Ubuntu
ssh-agent 轉發 Ubuntu 10.04.03 LTS
幾週前開始是一個煩人的問題，現在讓我發瘋！
在家裡，我有一個充當文件伺服器的 Ubuntu 10.04.03 機器。我通過網路外部其他盒子的 rsync 備份它上面的東西。當我從我的筆記型電腦連接到這個文件伺服器時，我轉發了 ssh-agent：
root@fileserver:~# env | grep SSH_AUTH SSH_AUTH_SOCK=/tmp/ssh-IumRLB2628/agent.2628有這個 1 框，也執行 10.04.03，我無法連接。所有其他人都工作正常，我的 SSH 密鑰被轉發沒有問題，但是這台伺服器不會有它。這就是我的意思：
root@fileserver:~# ssh the-problematic-server -v OpenSSH_5.3p1 Debian-3ubuntu7, OpenSSL 0.9.8k 25 Mar 2009 debug1: Reading configuration data /root/.ssh/config debug1: Applying options for myserver debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to the-problematic-server [n.n.n.n] port 22. debug1: connect to address n.n.n.n port 22: Connection timed out ssh: connect to host the-problematic-server port 22: Connection timed out從同一個文件伺服器到不同的盒子，使用相同的轉發 ssh-agent：
root@fileserver:~# ssh the-good-server -v debug1: Reading configuration data /root/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to the-good-server [n.n.n.n] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/identity type -1 debug1: identity file /root/.ssh/id_rsa type -1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3p1 Debian-3ubuntu7 debug1: match: OpenSSH_5.3p1 Debian-3ubuntu7 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'the-good-server.net' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:10 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv THE FORWARDED KEY debug1: Offering public key: /Users/gerhard/.ssh/calista_rsa <<<<<< THE FORWARDED KEY ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ THE FORWARDED KEY debug1: Server accepts key: pkalg ssh-rsa blen 277 debug1: Authentication succeeded (publickey). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: Requesting authentication agent forwarding. debug1: Sending environment. debug1: Sending env LANG = en_US.UTF-8 Linux the-good-server 2.6.32-32-generic #62-Ubuntu SMP Wed Apr 20 21:52:38 UTC 2011 x86_64 GNU/Linux Ubuntu 10.04.3 LTS現在，對於頂部的櫻桃，來自我剛剛連接到的伺服器……
root@the-good-server:~# ssh the-problematic-server -v OpenSSH_5.3p1 Debian-3ubuntu7, OpenSSL 0.9.8k 25 Mar 2009 debug1: Reading configuration data /root/.ssh/config debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Connecting to the-problematic-server [n.n.n.n] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/identity type -1 debug1: identity file /root/.ssh/id_rsa type 1 debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3p1 Debian-3ubuntu7 debug1: match: OpenSSH_5.3p1 Debian-3ubuntu7 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'the-problematic-server' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:1 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: client_input_channel_open: ctype auth-agent@openssh.com rchan 2 win 65536 max 16384 debug1: channel 1: new [authentication agent connection] debug1: confirm auth-agent@openssh.com debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv THE FORWARDED KEY AGAIN debug1: Offering public key: /Users/gerhard/.ssh/calista_rsa <<<<<< THE FORWARDED KEY AGAIN ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ THE FORWARDED KEY AGAIN debug1: Server accepts key: pkalg ssh-rsa blen 277 debug1: channel 1: FORCE input drain debug1: Authentication succeeded (publickey). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: channel 1: free: authentication agent connection, nchannels 2 debug1: Requesting authentication agent forwarding. debug1: Sending environment. debug1: Sending env LANG = en_US Linux the-problematic-server 2.6.34.6-64 #3 SMP Fri Sep 17 16:06:38 UTC 2010 x86_64 GNU/Linux Ubuntu 10.04.3 LTS順便說一句，我也嘗試了不同的使用者，當我嘗試從文件伺服器連接時也會發生同樣的事情。也沒有任何東西登錄到那個“問題伺服器”框的 auth.log 中，所以它似乎甚至沒有進入 sshd 部分。
我在這裡真的沒有想法了，我正在尋找更聰明、更鋒利的排骨。乾杯!
更新 27.09.2011
root@problematic-server:~# ifconfig eth0 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:188.165.229.62 Bcast:188.165.229.255 Mask:255.255.255.0 inet6 addr: fe80::225:90ff:fe13:b3a0/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:4021584924 errors:169 dropped:4562 overruns:0 frame:169 TX packets:6302335682 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2467184127845 (2.4 TB) TX bytes:8418184173437 (8.4 TB) Memory:febe0000-fec00000 eth0:0 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:94.23.121.1 Bcast:94.23.121.1 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:febe0000-fec00000 eth0:1 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:94.23.152.36 Bcast:94.23.152.36 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:febe0000-fec00000 eth0:2 Link encap:Ethernet HWaddr 00:25:90:13:b3:a0 inet addr:178.32.58.3 Bcast:178.32.58.3 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:febe0000-fec00000很少的arping結果：
root@problematic-server:~# arping -D -I eth0 -c 2 188.165.229.62 ARPING 188.165.229.62 from 0.0.0.0 eth0 Sent 2 probes (2 broadcast(s)) Received 0 response(s) root@opteron16:~# arping -D -I eth0:0 -c 2 94.23.121.1 ARPING 94.23.121.1 from 0.0.0.0 eth0:0 Sent 2 probes (2 broadcast(s)) Received 0 response(s)更新 29.09.2011
ip路由列表
root@fileserver:~# ip route list 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2 default via 192.168.1.1 dev eth0 metric 100 root@problematic-server:~# ip route list 188.165.229.0/24 dev eth0 proto kernel scope link src 188.165.229.62 default via 188.165.229.254 dev eth0 metric 100你
root@fileserver:~# dig problematic-server ; <<>> DiG 9.7.0-P1 <<>> problematic-server ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36025 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;problematic-server. IN A ;; ANSWER SECTION: problematic-server. 1016 IN A 188.165.229.62 ;; Query time: 26 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Sep 29 09:32:50 2011 ;; MSG SIZE rcvd: 58琶音
root@fileserver:~# arping -c 5 188.165.229.62 ARPING 188.165.229.62 --- 188.165.229.62 statistics --- 5 packets transmitted, 0 packets received, 100% unanswered
應該是newtwork的問題。檢查您是否可以 ping 框。檢查防火牆（iptables）以查看它是否阻止了您的主機。檢查 /etc/hosts.* 文件以查看它是否在那裡被拒絕。
查看您的主機或您要連接的主機是否可能存在 IP 衝突。您可以在主機上執行“arping”並查看是否返回多個硬體地址。
您是在進行鏈路聚合還是在任一主機中都有多個 NIC？可能是路由問題。
$$ update $$ 看起來你在從 filserver 到有問題的伺服器的過程中遇到了一些問題。無論出於何種原因，看起來數據都無法在這些網路之間路由。您是否執行路由此流量的網路路由器？感覺是你的路由器有問題。