Ssh

VPC VPN SSH 在主機驗證時停止

  • August 19, 2015

我已經在 Amazon 上設置了一個通往我們 VPC 的 VPN 隧道，它由一個帶有幾台機器的公共子網、一個 NAT 實例以及幾個帶有各種機器的私有子網組成。我可以從我們的本地網路看到 VPC 中的機器，我已將本地網路 IP 範圍中的 ICMP 和 SSH 添加到 VPC 安全組，並且可以很好地 ping/nmap 伺服器的私有 IP（看到埠 22 已打開。）

我可以毫無問題地通過 SSH 連接到具有公共 IP 的公共子網實例。我遇到的問題是從私有/公共子網私有 IP SSH 進入任何機器。

SSH 吐出：

  ssh -v -i ~/.ssh/redacted.pem ec2-user@11.0.0.139
  OpenSSH_6.6, OpenSSL 1.0.2d 9 Jul 2015
  debug1: Reading configuration data /etc/ssh/ssh_config
  debug1: Connecting to 11.0.0.139 [11.0.0.139] port 22.
  debug1: Connection established.
  debug1: identity file /home/username/.ssh/redacted.pem type -1
  debug1: identity file /home/username/.ssh/redacted.pem-cert type -1
  debug1: Enabling compatibility mode for protocol 2.0
  debug1: Local version string SSH-2.0-OpenSSH_6.6p1-hpn14v5
  debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
  debug1: Remote is NON-HPN aware
  debug1: match: OpenSSH_6.2 pat OpenSSH* compat 0x14000000
  debug1: SSH2_MSG_KEXINIT sent
  debug1: SSH2_MSG_KEXINIT received
  debug1: AUTH STATE IS 0
  debug1: REQUESTED ENC.NAME is 'aes128-ctr'
  debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
  debug1: REQUESTED ENC.NAME is 'aes128-ctr'
  debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
  debug1: sending SSH2_MSG_KEX_ECDH_INIT
  debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

在這一點上它坐了一會兒，終於回來了：

  Connection closed by 11.0.0.139

VPN 設置了靜態路由，並且隧道已啟動。路由表正在通過虛擬專用網關傳播我們的本地 192.18.0.0/16 網路 IP 範圍。網路 ACL 是完全開放的 IN 和 OUT。

但是我不確定為什麼我沒有從伺服器獲得主機驗證步驟？

tcpdump顯示了這一點：

  > sudo tcpdump -vvv 'tcp port 22 and host 11.0.0.139'
  tcpdump: listening on enp0s20u1, link-type EN10MB (Ethernet), capture size 262144 bytes
  12:36:26.096254 IP (tos 0x0, ttl 64, id 56385, offset 0, flags [DF], proto TCP (6), length 60)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [S], cksum 0xb16e (correct), seq 989731254, win 29200, options [mss 1460,sackOK,TS val 3130871 ecr 0,nop,wscale 7], length 0
  12:36:26.141295 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto TCP (6), length 60)
      11.0.0.139.ssh > HOSTNAME.55391: Flags [S.], cksum 0x3b34 (correct), seq 3868019661, ack 989731255, win 26847, options [mss 8961,sackOK,TS val 1060770 ecr 3130871,nop,wscale 7], length 0
  12:36:26.141372 IP (tos 0x0, ttl 64, id 56386, offset 0, flags [DF], proto TCP (6), length 52)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xef39 (correct), seq 1, ack 1, win 229, options [nop,nop,TS val 3130885 ecr 1060770], length 0
  12:36:26.141828 IP (tos 0x0, ttl 64, id 56387, offset 0, flags [DF], proto TCP (6), length 83)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [P.], cksum 0xb8b4 (correct), seq 1:32, ack 1, win 229, options [nop,nop,TS val 3130885 ecr 1060770], length 31
  12:36:26.185005 IP (tos 0x0, ttl 62, id 25699, offset 0, flags [DF], proto TCP (6), length 52)
      11.0.0.139.ssh > HOSTNAME.55391: Flags [.], cksum 0xef22 (correct), seq 1, ack 32, win 210, options [nop,nop,TS val 1060781 ecr 3130885], length 0
  12:36:26.188702 IP (tos 0x0, ttl 62, id 25700, offset 0, flags [DF], proto TCP (6), length 73)
      11.0.0.139.ssh > HOSTNAME.55391: Flags [P.], cksum 0x2e5c (correct), seq 1:22, ack 32, win 210, options [nop,nop,TS val 1060782 ecr 3130885], length 21
  12:36:26.188813 IP (tos 0x0, ttl 64, id 56388, offset 0, flags [DF], proto TCP (6), length 52)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xeeeb (correct), seq 32, ack 22, win 229, options [nop,nop,TS val 3130899 ecr 1060782], length 0
  12:36:26.483445 IP (tos 0x0, ttl 64, id 56395, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xdabd (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3130988 ecr 1060793], length 1386
  12:36:26.976751 IP (tos 0x0, ttl 64, id 56396, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xda29 (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3131136 ecr 1060793], length 1386
  12:36:27.966780 IP (tos 0x0, ttl 64, id 56397, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xd900 (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3131433 ecr 1060793], length 1386
  12:36:29.943400 IP (tos 0x0, ttl 64, id 56398, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xd6af (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3132026 ecr 1060793], length 1386
  12:36:33.896741 IP (tos 0x0, ttl 64, id 56399, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xd20d (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3133212 ecr 1060793], length 1386
  12:36:41.803450 IP (tos 0x0, ttl 64, id 56400, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xc8c9 (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3135584 ecr 1060793], length 1386
  12:36:57.643373 IP (tos 0x0, ttl 64, id 56401, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0xb639 (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3140336 ecr 1060793], length 1386
  12:37:29.270027 IP (tos 0x0, ttl 64, id 56402, offset 0, flags [DF], proto TCP (6), length 1438)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [.], cksum 0x9129 (correct), seq 32:1418, ack 1566, win 251, options [nop,nop,TS val 3149824 ecr 1060793], length 1386
  12:38:26.189231 IP (tos 0x0, ttl 62, id 25707, offset 0, flags [DF], proto TCP (6), length 64)
      11.0.0.139.ssh > HOSTNAME.55391: Flags [F.], cksum 0x86da (correct), seq 1566, ack 32, win 227, options [nop,nop,TS val 1090782 ecr 3130899,nop,nop,sack 1 {1418:2000}], length 0
  12:38:26.190197 IP (tos 0x0, ttl 64, id 56403, offset 0, flags [DF], proto TCP (6), length 132)
      HOSTNAME.55391 > 11.0.0.139.ssh: Flags [FP.], cksum 0x437d (correct), seq 2000:2080, ack 1567, win 251, options [nop,nop,TS val 3166900 ecr 1090782], length 80
  12:38:26.232692 IP (tos 0x0, ttl 62, id 41287, offset 0, flags [DF], proto TCP (6), length 40)
      11.0.0.139.ssh > HOSTNAME.55391: Flags [R], cksum 0x6dc0 (correct), seq 3868021228, win 0, length 0

阻止 SSH 完成連接的原因是什麼？

檢查界面上的 MTU 大小是否為 1436，請參閱http://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Introduction.html

引用自：https://serverfault.com/questions/715074

相關問答

Vpn

AWS Override VPC DHCP - RRAS VPN 客戶端的附加選項集

  • September 28, 2021
檢視問答
Ssh

允許外部訪問 aws 上的堡壘主機

  • July 12, 2019
檢視問答
Ssh

如何為 SSH 設置 AWS 網路訪問控制列表到私有子網

  • September 9, 2018
檢視問答
Vpn

如何建立與具有相同 CIDR 的不同網路的 VPN 連接？

  • October 13, 2017
檢視問答
Windows

您能否在沒有硬體 VPN 的情況下從 Windows 7 連接到 Amazon VPC VPN？

  • August 21, 2017
檢視問答
Ssh

通過 IPv6 通過 SSH 連接到 Amazon AWS

  • April 28, 2017
檢視問答