ssh_client和server功能调试

本文介绍了SSH连接中常见的四种错误及其解决方案,包括验证方式不支持、普通用户登录密码始终错误、PRNG未播种以及PTY分配请求失败等问题,并提供了详细的步骤来帮助读者解决问题。

1 验证方式不支持

  如客户端登录时提示如下:

[www.linuxidc.com@CentOS-6-37 ~]$ ssh monitor@192.168.1.5

Permission denied (publickey,keyboard-interactive).

  解决方法:

    设置sshd的配置文件(sshd_config)的这条配置:PasswordAuthentication yes

    然后重启服务:service sshd restart


2 普通用户登录密码始终错误,sshd启动有报错

  sshd启动报错:

    Unsupported option GSSAPIAuthentication
    Unsupported option GSSAPICleanupCredentials

  解决方法:

    注销sshd的配置文件(sshd_config)的如下配置:

    #GSSAPIAuthentication yes
    #GSSAPICleanupCredentials yes
    #UsePAM yes

    然后重启服务:service sshd restart

3. 报错 PRNG is not seeded

root@localhost:/# /etc/init.d/ssh restart
PRNG is not seeded

After investigation we found that the /dev/urandom was not there on the VPS.

root@localhost:/dev# ls -al /dev/random
crw-r--r-- 1 root root 1, 8 Mar  2 19:28 /dev/random

root@localhost:/dev# ls -al /dev/urandom
ls: cannot access /dev/urandom: No such file or directory

By the below command, we created it and restarted SSH

root@localhost:/dev# mknod /dev/urandom c 1 9
root@localhost:/dev# /etc/init.d/ssh  restart
* Restarting OpenBSD Secure Shell server sshd
...done.

4. 报错:

PTY allocation request failed on channel 0

可以用如下方式修改

1.rm -rf /dev/ptmx
2.mknod /dev/ptmx c 5 2
3.chmod 666 /dev/ptmx
4.umount /dev/pts
5.rm -rf /dev/pts
6.mkdir /dev/pts
7.mount /dev/pts


static int tmp_client_open_ssh(TmpClient *self) { int _ret = OK; self->internalData = (TMPC_SSH_DATA *)TMPC_MALLOC(sizeof(TMPC_SSH_DATA)); TMPC_CHECK(NULL == self->internalData); TMPC_SSH_DATA *internal = (TMPC_SSH_DATA *)self->internalData; memset(internal, 0, sizeof(TMPC_SSH_DATA)); internal->chan = INVALID_SOCKET; internal->inetdId = -1; internal->sshcli = ipssh_client_open(); TMPC_CHECK (NULL == internal->sshcli); internal->sess = ipssh_client_port_fwd_open(internal->sshcli); TMPC_CHECK (NULL == internal->sess); TMPC_CHECK(ipssh_client_port_fwd_set_userid_pw(internal->sshcli, self->user, self->passwd)); TMPC_CHECK(ipssh_client_port_fwd_set_hostname_port(internal->sshcli, self->serverHost, self->sshPort)); exit: if (_ret != OK) tmp_client_close_ssh(self); return _ret; } static int tmp_client_connect_ssh(TmpClient *self) { int _ret; /* 用于端口转发的本地port,该port会由ssh client监听 */ int localPort = 0; TMPC_SSH_DATA *internal = (TMPC_SSH_DATA *)self->internalData; TMPC_INFO("0x%x ipssh_client_port_fwd_set_host_port", self); TMPC_CHECK_RET(ipssh_client_port_fwd_set_host_port(internal->sess, "127.0.0.1", self->serverPort, "127.0.0.1", (localPort))); TMPC_INFO("0x%x ipssh_client_port_fwd_connect", self); TMPC_CHECK_RET (ipssh_client_port_fwd_connect(internal->sess)); TMPC_CHECK_RET(ipssh_client_port_fwd_get_local_port(internal->sess, &localPort)); TMPC_CHECK(localPort == 0); TMPC_INFO("0x%x tmp_client_connect_ssh local port is %d", self, localPort); UINT16 port = rdmPort(LOCAL_PORT, PKT_TCP); TMPC_CHECK(port <= 0); openPort(LOCAL_PORT, port, PKT_TCP); internal->chan = sockCreateTcp(htonl(INADDR_LOOPBACK), htons(port)); TMPC_CHECK_FMT(ERROR == internal->chan, "create local sock fail"); /* 异步 */ TMPC_CHECK_FMT(ERROR == sockNonBlock(internal->chan), "socket set non block fail"); struct sockaddr_in dst; bzero((void *)&dst, sizeof(struct sockaddr_in)); dst.sin_family = AF_INET; dst.sin_port = htons(localPort); dst.sin_addr.s_addr = htonl(INADDR_LOOPBACK); internal->inetdId = inetSocketAdd(internal->chan, (void *)tmp_client_inetd_cb, tmp_client_inetd_flush, NULL, (void *)tmp_client_inetd_timeout); TMPC_CHECK(ERROR == internal->inetdId); TMPC_INFO("0x%x connect", self); int rc = connect(internal->chan, (struct sockaddr*)&dst, sizeof(dst)); if (rc == ERROR && errno != EINPROGRESS) { TMPC_CHECK_FMT(TRUE, "ssh_channel_open_forward"); } exit: if (_ret != OK) tmp_client_close_ssh(self); return _ret; } 解释以上代码的功能
10-25
IP_STATIC Ip_err ipssh_parse_kexinit(Ipssh_conn* ssh_conn, Ipcom_buffer* pkt){ char* str; Ip_u32 dummy; IPCOM_LOG0(DEBUG2, "ipssh_parse_kexinit()"); IPCOM_LOG0(DEBUG2, "ipssh_parse_kexinit :: ssh_conn->mode:%d", ssh_conn->mode); if(ipcom_buffer_get(pkt, ssh_conn->v2_cookie, IPSSH_COOKIE_SIZE) != IPCOM_SUCCESS) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: failed unpack cookie"); return IPCOM_ERR_FAILED; } /* kex_algorithms */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.kex_alg, (int) sizeof(ssh_conn->peer_proposal.kex_alg)) != IPCOM_SUCCESS) { IPCOM_LOG1(ERR, "ipssh_parse_kexinit :: failed to parse kex_alg: %s", str ? str : ""); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: kex algs: %s\n", str); ipcom_free(str); /* server_host_key_algorithms */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.srv_host_key_alg, (int) sizeof(ssh_conn->peer_proposal.srv_host_key_alg)) != IPCOM_SUCCESS) { IPCOM_LOG1(ERR, "ipssh_parse_kexinit :: failed to parse srv_host_key_algs: %s", str ? str : ""); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: srv host key algs: %s\n", str); ipcom_free(str); /* encr algs, clt 2 srv */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.enc_alg_clt2srv, (int) sizeof(ssh_conn->peer_proposal.enc_alg_clt2srv)) != IPCOM_SUCCESS) { IPCOM_LOG1(ERR, "ipssh_parse_kexinit :: failed to parse enc_algs_clt2srv:%s", str ? str : ""); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: clt 2 srv enc algs: %s\n", str); ipcom_free(str); /* encr algs, srv 2 clt */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.enc_alg_srv2clt, (int) sizeof(ssh_conn->peer_proposal.enc_alg_srv2clt)) != IPCOM_SUCCESS) { IPCOM_LOG1(ERR, "ipssh_parse_kexinit :: failed to parse enc_algs_srv2clt: %s", str ? str : ""); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: srv 2 clt enc algs: %s\n", str); ipcom_free(str); /* mac algs, clt 2 srv */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.mac_alg_clt2srv, (int) sizeof(ssh_conn->peer_proposal.mac_alg_clt2srv)) != IPCOM_SUCCESS) { IPCOM_LOG1(ERR, "ipssh_parse_kexinit :: failed to parse mac_algs_clt2srv: %s", str ? str : ""); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: clt 2 srv mac algs: %s\n", str); ipcom_free(str); /* mac algs, srv 2 clt */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.mac_alg_srv2clt, (int) sizeof(ssh_conn->peer_proposal.mac_alg_srv2clt)) != IPCOM_SUCCESS) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: ipssh_str2list() failed for mac_algs_srv2clt"); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: srv 2 clt mac algs: %s\n", str); ipcom_free(str); /* compression algs, clt 2 srv */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.compr_alg_clt2srv, (int) sizeof(ssh_conn->peer_proposal.compr_alg_clt2srv)) != IPCOM_SUCCESS) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: ipssh_str2list() failed for compr_algs_clt2srv"); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: clt 2 srv compr algs: %s\n", str); ipcom_free(str); /* compression algs, srv 2 clt */ str = ipssh_buffer_get_sshstr(pkt); if(!str || ipssh_alg_list_str2id(str, ssh_conn->peer_proposal.compr_alg_srv2clt, (int) sizeof(ssh_conn->peer_proposal.compr_alg_srv2clt)) != IPCOM_SUCCESS) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: ipssh_str2list() failed for compr_algs_srv2clt"); if(str) ipcom_free(str); return IPCOM_ERR_FAILED; } printf("ipssh_parse_kexinit :: srv 2 clt compr algs: %s\n", str); ipcom_free(str); /* languages, clt 2 srv. Ignore for now */ str = ipssh_buffer_get_sshstr(pkt); if(!str) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: ipssh_str2list() failed for lang_clt2srv"); return IPCOM_ERR_FAILED; } ipcom_free(str); /* languanges, srv 2 clt */ str = ipssh_buffer_get_sshstr(pkt); if(!str) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: ipssh_str2list() failed for lang_srv2clt"); return IPCOM_ERR_FAILED; } ipcom_free(str); if(ipcom_buffer_get(pkt, &ssh_conn->first_kex_pkt_follows, 1) != IPCOM_SUCCESS) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: failed to read first_key_pkt_follows"); return IPCOM_ERR_FAILED; } if(ipssh_buffer_get_uint(pkt, &dummy) != IPCOM_SUCCESS) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: failed to read reserved int"); return IPCOM_ERR_FAILED; } if(ipssh_choose_algs(ssh_conn)) { IPCOM_LOG0(ERR, "ipssh_parse_kexinit :: ipssh_choose_algs() failed"); return IPCOM_ERR_FAILED; } if(ssh_conn->first_kex_pkt_follows) { /* Check if the guessed algorithms are correct */ if(ssh_conn->peer_proposal.kex_alg[0] != ssh_conn->conn_prop_pending.kex_alg[0]) ssh_conn->skip_guessed_kex_pkt = 1; if(ssh_conn->peer_proposal.srv_host_key_alg[0] != ssh_conn->conn_prop_pending.srv_host_key_alg[0]) ssh_conn->skip_guessed_kex_pkt = 1; } return IPCOM_SUCCESS; }解释以上代码
最新发布
11-27
ipssh_send_kex_dh_init(Ipssh_conn* ssh_conn) { Ip_err rc = IPCOM_ERR_FAILED; Ipcom_buffer* pkt; Ip_u8* ptr; int len; IPCOM_LOG1(DEBUG, "ipssh_send_kex_dh_init :: ssh_conn: %x", ssh_conn); pkt = ipssh_buffer_new_v2_pkt(1024, IPSSH_MSG_KEXDH_INIT); if(!pkt) { IPCOM_LOG0(ERR, "ipssh_send_kex_dh_init :: out of memory"); return IPCOM_ERR_FAILED; } if (ssh_conn->conn_prop_pending.kex_alg[0] == IPSSH_KEYEX_DH_GR14_SHA1_ID || ssh_conn->conn_prop_pending.kex_alg[0] == IPSSH_KEYEX_DH_GR14_SHA256_ID) { if(!(ssh_conn->dh_data->dh = ipssh_create_dh_group14())) { IPCOM_LOG0(ERR, "ipssh_send_msg_kex_dh_init :: ipssh_create_dh_group14() failed"); goto cleanup; } } else { if(!(ssh_conn->dh_data->dh = ipssh_create_dh_group1())) { IPCOM_LOG0(ERR, "ipssh_send_msg_kex_dh_init :: ipssh_create_dh_group1() failed"); goto cleanup; } } /* Generate random number y and create e = g^x mod p */ if(!DH_generate_key(ssh_conn->dh_data->dh)) { IPCOM_LOG0(ERR, "ipssh_send_msg_kex_dh_init :: DH_generate_key() failed"); goto cleanup; } ptr = ipcom_buffer_end_ptr(pkt); if(ipssh_buffer_put_bn(pkt, ssh_conn->dh_data->dh->pub_key) < 0) { IPCOM_LOG0(ERR, "ipssh_send_msg_kex_dh_init :: ipssh_buffer_put_bn() failed"); goto cleanup; } ptr += 4; /* proceed past length field */ len = ipcom_buffer_end_ptr(pkt) - ptr; if(ipssh_msg2list((Ipssh_msg_list*)&(ssh_conn->handshake_msgs), IPSSH_MPINT, ptr, len, 5)) { IPCOM_LOG0(ERR, "ipssh_send_kex_dh_reply :: ipssh_msg2list() failed for f"); goto cleanup; } if(ipssh_send_pkt(ssh_conn, pkt, IP_FALSE) == IPCOM_SUCCESS) { rc = IPCOM_SUCCESS; } cleanup: if(pkt) ipcom_buffer_free(pkt); return rc; }用流程图表示以上代码的功能,并关注这段代码在ssh的密钥交换过程中,不同种类密钥生成的时机(哪个函数生成的)
11-14
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值