无法在 On Premise GitLab 实例上获得 SSH 连接

Posted 2023-02-19

【中文标题】无法在 On Premise GitLab 实例上获得 SSH 连接

【英文标题】：Unable to get SSH connections working on On Premise GitLab Instance

【发布时间】：2021-09-30 12:15:11

【问题描述】：

我已经部署了一个 GitLab 的本地实例（使用https://docs.gitlab.com/ee/install/docker.html 中描述的步骤），创建了一个用户，生成了一个密钥对并按照https://docs.gitlab.com/ee/ssh/ 中的步骤上传了公钥。

私钥位于目录~/.ssh 600权限，文件~/.ssh/config如下：

Host gitlab.mycompany.com
    Hostname gitlab.mycompany.com
    User myusername
    PreferredAuthentications publickey
    IdentityFile ~/.ssh/id_rsa
    IdentitiesOnly yes
    TCPKeepAlive yes

但是，我在尝试建立 SSH 连接时收到错误“权限被拒绝（公钥）”：

$ ssh -vT [e-mail]
OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /home/myusername/.ssh/config
debug1: /home/myusername/.ssh/config line 1: Applying options for gitlab.mycompany.com
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to gitlab.mycompany.com [12.345.678.90] port 22.
debug1: Connection established.
debug1: identity file /home/myusername/.ssh/id_rsa type 0
debug1: identity file /home/myusername/.ssh/id_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.2
debug1: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.2 pat OpenSSH* compat 0x04000000
debug1: Authenticating to gitlab.mycompany.com:22 as 'git'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [e-mail] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [e-mail] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:9FbhbOAyNvky0M+CtyEOT8tBBimwF8aOpDH0zr+6+2Y
debug1: Host 'gitlab.mycompany.com' is known and matches the ECDSA host key.
debug1: Found key in /home/myusername/.ssh/known_hosts:29
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /home/myusername/.ssh/id_rsa RSA SHA256:uekBVw1MVUz2V4LgS//w1mAP9wBRr1oomLK5uYtfJDE explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[e-mail],ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[e-mail]>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/myusername/.ssh/id_rsa RSA SHA256:uekBVw1MVUz2V4LgS//w1mAP9wBRr1oomLK5uYtfJDE explicit
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
[e-mail]: Permission denied (publickey).

我认为问题出在服务器端，因为我能够使用相同的密钥对成功建立与 gitlab.com 的连接。

关于如何解决此问题的任何想法？

其他详情

我在最初对该问题的描述中没有提到的是 GitLab 被部署为一个容器，所以我在想可能发生的事情是主机可以通过端口 22 访问，但它可能不会重新指向 GitLab 容器。

【参考方案1】：

在您的 Gitlab 主机上检查 /var/log/auth.log。它往往具有有关身份验证错误的更多详细信息。查找 sshd 条目。

【讨论】：

在 /var/log 下找不到授权日志。我在 /var/log/gitlab/gitlab-rails 下找到了一个 auth.log 文件，但它完全是空的，这让我觉得服务器没有被访问。

调试输出表明已与主机 12.345.678.90 建立连接。那是没有auth.log的主机吗？

哦，你是对的。到达服务器。不知道为什么没有日志。

可能主机到达，但容器本身没有？

【参考方案2】：

我设法解决了这个问题:)

事实证明，我在创建容器时错过了 --publish 22:22 指令。

sudo docker run --detach \
  --hostname gitlab.mycompany.com \
  --publish 443:443 --publish 80:80 --publish 22:22 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab:Z \
  --volume $GITLAB_HOME/logs:/var/log/gitlab:Z \
  --volume $GITLAB_HOME/data:/var/opt/gitlab:Z \
  gitlab/gitlab-ee:latest

决议是：

停止容器

$ sudo docker stop gitlab

关闭泊坞窗

$ sudo systemctl stop docker

编辑文件 /var/lib/docker/containers/[container id]/hostconfig.json 以更改 PortBindings 来自

"PortBindings":"443/tcp":["HostIp":"","HostPort":"443"],"80/tcp":["HostIp":"","HostPort":"80"]

到

"PortBindings":"443/tcp":["HostIp":"","HostPort":"443"],"80/tcp":["HostIp":"","HostPort":"80"],"2222/tcp":["HostIp":"","HostPort":"22"]

（我选择使用端口 2222）

启动docker

$ sudo systemctl start docker

启动容器

$ sudo docker start gitlab

以上允许我成功连接：

$ ssh -T [e-mail] -p 2222
Enter passphrase for key '/home/<username>/.ssh/id_rsa':
Welcome to GitLab, @<username>!