為什麼 SFTP 連接僅部分時間成功？

我已經在 Windows Server 2019 上設置了 OpenSSH 7.7。在撰寫本文時，該框已收到更新。昨天結束時，我測試了使用 SFTP 連接到盒子，使用管理員帳戶和為供應商創建的受限帳戶，兩者都能夠連接和傳輸文件。

今天早上，我嘗試使用 SFTP 登錄，但兩次登錄都因身份驗證錯誤而被拒絕。如果我嘗試從命令行 ssh，也會發生同樣的事情。sshd_log條目只是說

3416 2021-08-18 10:25:08.957 Connection from XX.XX.XX.XX port 48119 on 172.31.49.52 port 22
3416 2021-08-18 10:25:10.754 Failed password for invalid user don-admin from XX.XX.XX.XX port 48119 ssh2
3416 2021-08-18 10:25:10.832 Connection closed by invalid user don-admin XX.XX.XX.XX port 48119 [preauth]

（順便說一下，管理員帳戶與我用於將 RDP 放入框中的帳戶相同，所以我確定不是該帳戶被意外更改或禁用。）我嘗試重新啟動OpenSSH SSH 伺服器和OpenSSH Authentication Agent服務，沒有效果。

當然，我並沒有在一夜之間改變任何東西。我檢查了一夜之間是否有任何自動更新，但沒有，並且自動更新被禁用，如我所願。這個盒子還沒有投入生產，據我在安全事件日誌中看到的，在我自己的連接之間沒有其他人類使用者登錄。

然後，大約 50 分鐘後，我根本沒有做任何更改，sshd_log條目在一些（但不是全部）SFTP 嘗試中更改為：

4628 2021-08-18 10:53:54.007 Connection from XX.XX.XX.XX port 34996 on 172.31.49.52 port 22
4628 2021-08-18 10:53:55.538 Failed publickey for sftpuser from XX.XX.XX.XX port 34996 ssh2: ED25519 SHA256:xxxxxxxxxxxxxxxx
4628 2021-08-18 10:53:55.694 Accepted password for sftpuser from XX.XX.XX.XX port 34996 ssh2
4628 2021-08-18 10:53:55.726 User child is on pid 3612
2860 2021-08-18 10:54:01.398 Connection from XX.XX.XX.XX port 43896 on 172.31.49.52 port 22
2860 2021-08-18 10:54:01.960 Failed password for invalid user sftpuser from XX.XX.XX.XX port 43896 ssh2
2860 2021-08-18 10:54:02.038 Connection closed by invalid user sftpuser XX.XX.XX.XX port 43896 [preauth]

然後，大約 25 分鐘後，我根本沒有進行任何更改，所有 SFTP 都重新開始正常工作。昨天早上也發生了同樣的情況，但由於當時我仍在調整配置，我認為這是原因；但現在我想這是同樣的事情。這幾乎就像 OpenSSH 需要在早上醒來並熱身才能正常工作。

由於 SFTP 站點需要在我們投入生產後可供我們的供應商日常使用，所以我真的需要弄清楚發生了什麼以及如何解決它，但我完全不知道這裡還有什麼可看的. 任何人都可以提出解釋，或者至少接下來要嘗試什麼來診斷？

$$ Update $$

幾個小時後，我根本沒有做任何更改，連接再次停止工作，嘗試再次遇到身份驗證錯誤。

$$ Update $$

以下是失敗嘗試的DEBUG級別日誌條目：

2924 2021-08-18 16:57:59.653 debug1: inetd sockets after dupping: 3, 3
2924 2021-08-18 16:57:59.653 Connection from 97.115.151.126 port 47632 on 172.31.49.52 port 22
2924 2021-08-18 16:57:59.653 debug1: Client protocol version 2.0; client software version FileZilla_3.55.1
2924 2021-08-18 16:57:59.653 debug1: no match: FileZilla_3.55.1
2924 2021-08-18 16:57:59.653 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
2924 2021-08-18 16:57:59.685 debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
2924 2021-08-18 16:57:59.685 debug1: SSH2_MSG_KEXINIT sent [preauth]
2924 2021-08-18 16:57:59.731 debug1: SSH2_MSG_KEXINIT received [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: algorithm: curve25519-sha256 [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: host key algorithm: ssh-ed25519 [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth]
2924 2021-08-18 16:57:59.731 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
2924 2021-08-18 16:57:59.809 debug1: rekey after 4294967296 blocks [preauth]
2924 2021-08-18 16:57:59.809 debug1: SSH2_MSG_NEWKEYS sent [preauth]
2924 2021-08-18 16:57:59.809 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
2924 2021-08-18 16:57:59.903 debug1: SSH2_MSG_NEWKEYS received [preauth]
2924 2021-08-18 16:57:59.903 debug1: rekey after 4294967296 blocks [preauth]
2924 2021-08-18 16:57:59.903 debug1: KEX done [preauth]
2924 2021-08-18 16:57:59.981 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method none [preauth]
2924 2021-08-18 16:57:59.981 debug1: attempt 0 failures 0 [preauth]
2924 2021-08-18 16:57:59.981 debug1: user n matched group list solutionwhere at line 86
2924 2021-08-18 16:57:59.981 debug1: get_passwd: LookupAccountName() failed: 1332.
2924 2021-08-18 16:57:59.981 debug1: Can't match group at line 93 because user n does not exist
2924 2021-08-18 16:58:00.059 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method publickey [preauth]
2924 2021-08-18 16:58:00.059 debug1: attempt 1 failures 0 [preauth]
2924 2021-08-18 16:58:00.059 debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog [preauth]
2924 2021-08-18 16:58:00.138 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method keyboard-interactive [preauth]
2924 2021-08-18 16:58:00.138 debug1: attempt 2 failures 1 [preauth]
2924 2021-08-18 16:58:00.138 debug1: keyboard-interactive devs  [preauth]
2924 2021-08-18 16:58:00.138 debug1: auth2_challenge: user=wisdomwhere-sftp devs= [preauth]
2924 2021-08-18 16:58:00.138 debug1: kbdint_alloc: devices '' [preauth]
2924 2021-08-18 16:58:00.231 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method password [preauth]
2924 2021-08-18 16:58:00.231 debug1: attempt 3 failures 2 [preauth]
2924 2021-08-18 16:58:00.231 debug1: Windows authentication failed for user: NOUSER domain: . error: 1326
2924 2021-08-18 16:58:00.231 Failed password for invalid user wisdomwhere-sftp from 97.115.151.126 port 47632 ssh2
2924 2021-08-18 16:58:00.309 Connection closed by invalid user wisdomwhere-sftp 97.115.151.126 port 47632 [preauth]
2924 2021-08-18 16:58:00.309 debug1: do_cleanup [preauth]
2924 2021-08-18 16:58:00.309 debug1: monitor_read_log: child log fd closed
2924 2021-08-18 16:58:00.309 debug1: do_cleanup
2924 2021-08-18 16:58:00.309 debug1: Killing privsep child 3476

這是幾分鐘後成功連接的DEBUG級別的日誌條目（請記住，在兩次嘗試之間，兩端都沒有配置更改）：

3188 2021-08-18 17:15:43.726 debug1: inetd sockets after dupping: 3, 3
3188 2021-08-18 17:15:43.726 Connection from 97.115.151.126 port 43761 on 172.31.49.52 port 22
3188 2021-08-18 17:15:43.726 debug1: Client protocol version 2.0; client software version FileZilla_3.55.1
3188 2021-08-18 17:15:43.726 debug1: no match: FileZilla_3.55.1
3188 2021-08-18 17:15:43.726 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
3188 2021-08-18 17:15:43.758 debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
3188 2021-08-18 17:15:43.758 debug1: SSH2_MSG_KEXINIT sent [preauth]
3188 2021-08-18 17:15:43.804 debug1: SSH2_MSG_KEXINIT received [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: algorithm: curve25519-sha256 [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: host key algorithm: ssh-ed25519 [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth]
3188 2021-08-18 17:15:43.804 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
3188 2021-08-18 17:15:43.883 debug1: rekey after 4294967296 blocks [preauth]
3188 2021-08-18 17:15:43.883 debug1: SSH2_MSG_NEWKEYS sent [preauth]
3188 2021-08-18 17:15:43.883 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
3188 2021-08-18 17:15:43.976 debug1: SSH2_MSG_NEWKEYS received [preauth]
3188 2021-08-18 17:15:43.976 debug1: rekey after 4294967296 blocks [preauth]
3188 2021-08-18 17:15:43.976 debug1: KEX done [preauth]
3188 2021-08-18 17:15:44.054 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method none [preauth]
3188 2021-08-18 17:15:44.054 debug1: attempt 0 failures 0 [preauth]
3188 2021-08-18 17:15:44.054 debug1: user wisdomwhere-sftp matched group list solutionwhere at line 86
3188 2021-08-18 17:15:44.054 debug1: user wisdomwhere-sftp does not match group list administrators at line 93
3188 2021-08-18 17:15:44.133 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method publickey [preauth]
3188 2021-08-18 17:15:44.133 debug1: attempt 1 failures 0 [preauth]
3188 2021-08-18 17:15:44.133 debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog [preauth]
3188 2021-08-18 17:15:44.133 debug1: trying public key file C:\\Users\\wisdomwhere-sftp\\.ssh/authorized_keys
3188 2021-08-18 17:15:44.133 debug1: Could not open authorized keys 'C:\\Users\\wisdomwhere-sftp\\.ssh/authorized_keys': No such file or directory
3188 2021-08-18 17:15:44.133 Failed publickey for wisdomwhere-sftp from 97.115.151.126 port 43761 ssh2: ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog
3188 2021-08-18 17:15:44.211 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method keyboard-interactive [preauth]
3188 2021-08-18 17:15:44.211 debug1: attempt 2 failures 1 [preauth]
3188 2021-08-18 17:15:44.211 debug1: keyboard-interactive devs  [preauth]
3188 2021-08-18 17:15:44.211 debug1: auth2_challenge: user=wisdomwhere-sftp devs= [preauth]
3188 2021-08-18 17:15:44.211 debug1: kbdint_alloc: devices '' [preauth]
3188 2021-08-18 17:15:44.289 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method password [preauth]
3188 2021-08-18 17:15:44.289 debug1: attempt 3 failures 2 [preauth]
3188 2021-08-18 17:15:44.304 Accepted password for wisdomwhere-sftp from 97.115.151.126 port 43761 ssh2
3188 2021-08-18 17:15:44.304 debug1: monitor_child_preauth: wisdomwhere-sftp has been authenticated by privileged process
3188 2021-08-18 17:15:44.304 debug1: monitor_read_log: child log fd closed
3188 2021-08-18 17:15:44.320 User child is on pid 5716

第 22 行是它們分歧的地方…失敗的嘗試停止引用user wisdomwhere-sftp並開始引用user n。這可能是什麼原因？

這似乎是Windows版本的 OpenSSH中的一個錯誤。我建議升級到 Win32-OpenSSH 版本 8.0.0.1 或更高版本。

引用自：https://serverfault.com/questions/1074952