ssh与本地密钥文件链接-这应该如何工作？

Question

我试图让ssh链接通过jump服务器工作到内部子网上的target服务器，这样我就可以在一个命令中到达目标服务器。如果我在两个跳中到达目标服务器，ssh‘in就能工作：

local$ ssh -i=jump_rsa ec2@jump
jump$ ssh -i=target_rsa centos@target
target$ 

我想要做的<#>What是将这些ssh连接链接在一个命令中，只在本地机器上使用ssh私钥，因为我知道这是最安全的解决方案(目前跳转服务器上有一个私钥)。

然而，我完全没有把这些链接在一个命令中，并且我在调试问题时画了一个空白。这里一个可能的复杂问题是本地服务器是Ubuntu、跳转服务器amazon和目标服务器centos7；所以我想知道这是否与此有关？

尝试1-通过命令行

$ ssh -A -t -i jump_rsa ec2-user@18.134.xx.xx ssh -A -t -i target_rsa centos@10.0.0.214
Warning: Identity file target_rsa not accessible: No such file or directory.
ssh: connect to host 10.0.0.214 port 22: No route to host
Connection to 18.134.xx.xx closed.

我试着把密钥文件放在任何地方，并且更改权限，这没有什么区别。用-v

Warning: Identity file target_rsa not accessible: No such file or directory.
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: Connecting to 10.0.0.214 [10.0.0.214] port 22.
debug1: connect to address 10.0.0.214 port 22: No route to host
ssh: connect to host 10.0.0.214 port 22: No route to host
Connection to 18.134.xx.xx closed.

有很多例子，但是没有一个像我试图做的那样使用两个关键文件引用。

尝试2-通过. .ssh/config文件和proxycommand

# .ssh/config
Host jump
  Hostname 18.134.xx.xx
  User ec2-user
  Port 22
  IdentityFile /home/path/to/jump_rsa
  
Host target
  Hostname 10.0.0.214
  User centos
  IdentityFile /home/path/to/target_rsa
  Port 22
  ProxyCommand ssh -q W %h:%p jump

命令ssh jump工作正常，可以到达跳转服务器，但是ssh target失败，如下所示：

$ ssh target -v
OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /home/peter/.ssh/config
debug1: /home/peter/.ssh/config line 16: Applying options for target
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Executing proxy command: exec ssh -q W 10.0.0.214:22 jump
debug1: identity file /home/path/to/target_rsa type -1
debug1: identity file /home/path/to/target_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
kex_exchange_identification: Connection closed by remote host

我想我漏掉了一些显而易见的东西，但我看不出是什么。

更新...

尝试3-通过-J

尝试了-J选项，这是更有帮助的，并有一些有趣的错误在那里。但还是没用。

$ ssh -J jump target -v
OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /home/peter/.ssh/config
debug1: /home/peter/.ssh/config line 16: Applying options for target
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Setting implicit ProxyCommand from ProxyJump: ssh -v -W '[%h]:%p' jump
debug1: Executing proxy command: exec ssh -v -W '[10.0.0.214]:22' jump
debug1: identity file /home/path/to/target_rsa type -1
debug1: identity file /home/path/to/target_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /home/peter/.ssh/config
debug1: /home/peter/.ssh/config line 10: Applying options for jump
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to 18.134.xx.xx [18.134.xx.xx] port 22.
debug1: Connection established.
debug1: identity file /home/path/to/jump_rsa type -1
debug1: identity file /home/path/to/jump_rsa_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to 18.134.xx.xx:22 as 'ec2-user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:302ZU2HdNyCd7uk+oGiKxoXKe+7eIYRIFNEFzAt9UJU
debug1: Host '18.134.xx.xx' is known and matches the ECDSA host key.
debug1: Found key in /home/peter/.ssh/known_hosts:31
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /home/path/to/jump_rsa  explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)


debug1: Next authentication method: publickey
debug1: Trying private key: /home/peter/path/to/jump_rsa
debug1: Authentication succeeded (publickey).
Authenticated to 18.134.xx.xx ([18.134.xx.xx]:22).
debug1: channel_connect_stdio_fwd 10.0.0.214:22
debug1: channel 0: new [stdio-forward]
debug1: getpeername failed: Bad file descriptor
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
channel 0: open failed: connect failed: No route to host
stdio forwarding failed
kex_exchange_identification: Connection closed by remote host

# .ssh/config
Host jump
  Hostname 18.134.xx.xx
  User ec2-user
  Port 22
  IdentityFile /home/path/to/jump_rsa
  
Host target
  Hostname 10.0.0.214
  User centos
  IdentityFile /home/path/to/target_rsa
  Port 22

Answer 1

解决方案如Ginnungagap所建议的那样使用-J选项。但是我看到的问题(至少在第3次尝试中是这样)是由于目标服务器的权限太松散。一旦我设置了它们(通过同样安装公钥的user_data引导脚本)，一切都正常。

全面解决办法：

1. 确保任何centos节点都具有以下权限集(对linux的其他特性也没有损害)

chmod 700 ~/.ssh
chmod 600 ~/.ssh/*

1. 在本地计算机上配置~/.ssh.config文件，如下所示：

# Speed up ssh by disabling this, as N/A for AWS
Host *
  GSSAPIAuthentication no
  
Host jump
  Hostname 35.178.207.12
  # Amazon Linux = ec2-user, Ubuntu = ubuntu, CentOS = centos
  User ec2-user
  Port 22
  IdentityFile /path/to/bastion_rsa
  
Host target
  Hostname 10.0.0.145
  # Amazon Linux = ec2-user, Ubuntu = ubuntu, CentOS = centos
  User centos
  IdentityFile /path/to/target_rsa
  Port 22

1. 使用命令ssh -J jump target连接到目标服务器

避免在跳转服务器上安装任何私钥。

Answer 2

OpenSSH的ssh有-J开关或ProxyJump选项。

来自man ssh：

-J目标连接到目标主机，方法是首先建立一个ssh连接到目的地描述的跳转主机，然后建立一个TCP转发到最终目的地。可以用逗号字符分隔多个跳转跳。这是指定ProxyJump配置指令的快捷方式。注意，在命令行上提供的配置指令通常适用于目标主机，而不是任何指定的跳转主机。使用~/..ssh/config为跳转主机指定配置。