無法連接到我的非特權 LXC 訪客中的 sshd。該怎麼辦？

May 6, 2015

所以你配置了你的非特權 LXC 來賓，通過定義
lxc.id_map = u 0 1000000000 10000
lxc.id_map = g 0 1000000000 10000
當然，將這些從屬 UID/GID 範圍分配給現有使用者 ( usermod --add-sub-uids ...)。
然而，每當ssh host你得到：
Read from socket failed: Connection reset by peer
但是，在來賓內部，您可以清楚地看到sshd正在執行（例如，使用lsof -i :22）。
什麼可能是錯的？

OpenSSH 的一般故障排除建議

首先，我向您推薦這個簡短的故障排除指南sshd，我一次又一次地將其用作食譜。

情節變厚了

在這種情況下，唯一的區別是，我曾經lxc-console連接到客戶機，登錄並停止執行sshd，然後在預設埠 22 上啟動我的實例。然後我以更高的詳細度從主機連接到客戶機：

$ ssh -vvvvvvvv host.lan
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /home/joe/.ssh/config
debug1: /home/joe/.ssh/config line 2: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to host.lan [10.0.3.223] port 22.
debug1: Connection established.
debug1: identity file /home/joe/.ssh/id_rsa type -1
debug1: identity file /home/joe/.ssh/id_rsa-cert type -1
debug1: identity file /home/joe/.ssh/id_dsa type -1
debug1: identity file /home/joe/.ssh/id_dsa-cert type -1
debug1: identity file /home/joe/.ssh/id_ecdsa type -1
debug1: identity file /home/joe/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/joe/.ssh/id_ed25519 type -1
debug1: identity file /home/joe/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "host.lan" from file "/home/joe/.ssh/known_hosts"
debug3: load_hostkeys: found key type ED25519 in file /home/joe/.ssh/known_hosts:7
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-ed25519-cert-v01@openssh.com,ssh-ed25519
debug1: SSH2_MSG_KEXINIT sent
Read from socket failed: Connection reset by peer

嗯，該輸出沒有任何啟發性。讓我們檢查連接嘗試的伺服器端輸出：

# $(which sshd) -Dddddddp22
debug2: load_server_config: filename /etc/ssh/sshd_config
debug2: load_server_config: done config len = 724
debug2: parse_server_config: config /etc/ssh/sshd_config len 724
debug3: /etc/ssh/sshd_config:5 setting Port 22
debug3: /etc/ssh/sshd_config:9 setting Protocol 2
debug3: /etc/ssh/sshd_config:11 setting HostKey /etc/ssh/ssh_host_rsa_key
debug3: /etc/ssh/sshd_config:12 setting HostKey /etc/ssh/ssh_host_dsa_key
debug3: /etc/ssh/sshd_config:13 setting HostKey /etc/ssh/ssh_host_ed25519_key
debug3: /etc/ssh/sshd_config:15 setting UsePrivilegeSeparation yes
debug3: /etc/ssh/sshd_config:18 setting KeyRegenerationInterval 3600
debug3: /etc/ssh/sshd_config:19 setting ServerKeyBits 1024
debug3: /etc/ssh/sshd_config:22 setting SyslogFacility AUTH
debug3: /etc/ssh/sshd_config:23 setting LogLevel INFO
debug3: /etc/ssh/sshd_config:26 setting LoginGraceTime 120
debug3: /etc/ssh/sshd_config:27 setting PermitRootLogin without-password
debug3: /etc/ssh/sshd_config:28 setting StrictModes yes
debug3: /etc/ssh/sshd_config:30 setting RSAAuthentication yes
debug3: /etc/ssh/sshd_config:31 setting PubkeyAuthentication yes
debug3: /etc/ssh/sshd_config:35 setting IgnoreRhosts yes
debug3: /etc/ssh/sshd_config:37 setting RhostsRSAAuthentication no
debug3: /etc/ssh/sshd_config:39 setting HostbasedAuthentication no
debug3: /etc/ssh/sshd_config:44 setting PermitEmptyPasswords no
debug3: /etc/ssh/sshd_config:48 setting ChallengeResponseAuthentication no
debug3: /etc/ssh/sshd_config:51 setting PasswordAuthentication no
debug3: /etc/ssh/sshd_config:63 setting X11Forwarding yes
debug3: /etc/ssh/sshd_config:64 setting X11DisplayOffset 10
debug3: /etc/ssh/sshd_config:65 setting PrintMotd no
debug3: /etc/ssh/sshd_config:66 setting PrintLastLog yes
debug3: /etc/ssh/sshd_config:67 setting TCPKeepAlive yes
debug3: /etc/ssh/sshd_config:74 setting AcceptEnv LANG LC_*
debug3: /etc/ssh/sshd_config:76 setting Subsystem sftp /usr/lib/openssh/sftp-server
debug3: /etc/ssh/sshd_config:87 setting UsePAM yes
debug1: sshd version OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug3: Incorrect RSA1 identifier
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_rsa_key" as a RSA1 public key
debug1: private host key: #0 type 1 RSA
debug3: Incorrect RSA1 identifier
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_dsa_key" as a RSA1 public key
debug1: private host key: #0 type 1 RSA
debug3: Incorrect RSA1 identifier
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_dsa_key" as a RSA1 public key
debug1: private host key: #1 type 2 DSA
debug3: Incorrect RSA1 identifier
debug3: Incorrect RSA1 identifier
debug3: Could not load "/etc/ssh/ssh_host_ed25519_key" as a RSA1 public key
debug1: private host key: #2 type 4 ED25519
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-Dddddddp22'
debug3: oom_adjust_setup
Set /proc/self/oom_score_adj from 0 to -1000
debug2: fd 3 setting O_NONBLOCK
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug2: fd 4 setting O_NONBLOCK
debug3: sock_set_v6only: set socket 4 IPV6_V6ONLY
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug3: fd 5 is not O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug3: send_rexec_state: entering fd = 8 config len 724
debug3: ssh_msg_send: type 0
debug3: send_rexec_state: done
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 10.0.3.1 port 51448 on 10.0.3.223 port 22
debug1: Client protocol version 2.0; client software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug2: fd 3 setting O_NONBLOCK
debug2: Network child is on pid 558
debug3: preauth child monitor started
debug3: privsep user:group 101:65534 [preauth]
setgroups: Invalid argument [preauth]
debug1: do_cleanup [preauth]
debug3: PAM: sshpam_thread_cleanup entering [preauth]
debug1: monitor_read_log: child log fd closed
debug3: mm_request_receive entering
debug1: do_cleanup
debug3: PAM: sshpam_thread_cleanup entering
debug1: Killing privsep child 558

請特別注意上述輸出中的以下幾行：

debug1: Killing privsep child 558

表明 OpenSSH（配置指令UsePrivilegeSeparation yes）的權限分離功能存在一些問題，並且：

debug3: privsep user:group 101:65534 [preauth]
setgroups: Invalid argument [preauth]

表示嘗試將程序的有效 GID 更改為 65534。

查看容器配置

現在再次查看容器配置文件中的節：

lxc.id_map = u 0 1000000000 10000
lxc.id_map = g 0 1000000000 10000

它告訴 LXC 為組和使用者 ID 分別創建一個具有 10000 個 ID 的使用者命名空間 ( userns )，從 1000000000 開始。在該命名空間內，UID 1000000000 變為 0，即超級使用者。

解決方案

這個問題有兩種有效的解決方案：

修復容器配置並在映射範圍內至少允許 65535 個從屬 ID，或
UsePrivilegeSeparation no在中設置配置選項sshd_config

背景

container-userns-convert該腳本託管在啟動板上（使用簽出bzr branch lp:~serge-hallyn/+junk/nsexec）並由 LXC 的重要貢獻者之一 Serge Hallyn 編寫，並使用uidmapshift來自同一儲存庫，預設情況下將為映射分配 10k 個從屬 ID。

這讓我絆倒了。通常我自己分配一個 100000 個 ID 的塊（因為它更容易閱讀）或 65535 個。

引用自：https://unix.stackexchange.com/questions/201848

無法連接到我的非特權 LXC 訪客中的 sshd。該怎麼辦？

OpenSSH 的一般故障排除建議

情節變厚了

查看容器配置

解決方案

背景

相關問答

userns容器啟動失敗，如何追查原因？

歸檔 LXC 來賓時如何保存使用者 UID/GID 映射？

知道 OpenSSH 客戶端和伺服器版本的命令？

結合不同的 ftp 目錄 chmod 設置，是什麼解釋了這種 sftp 登錄成功/失敗行為？

SSH 中 ssh_host_key 文件的密鑰類型是什麼？

使用者命名空間：如何僅為給定程序安裝文件夾