SSH仅在本地登录服务器后才允许远程连接

我已经在我的旧笔记本上安装了Ubuntu Server 16.04 32位，它连接到互联网（外部IP）。 从一开始我就添加了ufw和Fail2ban。 但后来我发现重启后我无法远程进入服务器。

经过多次尝试后，我终于可以理解，这不是因为我在Fail2ban上设置了exception，或者因为我禁用了ufw ssh服务器再次接受远程连接（暂时，直到下次重启）。

在我的情况下，什么是hash开始只在本地登录服务器后才开始回答。

有什么建议吗？ 也许是与我的用户目录加密有关的东西？

SERVER AUTH.LOG

Feb 11 14:18:16 servername systemd-logind[1274]: System is rebooting. Feb 11 14:19:14 servername CRON[1311]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 11 14:19:14 servername su[1374]: Successful su for noip by root Feb 11 14:19:14 servername su[1374]: + ??? root:noip Feb 11 14:19:14 servername su[1374]: pam_unix(su:session): session opened for user noip by (uid=0) Feb 11 14:19:15 servername systemd-logind[1331]: New seat seat0. Feb 11 14:19:15 servername systemd-logind[1331]: Watching system buttons on /dev/input/event3 (Power Button) Feb 11 14:19:15 servername systemd-logind[1331]: Watching system buttons on /dev/input/event5 (Video Bus) Feb 11 14:19:15 servername systemd-logind[1331]: Watching system buttons on /dev/input/event0 (Power Button) Feb 11 14:19:15 servername systemd-logind[1331]: Watching system buttons on /dev/input/event1 (Lid Switch) Feb 11 14:19:15 servername systemd-logind[1331]: Watching system buttons on /dev/input/event2 (Sleep Button) Feb 11 14:19:15 servername systemd-logind[1331]: Watching system buttons on /dev/input/event9 (HP WMI hotkeys) Feb 11 14:19:15 servername systemd: pam_unix(systemd-user:session): session opened for user noip by (uid=0) Feb 11 14:19:15 servername systemd-logind[1331]: New session 1 of user noip. Feb 11 14:19:15 servername su[1374]: pam_unix(su:session): session closed for user noip Feb 11 14:19:16 servername sshd[1287]: Server listening on 0.0.0.0 port 22. Feb 11 14:19:16 servername CRON[1311]: pam_unix(cron:session): session closed for user root Feb 11 14:19:16 servername systemd-logind[1331]: Removed session 1. Feb 11 14:19:16 servername systemd: pam_unix(systemd-user:session): session closed for user noip Feb 11 14:19:44 servername sshd[1860]: Connection closed by xxxx port 49743 [preauth] Feb 11 14:20:01 servername login[1863]: pam_ecryptfs: Passphrase file wrapped Feb 11 14:20:03 servername login[1410]: pam_unix(login:session): session opened for user noliva by LOGIN(uid=0) Feb 11 14:20:03 servername systemd: pam_unix(systemd-user:session): session opened for user noliva by (uid=0) Feb 11 14:20:03 servername systemd-logind[1331]: New session 2 of user noliva. Feb 11 14:20:12 servername sshd[1942]: Accepted publickey for noliva from xxxx port 49744 ssh2: RSA SHA256:yyyy Feb 11 14:20:12 servername sshd[1942]: pam_unix(sshd:session): session opened for user noliva by (uid=0) Feb 11 14:20:12 servername systemd-logind[1331]: New session 3 of user noliva. Feb 11 14:20:25 servername sudo: noliva : TTY=pts/0 ; PWD=/home/noliva ; USER=root ; COMMAND=/usr/bin/vi /var/log/auth.log 

客户端，在本地登录服务器之前：

 iMac-de-noliva:log noliva$ ssh -v -v -v noliva@xxxx OpenSSH_7.3p1, LibreSSL 2.4.1 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 20: Applying options for * debug2: resolving "xxxx" port 22 debug2: ssh_connect_direct: needpriv 0 debug1: Connecting to xxxx [xxxx] port 22. debug1: Connection established. debug1: identity file /Users/noliva/.ssh/id_rsa type 1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_rsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_dsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.3 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 pat OpenSSH* compat 0x04000000 debug2: fd 3 setting O_NONBLOCK debug1: Authenticating to xxxx:22 as 'noliva' debug3: hostkeys_foreach: reading file "/Users/noliva/.ssh/known_hosts" debug3: record_hostkey: found key type ECDSA in file /Users/noliva/.ssh/known_hosts:6 debug3: load_hostkeys: loaded 1 keys from xxxx debug3: order_hostkeyalgs: prefer hostkeyalgs: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 debug3: send packet: type 20 debug1: SSH2_MSG_KEXINIT sent debug3: receive packet: type 20 debug1: SSH2_MSG_KEXINIT received debug2: local client KEXINIT proposal debug2: KEX algorithms: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c debug2: host key algorithms: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[e-mail],[e-mail],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa debug2: ciphers ctos: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc debug2: ciphers stoc: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc debug2: MACs ctos: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: MACs stoc: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: compression ctos: none,[e-mail],zlib debug2: compression stoc: none,[e-mail],zlib debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug2: peer server KEXINIT proposal debug2: KEX algorithms: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1 debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 debug2: ciphers ctos: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail] debug2: ciphers stoc: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail] debug2: MACs ctos: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: MACs stoc: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: compression ctos: none,[e-mail] debug2: compression stoc: none,[e-mail] debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug1: kex: algorithm: [e-mail] debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: [e-mail] MAC:  compression: none debug1: kex: client->server cipher: [e-mail] MAC:  compression: none debug3: send packet: type 30 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug3: receive packet: type 31 debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5KVog8lQVx18HDJnyjAqJTIyjfkbomRD75l817SPDXs debug3: hostkeys_foreach: reading file "/Users/noliva/.ssh/known_hosts" debug3: record_hostkey: found key type ECDSA in file /Users/noliva/.ssh/known_hosts:6 debug3: load_hostkeys: loaded 1 keys from xxxx debug1: Host 'xxxx' is known and matches the ECDSA host key. debug1: Found key in /Users/noliva/.ssh/known_hosts:6 debug3: send packet: type 21 debug2: set_newkeys: mode 1 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: receive packet: type 21 debug2: set_newkeys: mode 0 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS received debug2: key: /Users/noliva/.ssh/id_rsa (0x7f94cf7000a0) debug2: key: /Users/noliva/.ssh/id_dsa (0x0) debug2: key: /Users/noliva/.ssh/id_ecdsa (0x0) debug2: key: /Users/noliva/.ssh/id_ed25519 (0x0) debug3: send packet: type 5 debug3: receive packet: type 7 debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs= debug3: receive packet: type 6 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug3: send packet: type 50 debug3: receive packet: type 51 debug1: Authentications that can continue: publickey debug3: start over, passed a different list publickey debug3: preferred publickey,keyboard-interactive,password debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: /Users/noliva/.ssh/id_rsa debug3: send_pubkey_test debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey debug1: Trying private key: /Users/noliva/.ssh/id_dsa debug3: no such identity: /Users/noliva/.ssh/id_dsa: No such file or directory debug1: Trying private key: /Users/noliva/.ssh/id_ecdsa debug3: no such identity: /Users/noliva/.ssh/id_ecdsa: No such file or directory debug1: Trying private key: /Users/noliva/.ssh/id_ed25519 debug3: no such identity: /Users/noliva/.ssh/id_ed25519: No such file or directory debug2: we did not send a packet, disable method debug1: No more authentication methods to try. Permission denied (publickey). 

客户端，本地登录服务器后：

 iMac-de-noliva:log noliva$ ssh -v -v -v noliva@xxxx OpenSSH_7.3p1, LibreSSL 2.4.1 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 20: Applying options for * debug2: resolving "xxxx" port 22 debug2: ssh_connect_direct: needpriv 0 debug1: Connecting to xxxx [xxxx] port 22. debug1: Connection established. debug1: identity file /Users/noliva/.ssh/id_rsa type 1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_rsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_dsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/noliva/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_7.3 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 pat OpenSSH* compat 0x04000000 debug2: fd 3 setting O_NONBLOCK debug1: Authenticating to xxxx:22 as 'noliva' debug3: hostkeys_foreach: reading file "/Users/noliva/.ssh/known_hosts" debug3: record_hostkey: found key type ECDSA in file /Users/noliva/.ssh/known_hosts:6 debug3: load_hostkeys: loaded 1 keys from xxxx debug3: order_hostkeyalgs: prefer hostkeyalgs: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 debug3: send packet: type 20 debug1: SSH2_MSG_KEXINIT sent debug3: receive packet: type 20 debug1: SSH2_MSG_KEXINIT received debug2: local client KEXINIT proposal debug2: KEX algorithms: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c debug2: host key algorithms: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[e-mail],[e-mail],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa debug2: ciphers ctos: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc debug2: ciphers stoc: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc debug2: MACs ctos: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: MACs stoc: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: compression ctos: none,[e-mail],zlib debug2: compression stoc: none,[e-mail],zlib debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug2: peer server KEXINIT proposal debug2: KEX algorithms: [e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1 debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 debug2: ciphers ctos: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail] debug2: ciphers stoc: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail] debug2: MACs ctos: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: MACs stoc: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1 debug2: compression ctos: none,[e-mail] debug2: compression stoc: none,[e-mail] debug2: languages ctos: debug2: languages stoc: debug2: first_kex_follows 0 debug2: reserved 0 debug1: kex: algorithm: [e-mail] debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: [e-mail] MAC:  compression: none debug1: kex: client->server cipher: [e-mail] MAC:  compression: none debug3: send packet: type 30 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug3: receive packet: type 31 debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5KVog8lQVx18HDJnyjAqJTIyjfkbomRD75l817SPDXs debug3: hostkeys_foreach: reading file "/Users/noliva/.ssh/known_hosts" debug3: record_hostkey: found key type ECDSA in file /Users/noliva/.ssh/known_hosts:6 debug3: load_hostkeys: loaded 1 keys from xxxx debug1: Host 'xxxx' is known and matches the ECDSA host key. debug1: Found key in /Users/noliva/.ssh/known_hosts:6 debug3: send packet: type 21 debug2: set_newkeys: mode 1 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug3: receive packet: type 21 debug2: set_newkeys: mode 0 debug1: rekey after 134217728 blocks debug1: SSH2_MSG_NEWKEYS received debug2: key: /Users/noliva/.ssh/id_rsa (0x7fbebf420020) debug2: key: /Users/noliva/.ssh/id_dsa (0x0) debug2: key: /Users/noliva/.ssh/id_ecdsa (0x0) debug2: key: /Users/noliva/.ssh/id_ed25519 (0x0) debug3: send packet: type 5 debug3: receive packet: type 7 debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs= debug3: receive packet: type 6 debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug3: send packet: type 50 debug3: receive packet: type 51 debug1: Authentications that can continue: publickey debug3: start over, passed a different list publickey debug3: preferred publickey,keyboard-interactive,password debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Offering RSA public key: /Users/noliva/.ssh/id_rsa debug3: send_pubkey_test debug3: send packet: type 50 debug2: we sent a publickey packet, wait for reply debug3: receive packet: type 60 debug1: Server accepts key: pkalg rsa-sha2-512 blen 279 debug2: input_userauth_pk_ok: fp SHA256:yyyyy debug3: sign_and_send_pubkey: RSA SHA256:xxxxx Enter passphrase for key '/Users/noliva/.ssh/id_rsa': 

Answer 1

问题是，当您未登录系统时，您的主文件夹已加密，文件~/.ssh/authorized_keys无法访问。

help.ubuntu.com上 文章SSH / OpenSSH / Keys的故障排除一节中描述了一个简单的解决方案。

要解决此问题，请在家外创建名为/etc/ssh/的文件夹（将替换为您的实际用户名）。 此目录应具有755个权限，并由用户拥有。 将authorized_keys文件移入其中。 authorized_keys文件应具有644权限并由用户拥有。

然后编辑/etc/ssh/sshd_config并添加：

 AuthorizedKeysFile /etc/ssh/%u/authorized_keys 

---

如果要为当前用户执行此操作（并且它位于sudoers组中），命令行可能如下所示：

 sudo mkdir /etc/ssh/$USER sudo mv $HOME/.ssh/authorized_keys /etc/ssh/$USER/ sudo chown -R $USER:$USER /etc/ssh/$USER sudo chmod 755 /etc/ssh/$USER sudo chmod 644 /etc/ssh/$USER/authorized_keys 

^{*其中$USER和$HOME是包含当前用户的用户名和主目录的envvars 。}

然后编辑/etc/ssh/sshd_config并以这种方式更改指令AuthorizedKeysFile ：

 #AuthorizedKeysFile %h/.ssh/authorized_keys AuthorizedKeysFile /etc/ssh/%u/authorized_keys 

重启SSH服务器：

 sudo systemctl restart ssh.service 

而已。

---

参考文献和其他方法：

• 来自help.ubuntu.com的文章“SSH / OpenSSH / Keys”
• 在Ask Ubuntu中的类似问题
• 超级用户的答案
• 错误362427 | 公钥ssh auth不适用于我的加密主目录
• 文章“加密的主目录+ SSH密钥认证”进入斯蒂芬的空间