SSH服务器日志分析：深入理解SSH认证过程

引言

SSH（Secure Shell）是一种安全协议，用于远程计算机系统的登录和数据传输。解决SSH相关的问题通常涉及日志分析，以便了解协议的内部工作机制。本文将对一份SSH服务器端的debug日志进行详细解析，目的是提供对SSH认证过程更深入的了解。

Sep 18 19:22:18 pam-dev21 sshd[8923]: debug1: Forked child 9223.
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: Set /proc/self/oom_score_adj to 0
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: inetd sockets after dupping: 3, 3
Sep 18 19:22:18 pam-dev21 sshd[9223]: Connection from 10.*.*.100 port 42510 on 10.*.*.21 port 22
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: Client protocol version 2.0; client software version OpenSSH_7.4
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: Local version string SSH-2.0-OpenSSH_7.4
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: Enabling compatibility mode for protocol 2.0
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SELinux support enabled [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: permanently_set_uid: 74/74 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: list_hostkey_types: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SSH2_MSG_KEXINIT sent [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SSH2_MSG_KEXINIT received [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: kex: algorithm: diffie-hellman-group-exchange-sha256 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: kex: diffie-hellman-group-exchange-sha256 need=64 dh_need=64 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: kex: diffie-hellman-group-exchange-sha256 need=64 dh_need=64 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: expecting SSH2_MSG_KEX_DH_GEX_REQUEST [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: rekey after 134217728 blocks [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SSH2_MSG_NEWKEYS received [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: rekey after 134217728 blocks [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: KEX done [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: userauth-request for user root service ssh-connection method none [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: attempt 0 failures 0 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: PAM: initializing for "root"
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: PAM: setting PAM_RHOST to "pam-server01.com"
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: PAM: setting PAM_TTY to "ssh"
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: userauth-request for user root service ssh-connection method publickey [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: attempt 1 failures 0 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: userauth_pubkey: test whether pkalg/pkblob are acceptable for RSA SHA256:z2sV4X/ioEmUAMluJM2QB0JMSzwqIA26wpHBZ3O0Yuk [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: temporarily_use_uid: 0/0 (e=0/0)
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: trying public key file /root/.ssh/authorized_keys
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: fd 4 clearing O_NONBLOCK
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: matching key found: file /root/.ssh/authorized_keys, line 2 RSA SHA256:z2sV4X/ioEmUAMluJM2QB0JMSzwqIA26wpHBZ3O0Yuk
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: restore_uid: 0/0
Sep 18 19:22:18 pam-dev21 sshd[9223]: Postponed publickey for root from 10.*.*.100 port 42510 ssh2 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: userauth-request for user root service ssh-connection method publickey [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: attempt 2 failures 0 [preauth]
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: temporarily_use_uid: 0/0 (e=0/0)
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: trying public key file /root/.ssh/authorized_keys
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: fd 4 clearing O_NONBLOCK
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: matching key found: file /root/.ssh/authorized_keys, line 2 RSA SHA256:z2sV4X/ioEmUAMluJM2QB0JMSzwqIA26wpHBZ3O0Yuk
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: restore_uid: 0/0
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: do_pam_account: called
Sep 18 19:22:18 pam-dev21 sshd[9223]: Accepted publickey for root from 10.*.*.100 port 42510 ssh2: RSA SHA256:z2sV4X/ioEmUAMluJM2QB0JMSzwqIA26wpHBZ3O0Yuk
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: monitor_child_preauth: root has been authenticated by privileged process
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: monitor_read_log: child log fd closed
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: temporarily_use_uid: 0/0 (e=0/0)
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: restore_uid: 0/0
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: SELinux support enabled
Sep 18 19:22:18 pam-dev21 sshd[9223]: debug1: PAM: establishing credentials

日志概览

日志来源于名为pam-dev21的服务器，该服务器使用了OpenSSH 7.4版本。客户端连接来自IP地址10.76.77.100，端口42510。

关键步骤解析

进程和资源准备

• Forked child 9223: SSHD（SSH Daemon）进程fork了一个子进程（PID为9223）来处理新的SSH连接。

连接和版本匹配

• Connection from 10.*.*.100: 记录了客户端的IP地址和端口。
• Client protocol version 2.0: 客户端使用SSH协议版本2.0。
• Local version string SSH-2.0-OpenSSH_7.4: 服务器端的SSH版本信息。

密钥交换（Key Exchange）

• SSH2_MSG_KEXINIT sent/received: 密钥交换初始化信息已发送和接收。
• kex: algorithm: diffie-hellman-group-exchange-sha256: 使用Diffie-Hellman算法和SHA-256进行密钥交换。
• kex: host key algorithm: ecdsa-sha2-nistp256: 主机密钥使用ECDSA和SHA-256。

认证准备和方法

• userauth-request for user root service ssh-connection method none: 开始用户（root）的无密码认证尝试。
• PAM: initializing for "root": 使用PAM（Pluggable Authentication Module）进行认证。

公钥认证

• userauth-request for user root service ssh-connection method publickey: 尝试使用公钥进行认证。
• matching key found: file /root/.ssh/authorized_keys: 在授权密钥文件中找到了匹配的公钥。

认证结果

• Accepted publickey for root from 10.*.*.100: 公钥认证成功，root用户被允许登录。

关键点总结

1. 密钥交换：使用Diffie-Hellman算法，加强了连接的安全性。
2. 认证方法：首先尝试了无密码登录，随后成功使用了公钥认证。
3. PAM与SELinux：这两个安全机制都被启用，增加了系统的安全性。

建议和最佳实践

1. 更新SSH版本：确保使用最新的SSH版本以获取最佳的安全性。
2. 限制root登录：考虑禁止或限制root用户通过SSH登录。

结论

SSH服务器日志提供了丰富的信息，有助于我们了解SSH连接和认证的内部细节。了解这些基础知识不仅可以帮助我们更有效地解决问题，还能增强我们对SSH安全性的理解。

如果你有其他问题或需要更多信息，请随时与我联系。我们将很高兴能为你提供更多的帮助和信息。