升级 openssh 不影响加密算法

    拒绝过程：

    1. [boccfc@cl-prod-pats-bat-01 ~]$ sftp -oPort=2222 -vvv -oIdentityFile=id_ecdsa_pc_zhongyinxj_online -oKexAlgorithms=diffie-hellman-group18-sha512 pc_zhongyinxj@58.83.177.88
    2. OpenSSH_8.3p1, OpenSSL 1.1.1g  21 Apr 2020
    3. debug1: Reading configuration data /etc/ssh/ssh_config
    4. debug1: /etc/ssh/ssh_config line 58: Applying options for *
    5. debug2: resolve_canonicalize: hostname 58.83.177.88 is address
    6. debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
    7. debug2: ssh_connect_direct
    8. debug1: Connecting to 58.83.177.88 [58.83.177.88] port 2222.
    9. debug1: Connection established.
    10. debug1: identity file id_ecdsa_pc_zhongyinxj_online type -1
    11. debug1: identity file id_ecdsa_pc_zhongyinxj_online-cert type -1
    12. debug1: Local version string SSH-2.0-OpenSSH_8.3
    13. kex_exchange_identification: read: Connection reset by peer
    14. Connection reset by 58.83.177.88 port 2222
    15. Connection closed.  
    16. Connection closed
    17. [boccfc@cl-prod-pats-bat-01 ~]$

    通过过程：

    1. [boccfc@ftp-ap01 ~]$ sftp -oPort=2222 -v -oIdentityFile=/home/boccfc/app/id_ecdsa_pc_zhongyinxj_online  pc_zhongyinxj@58.83.177.88
    2. OpenSSH_7.4p1, OpenSSL 1.0.1e-fips 11 Feb 2013
    3. debug1: Reading configuration data /etc/ssh/ssh_config
    4. debug1: /etc/ssh/ssh_config line 58: Applying options for *
    5. debug1: Connecting to 58.83.177.88 [58.83.177.88] port 2222.
    6. debug1: Connection established.
    7. debug1: key_load_public: No such file or directory
    8. debug1: identity file /home/boccfc/app/id_ecdsa_pc_zhongyinxj_online type -1
    9. debug1: key_load_public: No such file or directory
    10. debug1: identity file /home/boccfc/app/id_ecdsa_pc_zhongyinxj_online-cert type -1
    11. debug1: Enabling compatibility mode for protocol 2.0
    12. debug1: Local version string SSH-2.0-OpenSSH_7.4
    13. debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1
    14. debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000
    15. debug1: Authenticating to 58.83.177.88:2222 as 'pc_zhongyinxj'
    16. debug1: SSH2_MSG_KEXINIT sent
    17. debug1: SSH2_MSG_KEXINIT received
    18. debug1: kex: algorithm: curve25519-sha256@libssh.org
    19. debug1: kex: host key algorithm: ssh-rsa
    20. debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
    21. debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
    22. debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
    23. debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
    24. debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
    25. debug1: Server host key: ssh-rsa SHA256:XiO4YlCW3+hGari2n4YiL35pHNAl4guUQ/gOCt/bPYQ
    26. debug1: Host '[58.83.177.88]:2222' is known and matches the RSA host key.
    27. debug1: Found key in /home/boccfc/.ssh/known_hosts:1
    28. debug1: rekey after 134217728 blocks
    29. debug1: SSH2_MSG_NEWKEYS sent
    30. debug1: expecting SSH2_MSG_NEWKEYS
    31. debug1: SSH2_MSG_NEWKEYS received
    32. debug1: rekey after 134217728 blocks
    33. debug1: SSH2_MSG_SERVICE_ACCEPT received
    34. debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
    35. debug1: Next authentication method: gssapi-keyex
    36. debug1: No valid Key exchange context
    37. debug1: Next authentication method: gssapi-with-mic
    38. debug1: Unspecified GSS failure.  Minor code may provide more information
    39. No Kerberos credentials available (default cache: KEYRING:persistent:310)
    41. debug1: Unspecified GSS failure.  Minor code may provide more information
    42. No Kerberos credentials available (default cache: KEYRING:persistent:310)
    44. debug1: Next authentication method: publickey
    45. debug1: Trying private key: /home/boccfc/app/id_ecdsa_pc_zhongyinxj_online
    46. debug1: Authentication succeeded (publickey).
    47. Authenticated to 58.83.177.88 ([58.83.177.88]:2222).
    48. debug1: channel 0: new [client-session]
    49. debug1: Requesting no-more-sessions@openssh.com
    50. debug1: Entering interactive session.
    51. debug1: pledge: network
    52. debug1: Sending environment.
    53. debug1: Sending env LANG = en_US.UTF-8
    54. debug1: Sending subsystem: sftp
    55. Connected to 58.83.177.88.
    56. sftp> exit
    57. debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
    58. debug1: channel 0: free: client-session, nchannels 1
    59. debug1: fd 0 clearing O_NONBLOCK
    60. Transferred: sent 2264, received 2732 bytes, in 2.1 seconds
    61. Bytes per second: sent 1088.2, received 1313.2
    62. debug1: Exit status 0
    63. [boccfc@ftp-ap01 ~]$

    故障定位：

    还没有进入key交换过程、判断到网络

    然后定位为什么被拒绝

    追查到对端 对端server端设置了白名单 放行的IP地址不对，通过子网掩码换算出来的地址

    1. [chroot@uat-nfs-server ~]$ sftp -oPort=22222 liwm@10.182.210.155
    2. kex_exchange_identification: Connection closed by remote host
    3. Connection closed by 10.182.210.155 port 22222
    4. Connection closed.  
    5. Connection closed
    6. [chroot@uat-nfs-server ~]$
    1. [chroot@uat-nfs-server ~]$ sftp -P 22222 test@10.182.210.155
    2. Unable to negotiate with 10.182.210.155 port 22222: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
    3. Connection closed.  
    4. Connection closed
    5. [chroot@uat-nfs-server ~]$
    1. [chroot@uat-nfs-server ~]$ sftp -oIdentityFile=/root/test.pub -oPort=22222 test@10.182.210.155
    2. load pubkey "/root/test.pub": Permission denied
    3. load pubkey "/root/test.pub": Permission denied
    4. Unable to negotiate with 10.182.210.155 port 22222: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
    5. Connection closed.  
    6. Connection closed
    7. [chroot@uat-nfs-server ~]$
    1. [chroot@uat-nfs-server ~]$ sftp -oIdentityFile=/home/chroot/test.pub -oPort=22222 test@10.182.210.155
    2. load pubkey "/home/chroot/test.pub": invalid format
    3. Unable to negotiate with 10.182.210.155 port 22222: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
    4. Connection closed.  
    5. Connection closed
    6. [chroot@uat-nfs-server ~]$ ssh -Q kex
    7. diffie-hellman-group1-sha1
    8. diffie-hellman-group14-sha1
    9. diffie-hellman-group14-sha256
    10. diffie-hellman-group16-sha512
    11. diffie-hellman-group18-sha512
    12. diffie-hellman-group-exchange-sha1
    13. diffie-hellman-group-exchange-sha256
    14. ecdh-sha2-nistp256
    15. ecdh-sha2-nistp384
    16. ecdh-sha2-nistp521
    17. curve25519-sha256
    18. curve25519-sha256@libssh.org
    19. sntrup4591761x25519-sha512@tinyssh.org
    20. [chroot@uat-nfs-server ~]$
    22. [chroot@uat-nfs-server ~]$ sftp -v -oIdentityFile=/home/chroot/test.pub -oPort=22222 test@10.182.210.155
    23. OpenSSH_8.3p1, OpenSSL 1.1.1g  21 Apr 2020
    24. debug1: Reading configuration data /etc/ssh/ssh_config
    25. debug1: /etc/ssh/ssh_config line 58: Applying options for *
    26. debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
    27. debug1: Connecting to 10.182.210.155 [10.182.210.155] port 22222.
    28. debug1: Connection established.
    29. load pubkey "/home/chroot/test.pub": invalid format
    30. debug1: identity file /home/chroot/test.pub type -1
    31. debug1: identity file /home/chroot/test.pub-cert type -1
    32. debug1: Local version string SSH-2.0-OpenSSH_8.3
    33. debug1: Remote protocol version 2.0, remote software version Serv-U_15.1.2.189
    34. debug1: no match: Serv-U_15.1.2.189
    35. debug1: Authenticating to 10.182.210.155:22222 as 'test'
    36. debug1: SSH2_MSG_KEXINIT sent
    37. debug1: SSH2_MSG_KEXINIT received
    38. debug1: kex: algorithm: (no match)
    39. Unable to negotiate with 10.182.210.155 port 22222: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
    40. Connection closed.  
    41. Connection closed
    42. [chroot@uat-nfs-server ~]$

    故障2
    debug1: Sending subsystem: sftp Received message too long 1416128883
    拒绝：

    1. [chroot@ntp-server-it-ap02 ~]$ /usr/bin/sftp -v  -oPort=22 -v ewftp@10.82.100.250
    2. OpenSSH_8.3p1, OpenSSL 1.1.1g  21 Apr 2020
    3. debug1: Reading configuration data /etc/ssh/ssh_config
    4. debug1: /etc/ssh/ssh_config line 58: Applying options for *
    5. /etc/ssh/ssh_config line 59: Unsupported option "gssapiauthentication"
    6. debug2: resolve_canonicalize: hostname 10.82.100.250 is address
    7. debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
    8. debug2: ssh_connect_direct
    9. debug1: Connecting to 10.82.100.250 [10.82.100.250] port 22.
    10. debug1: Connection established.
    11. debug1: identity file /home/chroot/.ssh/id_rsa type 0
    12. debug1: identity file /home/chroot/.ssh/id_rsa-cert type -1
    13. debug1: identity file /home/chroot/.ssh/id_dsa type -1
    14. debug1: identity file /home/chroot/.ssh/id_dsa-cert type -1
    15. debug1: identity file /home/chroot/.ssh/id_ecdsa type -1
    16. debug1: identity file /home/chroot/.ssh/id_ecdsa-cert type -1
    17. debug1: identity file /home/chroot/.ssh/id_ecdsa_sk type -1
    18. debug1: identity file /home/chroot/.ssh/id_ecdsa_sk-cert type -1
    19. debug1: identity file /home/chroot/.ssh/id_ed25519 type -1
    20. debug1: identity file /home/chroot/.ssh/id_ed25519-cert type -1
    21. debug1: identity file /home/chroot/.ssh/id_ed25519_sk type -1
    22. debug1: identity file /home/chroot/.ssh/id_ed25519_sk-cert type -1
    23. debug1: identity file /home/chroot/.ssh/id_xmss type -1
    24. debug1: identity file /home/chroot/.ssh/id_xmss-cert type -1
    25. debug1: Local version string SSH-2.0-OpenSSH_8.3
    26. debug1: Remote protocol version 2.0, remote software version OpenSSH_8.3
    27. debug1: match: OpenSSH_8.3 pat OpenSSH* compat 0x04000000
    28. debug2: fd 3 setting O_NONBLOCK
    29. debug1: Authenticating to 10.82.100.250:22 as 'ewftp'
    30. debug1: SSH2_MSG_KEXINIT sent
    31. debug1: SSH2_MSG_KEXINIT received
    32. debug2: local client KEXINIT proposal
    33. debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
    34. debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
    35. debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
    36. debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
    37. debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    38. debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    39. debug2: compression ctos: none,zlib@openssh.com,zlib
    40. debug2: compression stoc: none,zlib@openssh.com,zlib
    41. debug2: languages ctos: 
    42. debug2: languages stoc: 
    43. debug2: first_kex_follows 0 
    44. debug2: reserved 0 
    45. debug2: peer server KEXINIT proposal
    46. debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
    47. debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
    48. debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
    49. debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
    50. debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    51. debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
    52. debug2: compression ctos: none,zlib@openssh.com
    53. debug2: compression stoc: none,zlib@openssh.com
    54. debug2: languages ctos: 
    55. debug2: languages stoc: 
    56. debug2: first_kex_follows 0 
    57. debug2: reserved 0 
    58. debug1: kex: algorithm: curve25519-sha256
    59. debug1: kex: host key algorithm: ecdsa-sha2-nistp256
    60. debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
    61. debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
    62. debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
    63. debug1: Server host key: ecdsa-sha2-nistp256 SHA256:vK5YbifEyx0aZhFqQU7qtFLFhc0Vz3HIM2aBEH2FoWo
    64. debug1: Host '10.82.100.250' is known and matches the ECDSA host key.
    65. debug1: Found key in /home/chroot/.ssh/known_hosts:8
    66. debug2: set_newkeys: mode 1
    67. debug1: rekey out after 134217728 blocks
    68. debug1: SSH2_MSG_NEWKEYS sent
    69. debug1: expecting SSH2_MSG_NEWKEYS
    70. debug1: SSH2_MSG_NEWKEYS received
    71. debug2: set_newkeys: mode 0
    72. debug1: rekey in after 134217728 blocks
    73. debug1: Will attempt key: /home/chroot/.ssh/id_rsa RSA SHA256:nn24ysqxCkUv40izxDyijeF9+xhyDi81bf9mGVBEtoo
    74. debug1: Will attempt key: /home/chroot/.ssh/id_dsa 
    75. debug1: Will attempt key: /home/chroot/.ssh/id_ecdsa 
    76. debug1: Will attempt key: /home/chroot/.ssh/id_ecdsa_sk 
    77. debug1: Will attempt key: /home/chroot/.ssh/id_ed25519 
    78. debug1: Will attempt key: /home/chroot/.ssh/id_ed25519_sk 
    79. debug1: Will attempt key: /home/chroot/.ssh/id_xmss 
    80. debug2: pubkey_prepare: done
    81. debug1: SSH2_MSG_EXT_INFO received
    82. debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com>
    83. debug2: service_accept: ssh-userauth
    84. debug1: SSH2_MSG_SERVICE_ACCEPT received
    85. Be sure you are authorized to access this system!
    86. debug1: Authentications that can continue: publickey,password
    87. debug1: Next authentication method: publickey
    88. debug1: Offering public key: /home/chroot/.ssh/id_rsa RSA SHA256:nn24ysqxCkUv40izxDyijeF9+xhyDi81bf9mGVBEtoo
    89. debug2: we sent a publickey packet, wait for reply
    90. debug1: Authentications that can continue: publickey,password
    91. debug1: Trying private key: /home/chroot/.ssh/id_dsa
    92. debug1: Trying private key: /home/chroot/.ssh/id_ecdsa
    93. debug1: Trying private key: /home/chroot/.ssh/id_ecdsa_sk
    94. debug1: Trying private key: /home/chroot/.ssh/id_ed25519
    95. debug1: Trying private key: /home/chroot/.ssh/id_ed25519_sk
    96. debug1: Trying private key: /home/chroot/.ssh/id_xmss
    97. debug2: we did not send a packet, disable method
    98. debug1: Next authentication method: password
    99. ewftp@10.82.100.250's password: 
    100. debug2: we sent a password packet, wait for reply
    101. debug1: Authentication succeeded (password).
    102. Authenticated to 10.82.100.250 ([10.82.100.250]:22).
    103. debug2: fd 4 setting O_NONBLOCK
    104. debug1: channel 0: new [client-session]
    105. debug2: channel 0: send open
    106. debug1: Requesting no-more-sessions@openssh.com
    107. debug1: Entering interactive session.
    108. debug1: pledge: network
    109. debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
    110. debug2: channel_input_open_confirmation: channel 0: callback start
    111. debug2: fd 3 setting TCP_NODELAY
    112. debug2: client_session2_setup: id 0
    113. debug1: Sending environment.
    114. debug1: Sending env LANG = en_US.UTF-8
    115. debug2: channel 0: request env confirm 0
    116. debug1: Sending subsystem: sftp
    117. debug2: channel 0: request subsystem confirm 1
    118. debug2: channel_input_open_confirmation: channel 0: callback done
    119. debug2: channel 0: open confirm rwindow 0 rmax 32768
    120. debug2: channel 0: rcvd adjust 2097152
    121. debug2: channel_input_status_confirm: type 99 id 0
    122. debug2: subsystem request accepted on channel 0
    123. Received message too long 1416128883
    124. Ensure the remote shell produces no output for non-interactive sessions.
    125. debug2: channel 0: read<=0 rfd 4 len -1
    126. debug2: channel 0: read failed
    127. debug2: channel 0: chan_shutdown_read (i0 o0 sock -1 wfd 4 efd 6 [write])
    128. debug2: channel 0: input open -> drain
    129. debug2: channel 0: rcvd eof
    130. debug2: channel 0: output open -> drain
    131. debug2: channel 0: obuf empty
    132. debug2: channel 0: chan_shutdown_write (i1 o1 sock -1 wfd 5 efd 6 [write])
    133. debug2: channel 0: output drain -> closed
    134. debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
    135. debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
    136. debug2: channel 0: rcvd eow
    137. debug2: channel 0: rcvd close
    138. debug2: channel 0: send eof
    139. debug2: channel 0: input drain -> closed
    140. debug2: channel 0: almost dead
    141. debug2: channel 0: gc: notify user
    142. debug2: channel 0: gc: user detached
    143. debug2: channel 0: send close
    144. debug2: channel 0: is dead
    145. debug2: channel 0: garbage collecting
    146. debug1: channel 0: free: client-session, nchannels 1
    147. debug1: fd 0 clearing O_NONBLOCK
    148. Transferred: sent 2552, received 2452 bytes, in 0.1 seconds
    149. Bytes per second: sent 49931.9, received 47975.3
    150. debug1: Exit status 1
    151. [chroot@ntp-server-it-ap02 ~]$

    报错信息：

    1. debug1: Sending subsystem: sftp
    2. Received message too long 1416128883
    3. Ensure the remote shell produces no output for non-interactive sessions.

    解决：
    image.png
    /sbin/nologin，所以导致你在进行SFTP的时候出现了这个问题
    解决方案有以下两个：
    （1）该用户需要修改用户权限，使用命令：usermod -s /bin/bash 用户名来放开限制，这样子你就可以成功登录了；
    （2）如果他必须要限制你的访问权限，不允许你除了登录SFTP外的任何操作，那么他需要在/etc/ssh/sshd_config文件下修改一些信息

    Subsystem sftp internal-sftp，通过内部登录SFTP
    systemctl restart sshd.service来重启sshd服务
    image.png