为什么 SFTP 连接仅部分时间成功？

我已经在 Windows Server 2019 上设置了 OpenSSH 7.7。在撰写本文时，该框已收到更新。昨天结束时，我测试了使用 SFTP 连接到盒子，使用管理员帐户和为供应商创建的受限帐户，两者都能够连接和传输文件。

今天早上，我尝试使用 SFTP 登录，但两次登录都因身份验证错误而被拒绝。如果我尝试从命令行 ssh，也会发生同样的事情。sshd_log条目只是说

3416 2021-08-18 10:25:08.957 Connection from XX.XX.XX.XX port 48119 on 172.31.49.52 port 22
3416 2021-08-18 10:25:10.754 Failed password for invalid user don-admin from XX.XX.XX.XX port 48119 ssh2
3416 2021-08-18 10:25:10.832 Connection closed by invalid user don-admin XX.XX.XX.XX port 48119 [preauth]

（顺便说一下，管理员帐户与我用于将 RDP 放入框中的帐户相同，所以我确定不是该帐户被意外更改或禁用。）我尝试重新启动OpenSSH SSH 服务器和OpenSSH Authentication Agent服务，没有效果。

当然，我并没有在一夜之间改变任何东西。我检查了一夜之间是否有任何自动更新，但没有，并且自动更新被禁用，如我所愿。这个盒子还没有投入生产，据我在安全事件日志中看到的，在我自己的连接之间没有其他人类用户登录。

然后，大约 50 分钟后，我根本没有做任何更改，sshd_log条目在一些（但不是全部）SFTP 尝试中更改为：

4628 2021-08-18 10:53:54.007 Connection from XX.XX.XX.XX port 34996 on 172.31.49.52 port 22
4628 2021-08-18 10:53:55.538 Failed publickey for sftpuser from XX.XX.XX.XX port 34996 ssh2: ED25519 SHA256:xxxxxxxxxxxxxxxx
4628 2021-08-18 10:53:55.694 Accepted password for sftpuser from XX.XX.XX.XX port 34996 ssh2
4628 2021-08-18 10:53:55.726 User child is on pid 3612
2860 2021-08-18 10:54:01.398 Connection from XX.XX.XX.XX port 43896 on 172.31.49.52 port 22
2860 2021-08-18 10:54:01.960 Failed password for invalid user sftpuser from XX.XX.XX.XX port 43896 ssh2
2860 2021-08-18 10:54:02.038 Connection closed by invalid user sftpuser XX.XX.XX.XX port 43896 [preauth]

然后，大约 25 分钟后，我根本没有进行任何更改，所有 SFTP 都重新开始正常工作。昨天早上也发生了同样的情况，但由于当时我仍在调整配置，我认为这是原因；但现在我想这是同样的事情。这几乎就像 OpenSSH 需要在早上醒来并热身才能正常工作。

由于 SFTP 站点需要在我们投入生产后可供我们的供应商日常使用，所以我真的需要弄清楚发生了什么以及如何解决它，但我完全不知道这里还有什么可看的. 任何人都可以提出解释，或者至少接下来要尝试什么来诊断？

[更新]

几个小时后，我根本没有做任何更改，连接再次停止工作，尝试再次遇到身份验证错误。

[更新]

以下是失败尝试的DEBUG级别日志条目：

2924 2021-08-18 16:57:59.653 debug1: inetd sockets after dupping: 3, 3
2924 2021-08-18 16:57:59.653 Connection from 97.115.151.126 port 47632 on 172.31.49.52 port 22
2924 2021-08-18 16:57:59.653 debug1: Client protocol version 2.0; client software version FileZilla_3.55.1
2924 2021-08-18 16:57:59.653 debug1: no match: FileZilla_3.55.1
2924 2021-08-18 16:57:59.653 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
2924 2021-08-18 16:57:59.685 debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
2924 2021-08-18 16:57:59.685 debug1: SSH2_MSG_KEXINIT sent [preauth]
2924 2021-08-18 16:57:59.731 debug1: SSH2_MSG_KEXINIT received [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: algorithm: curve25519-sha256 [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: host key algorithm: ssh-ed25519 [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
2924 2021-08-18 16:57:59.731 debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
2924 2021-08-18 16:57:59.731 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
2924 2021-08-18 16:57:59.809 debug1: rekey after 4294967296 blocks [preauth]
2924 2021-08-18 16:57:59.809 debug1: SSH2_MSG_NEWKEYS sent [preauth]
2924 2021-08-18 16:57:59.809 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
2924 2021-08-18 16:57:59.903 debug1: SSH2_MSG_NEWKEYS received [preauth]
2924 2021-08-18 16:57:59.903 debug1: rekey after 4294967296 blocks [preauth]
2924 2021-08-18 16:57:59.903 debug1: KEX done [preauth]
2924 2021-08-18 16:57:59.981 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method none [preauth]
2924 2021-08-18 16:57:59.981 debug1: attempt 0 failures 0 [preauth]
2924 2021-08-18 16:57:59.981 debug1: user n matched group list solutionwhere at line 86
2924 2021-08-18 16:57:59.981 debug1: get_passwd: LookupAccountName() failed: 1332.
2924 2021-08-18 16:57:59.981 debug1: Can't match group at line 93 because user n does not exist
2924 2021-08-18 16:58:00.059 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method publickey [preauth]
2924 2021-08-18 16:58:00.059 debug1: attempt 1 failures 0 [preauth]
2924 2021-08-18 16:58:00.059 debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog [preauth]
2924 2021-08-18 16:58:00.138 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method keyboard-interactive [preauth]
2924 2021-08-18 16:58:00.138 debug1: attempt 2 failures 1 [preauth]
2924 2021-08-18 16:58:00.138 debug1: keyboard-interactive devs  [preauth]
2924 2021-08-18 16:58:00.138 debug1: auth2_challenge: user=wisdomwhere-sftp devs= [preauth]
2924 2021-08-18 16:58:00.138 debug1: kbdint_alloc: devices '' [preauth]
2924 2021-08-18 16:58:00.231 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method password [preauth]
2924 2021-08-18 16:58:00.231 debug1: attempt 3 failures 2 [preauth]
2924 2021-08-18 16:58:00.231 debug1: Windows authentication failed for user: NOUSER domain: . error: 1326
2924 2021-08-18 16:58:00.231 Failed password for invalid user wisdomwhere-sftp from 97.115.151.126 port 47632 ssh2
2924 2021-08-18 16:58:00.309 Connection closed by invalid user wisdomwhere-sftp 97.115.151.126 port 47632 [preauth]
2924 2021-08-18 16:58:00.309 debug1: do_cleanup [preauth]
2924 2021-08-18 16:58:00.309 debug1: monitor_read_log: child log fd closed
2924 2021-08-18 16:58:00.309 debug1: do_cleanup
2924 2021-08-18 16:58:00.309 debug1: Killing privsep child 3476

这是几分钟后成功连接的DEBUG级别的日志条目（请记住，在两次尝试之间，两端都没有配置更改）：

3188 2021-08-18 17:15:43.726 debug1: inetd sockets after dupping: 3, 3
3188 2021-08-18 17:15:43.726 Connection from 97.115.151.126 port 43761 on 172.31.49.52 port 22
3188 2021-08-18 17:15:43.726 debug1: Client protocol version 2.0; client software version FileZilla_3.55.1
3188 2021-08-18 17:15:43.726 debug1: no match: FileZilla_3.55.1
3188 2021-08-18 17:15:43.726 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_7.7
3188 2021-08-18 17:15:43.758 debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
3188 2021-08-18 17:15:43.758 debug1: SSH2_MSG_KEXINIT sent [preauth]
3188 2021-08-18 17:15:43.804 debug1: SSH2_MSG_KEXINIT received [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: algorithm: curve25519-sha256 [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: host key algorithm: ssh-ed25519 [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none [preauth]
3188 2021-08-18 17:15:43.804 debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none [preauth]
3188 2021-08-18 17:15:43.804 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
3188 2021-08-18 17:15:43.883 debug1: rekey after 4294967296 blocks [preauth]
3188 2021-08-18 17:15:43.883 debug1: SSH2_MSG_NEWKEYS sent [preauth]
3188 2021-08-18 17:15:43.883 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
3188 2021-08-18 17:15:43.976 debug1: SSH2_MSG_NEWKEYS received [preauth]
3188 2021-08-18 17:15:43.976 debug1: rekey after 4294967296 blocks [preauth]
3188 2021-08-18 17:15:43.976 debug1: KEX done [preauth]
3188 2021-08-18 17:15:44.054 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method none [preauth]
3188 2021-08-18 17:15:44.054 debug1: attempt 0 failures 0 [preauth]
3188 2021-08-18 17:15:44.054 debug1: user wisdomwhere-sftp matched group list solutionwhere at line 86
3188 2021-08-18 17:15:44.054 debug1: user wisdomwhere-sftp does not match group list administrators at line 93
3188 2021-08-18 17:15:44.133 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method publickey [preauth]
3188 2021-08-18 17:15:44.133 debug1: attempt 1 failures 0 [preauth]
3188 2021-08-18 17:15:44.133 debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog [preauth]
3188 2021-08-18 17:15:44.133 debug1: trying public key file C:\\Users\\wisdomwhere-sftp\\.ssh/authorized_keys
3188 2021-08-18 17:15:44.133 debug1: Could not open authorized keys 'C:\\Users\\wisdomwhere-sftp\\.ssh/authorized_keys': No such file or directory
3188 2021-08-18 17:15:44.133 Failed publickey for wisdomwhere-sftp from 97.115.151.126 port 43761 ssh2: ED25519 SHA256:ZiwK/RCeTj8jshoMs22PvyckMLSGZE4EEZuNhhyIkog
3188 2021-08-18 17:15:44.211 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method keyboard-interactive [preauth]
3188 2021-08-18 17:15:44.211 debug1: attempt 2 failures 1 [preauth]
3188 2021-08-18 17:15:44.211 debug1: keyboard-interactive devs  [preauth]
3188 2021-08-18 17:15:44.211 debug1: auth2_challenge: user=wisdomwhere-sftp devs= [preauth]
3188 2021-08-18 17:15:44.211 debug1: kbdint_alloc: devices '' [preauth]
3188 2021-08-18 17:15:44.289 debug1: userauth-request for user wisdomwhere-sftp service ssh-connection method password [preauth]
3188 2021-08-18 17:15:44.289 debug1: attempt 3 failures 2 [preauth]
3188 2021-08-18 17:15:44.304 Accepted password for wisdomwhere-sftp from 97.115.151.126 port 43761 ssh2
3188 2021-08-18 17:15:44.304 debug1: monitor_child_preauth: wisdomwhere-sftp has been authenticated by privileged process
3188 2021-08-18 17:15:44.304 debug1: monitor_read_log: child log fd closed
3188 2021-08-18 17:15:44.320 User child is on pid 5716

第 22 行是它们分歧的地方...失败的尝试停止引用user wisdomwhere-sftp并开始引用user n。这可能是什么原因？