7 08:17:07 raspberrypi login[564]: pam_unix(login:session): session opened for user pi by LOGIN(uid=0)
Aug 7 08:17:07 raspberrypi sshd[469]: Received SIGHUP; restarting.
Aug 7 08:17:07 raspberrypi systemd: pam_unix(systemd-user:session): session opened for user pi by (uid=0)
Aug 7 08:17:07 raspberrypi systemd-logind[360]: New session c1 of user pi.
Aug 7 08:17:07 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8000.
Aug 7 08:17:07 raspberrypi sshd[469]: Server listening on 0.0.0.0 port 8291.
Aug 7 08:17:08 raspberrypi lightdm: pam_unix(lightdm-autologin:session): session opened for user pi by (uid=0)
Aug 7 08:17:08 raspberrypi systemd-logind[360]: New session c2 of user pi.
Aug 7 08:17:10 raspberrypi polkitd(authority=local): Registered Authentication Agent for unix-session:c2 (system bus name :1.7 [lxpolkit], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_GB.UTF-8)
Aug 7 14:23:36 raspberrypi sshd[974]: Accepted password for pi from 192.168.0.13 port 42446 ssh2
Aug 7 14:23:36 raspberrypi sshd[974]: pam_unix(sshd:session): session opened for user pi by (uid=0)
Aug 7 14:23:36 raspberrypi systemd-logind[360]: New session c3 of user pi.
Позже я обнаружил, что между я и мой интернет-провайдер, а не прямой публичный IP (обратите внимание на панель tplink). Есть ли у него дела в этом отношении?
MAC Address: hex-hex-hex...
IP Address: 192.168.120.231 PPPoE
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.120.231
DNS Server: 123.456.789.000 , 8.8.4.4
Online Time: 0 day(s) 03:49:20
Мой брандмауэр unix выключен, и iptables -L выводит простой результат. Итак, как я могу решить проблему?
ငါအရင်ကလည်းအလားတူပြproblemနာရှိခဲ့တယ်။ Raspberry Pi နဲ့မတူဘူး။ အများသုံး IP နှင့် Pi ၏ဒေသဆိုင်ရာ IP ကွဲပြားခြားနားသောကြောင့်ဖြစ်သည်။ ဒီတော့ (ဝှက်ထားသော) အလုပ်မလုပ်ဘူးငါ username ကိုဖြတ်သန်းခြင်းနှင့် ssh ကိုဆက်သွယ်ခွင့်မပြုဘဲ ssh ခဲ့ကြပြီး username ကိုတောင်းခဲ့သည်။ ထိုအခါ auth ရန် (ဝှက်ထားသော) ကိုအသုံးပြုပါ။
အနောက်