Question

我可以通过networkmanager和openconnect插件连接到vpn。但是当我连接到公司的服务器时，我得到了以下日志：

[root@XSign ssh]# ssh username@xxx -v
OpenSSH_7.1p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to xxx [x.x.x.x] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5* compat 0x0c000000
debug1: Authenticating to xxx:22 as 'username'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr umac-64@openssh.com none
debug1: kex: client->server aes128-ctr umac-64@openssh.com none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent

然后它被卡在最后一行我在公司时可以连接到xxx服务器我可以通过家里的同一网络将这台xxx服务器与我以前的笔记本电脑连接起来这两款笔记本电脑之间的区别在于软件版本。

有人知道我被困了吗？

Answer 1

MACs hmac-md5，hmac-sha1，umac-64 @ openssh.com，hmac-ripemd160

/ etc / ssh / ssh_config中的行上面的文档，解决了这个问题。

Answer 2

看来您的目标服务器不支持现代HMAC，而只允许使用较旧的（可能是不安全的）HMAC。因此，源计算机上的默认SSH客户端设置会阻止连接。

您可以根据具体情况进行覆盖，例如：

ssh -m umac-64@openssh.com targetserver
ssh -m hmac-sha1 targetserver
ssh -m hmac-md5 targetserver

。

或者，如上面@hacksign所建议的，您可以通过取消注释/etc/ssh/ssh_config中的以下行来永久允许使用（可能）不安全的HMAC：

MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160

Answer 3

尝试调整MTU大小。我遇到了同样的问题（使用另一个隧道）并将MTU大小设置为较小的值可以解决我的问题。

ssh卡在SSH2_MSG_KEX_DH_GEX_REQUEST（1024 <7680＆lt; 8192）上发送

3 个答案: