Gano dalilin matsalar haɗin SSH

Rubuta kuskuren daga sabon haɗi

Commands na client suna aiki a Bash na kwamfutarka; na server a zaman SSH mai aiki ko trusted recovery console. Sauya IP, username, port da key path da naka. Kada ka rufe tsohon zaman.

Duba effective SSH configuration, sannan yi ƙoƙarin sabon haɗi ba tare da amfani da tsohon shared connection ba:

ssh -G -p 22 -i ~/.ssh/ubuntu_vps ubuntu@203.0.113.10
ssh -v -S none -o ConnectTimeout=10 -o StrictHostKeyChecking=ask -p 22 -i ~/.ssh/ubuntu_vps ubuntu@203.0.113.10

Rubuta lokaci da ainihin error. Cire IP na sirri, usernames ko wasu bayanan da ba ka son raba wa mutane kafin aika logs. ssh -G yana bayyana settings; ba gwajin haɗi ba ne.

Raba kuskuren bisa matakin haɗi

Timeout kafin TCP ya haɗu yana sa a fara duba address, route da firewall. Timeout bayan connection established ko yayin handshake na buƙatar duba matakin da logs suka nuna. Connection refused yawanci yana nuna an kai endpoint amma ba a karɓi port; ba tabbatar da identity na server ba ne.

Permission denied (publickey) yana nuni ga authentication. Host identification has changed kuma yana buƙatar tantance sabar kafin karɓar sabon key. Kada ka yi gyaran iri ɗaya ga duka waɗannan.

Idan TCP bai haɗu ba, bincika hanyar network

Tabbatar da instance da public IP a panel; duba DNS A da AAAA, IPv6, VPN, ProxyJump da SSH config. IP ko DNS na iya zama tsoho. Bincika source public IP na yanzu, /32 da actual SSH port a firewall na kamfani da guest.

A Oracle, security lists da NSGs na iya haɗuwa; kiyaye dokokin image, musamman iSCSI. Kada ka kunna UFW ko flush firewall domin gwaji. Rashin amsar ping ba hujjar cewa TCP 22 ya mutu ba; ICMP na iya kasancewa daban.

Idan port ya ƙi haɗi, duba listener daga console

A server console ko zaman mai aiki, bincika SSH service, socket, listener da configuration:

systemctl status ssh.service ssh.socket --no-pager
sudo ss -lntp
sudo /usr/sbin/sshd -t
sudo journalctl -u ssh.service -u ssh.socket --since '15 minutes ago' --no-pager

A tsarin socket activation, ssh.service na iya zama inactive amma ssh.socket yana sauraro. Duba ainihin port da address, ba service state kaɗai ba. sshd -t yana gwada syntax na configuration, ba network ko sabon login ba.

Karanta logs da lokacin da matsalar ta faru. Kada ka restart sabis ko canza port ba tare da gano abin da zai hana shiga ba. Gwada config kafin kowane reload da ya zama dole, kuma kiyaye hanyar recovery.

Idan public key ya ƙi, tabbatar da asusu da key

Bincika username na image, key da client yake miƙawa da fingerprint ɗinsa. Idan local key permissions sun yi faɗi, gyara wannan matsalar a client kafin canza sabar. Sake gwadawa da key da ka nufa:

ssh -v -S none -o IdentitiesOnly=yes -o StrictHostKeyChecking=ask -p 22 -i ~/.ssh/ubuntu_vps ubuntu@203.0.113.10

IdentitiesOnly yana rage keys daga agent, amma IdentityFile entries na configuration na iya ci gaba da aiki. Duba ssh -G maimakon ɗaukar cewa zaɓin ya cire duk sauran keys.

A server, bincika actual home, authorized keys, ownership da permissions, logs da effective configuration:

getent passwd ubuntu
sudo ls -ld /home/ubuntu /home/ubuntu/.ssh /home/ubuntu/.ssh/authorized_keys
sudo ssh-keygen -lf /home/ubuntu/.ssh/authorized_keys

AuthorizedKeysFile, Include, Match ko key service na kamfani na iya sauya inda ake samun key. Ƙara key mai dacewa ba tare da goge keys masu aiki ba. Kada ka kashe StrictModes ko kunna password authentication kawai don ɓoye dalilin matsalar.

Idan host identity ya canza, tabbatar kafin amincewa

Rebuild, sake ba da IP ko matsalar tsaro na iya sa host key ya bambanta. Je zuwa trusted provider console na ainihin instance, ka karanta fingerprint na matching public host key:

sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub -E sha256

Kwatanta guest host key, ba user key ko key na console gateway ba. Kada ka yi amfani da network scan marar tabbaci a matsayin hujja guda.

Idan sauyin ya dace da abin da aka yi, ajiye kwafin known_hosts, sannan sabunta entry na wannan host/IP da port kawai. Kada ka goge dukan known_hosts ko kashe StrictHostKeyChecking domin kauce wa gargadi.

Gyara abu ɗaya, sannan gwada sabon shiga

Yi ƙaramin gyaran da hujjoji suka nuna: adireshe, takamaiman rule, listener ko key. Buɗe sabon SSH sannan gwada sudo idan ana buƙata. Tsohon zaman da ke aiki ba ya tabbatar da sabon login.

Rubuta abin da aka sauya, lokacin gwaji da hanyar recovery. Idan kana kan sabon deployment, ci gaba da saita HTTPS bayan shiga ya tabbata; kiyaye backup mai zaman kansa.

Tambayoyi da amsoshi

Takardu da madogarai

• Madogara: Ubuntu OpenSSH server documentation
• Madogara: OpenSSH client manual
• Madogara: OpenSSH client configuration manual
• Madogara: OpenSSH server test modes
• Madogara: OpenSSH server configuration manual
• Madogara: OpenSSH key fingerprint tools
• Madogara: Ubuntu 24.04 OpenSSH socket activation
• Madogara: Oracle image firewall requirements