主页 / server / 问题 / 447055
Accepted
aef
Asked: 2012-11-10 02:51:12 +0800 CST

使用 netcat 模式代理的 SSH 多跳连接

  • 772

自 OpenSSH 5.4 以来，有一个称为 natcat 模式的新功能，它允许您将本地 SSH 客户端绑定STDIN到STDOUT可通过远程 SSH 服务器访问的 TCP 端口。只需调用即可启用此模式ssh -W [HOST]:[PORT]

从理论上讲，这应该非常适合用于ProxyCommand每台主机 SSH 配置的设置，它以前经常与nc(netcat) 命令一起使用。ProxyCommand允许您将一台机器配置为本地机器和目标 SSH 服务器之间的代理，例如，如果目标 SSH 服务器隐藏在防火墙后面。

现在的问题是，它没有工作，而是在我面前抛出一条神秘的错误信息：

Bad packet length 1397966893.
Disconnecting: Packet corrupt

这是我的摘录~/.ssh/config：

Host *
  Protocol 2
  ControlMaster auto
  ControlPath ~/.ssh/cm_socket/%r@%h:%p
  ControlPersist 4h

Host proxy-host proxy-host.my-domain.tld
  HostName proxy-host.my-domain.tld
  ForwardAgent yes

Host target-server target-server.my-domain.tld
  HostName target-server.my-domain.tld
  ProxyCommand ssh -W %h:%p proxy-host
  ForwardAgent yes

正如您在此处看到的，我正在使用 ControlMaster 功能，因此我不必为每个主机打开多个 SSH 连接。

我测试的客户端机器是 Ubuntu 11.10 (x86_64)，代理主机和目标服务器都是 Debian Wheezy Beta 3 (x86_64) 机器。

当我打电话时发生错误ssh target-server。当我用-vvv标志调用它时，这是我另外得到的：

OpenSSH_5.8p1 Debian-7ubuntu1, OpenSSL 1.0.0e 6 Sep 2011
debug1: Reading configuration data /home/aef/.ssh/config
debug1: Applying options for *
debug1: Applying options for target-server.my-domain.tld
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Applying options for target-server.my-domain.tld
debug1: auto-mux: Trying existing master
debug1: Control socket "/home/aef/.ssh/cm_socket/[email protected]:22" does not exist
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec ssh -W 192.0.2.195:22 gateway-host.my-domain.tld
debug1: identity file /home/aef/.ssh/id_rsa type -1
debug1: identity file /home/aef/.ssh/id_rsa-cert type -1
debug1: identity file /home/aef/.ssh/id_dsa type -1
debug1: identity file /home/aef/.ssh/id_dsa-cert type -1
debug1: identity file /home/aef/.ssh/id_ecdsa type -1
debug1: identity file /home/aef/.ssh/id_ecdsa-cert type -1
debug1: permanently_drop_suid: 1000
Host key fingerprint is 1a:2b:3c:4d:5e:6f:7a:8b:9c:ad:be:cf:de:ed:fe:ef
+--[ECDSA  521]---+
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
|                 |
+-----------------+

debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-3
debug1: match: OpenSSH_6.0p1 Debian-3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1
debug2: fd 5 setting O_NONBLOCK
debug2: fd 4 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "192.0.2.195" from file "/home/aef/.ssh/known_hosts"
debug3: load_hostkeys: loaded 0 keys
debug3: load_hostkeys: loading entries for host "192.0.2.195" from file "/etc/ssh/ssh_known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /etc/ssh/ssh_known_hosts:49
debug3: load_hostkeys: found key type RSA in file /etc/ssh/ssh_known_hosts:50
debug3: load_hostkeys: loaded 2 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa
debug1: SSH2_MSG_KEXINIT sent
Bad packet length 1397966893.
Disconnecting: Packet corrupt

更新：现在有-vvv而不是只有-v输出。

linux

2 个回答

  1. Best Answer

    我终于知道这是怎么回事了。当和. ControlMaster_ 但是，至少有以下两种解决方法：proxy-hosttarget-server

    • proxy-host在尝试连接到 之前，请确保已经有一个正在运行的连接target-server。这将使错误消失，一切都按预期进行。您可以通过手动连接到proxy-host.

    • 禁用ControlMaster之ProxyCommand类的ProxyCommand ssh -o "ControlMaster no" -W %h:%p proxy-host。这也将解决这个问题，但它会proxy-host为每个使用完全相同的连接创建一个新连接ProxyCommand。

    • 8

  2. 这里真正的问题是ControlPersist因为这个选项出现在OpenSSH 5.6中。

    您应该考虑将您的 openssh 服务器升级到>=5.6或简单地从您的客户端配置文件中删除该指令。

    问候

    • 1

相关问题