Authentication 为什么我不能连接到ssh反向隧道？

我使用的是

autossh-m20000-fN-r19999:localhost:22-imycert.pemubuntu@myaws.hopto.org

建立到我的aws机器的反向通道。现在，当我尝试从aws

aws

访问机器时，我得到以下信息：

$ ssh ron@localhost -P 19999
Permission denied (publickey).

为什么会这样？详细选项显示：

$ ssh ron@localhost -v -P 19999
OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to localhost [127.0.0.1] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ubuntu/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to localhost:22 as 'ron'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:kT8pM3YwDEYqE+CFzyWQDiSVCLhgMjPLWBJXYPl1BZs
debug1: Host 'localhost' is known and matches the ECDSA host key.
debug1: Found key in /home/ubuntu/.ssh/known_hosts:5
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/ubuntu/.ssh/id_rsa
debug1: Trying private key: /home/ubuntu/.ssh/id_dsa
debug1: Trying private key: /home/ubuntu/.ssh/id_ecdsa
debug1: Trying private key: /home/ubuntu/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).

$sshron@localhost-v-P 19999
OpenSSH_7.2p2 Ubuntu-4ubuntu2.4，OpenSSL 1.0.2g 2016年3月1日
debug1:读取配置数据/etc/ssh/ssh\u config
debug1:/etc/ssh/ssh\u配置第19行：应用*
debug1:连接到本地主机[127.0.0.1]端口22。
debug1:已建立连接。
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id\u rsa type-1
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id\u rsa-cert type-1
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id_dsa type-1
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id_dsa-cert type-1
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id_ecdsa type-1
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id_ecdsa-cert type-1
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id_ed25519 type-1
debug1:key\u load\u public:没有这样的文件或目录
debug1:identity file/home/ubuntu/.ssh/id_ed25519-cert type-1
debug1:启用协议2.0的兼容模式
debug1：本地版本字符串SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1：远程协议版本2.0，远程软件版本OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1:match:OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH*compat 0x04000000
debug1:将本地主机身份验证为“ron”
debug1:SSH2\u MSG\u KEXINIT已发送
debug1:SSH2\u MSG\u KEXINIT已收到
debug1:kex:算法：curve25519-sha256@libssh.org
debug1:kex:主机密钥算法：ecdsa-sha2-nistp256
debug1:kex:server->client cipher:chachacha20-poly1305@openssh.comMAC:压缩：无
debug1:kex:client->server cipher:chachacha20-poly1305@openssh.comMAC:压缩：无
debug1:需要SSH2\u MSG\u KEX\u ECDH\u回复
debug1:服务器主机密钥：ecdsa-sha2-nistp256 SHA256:kT8pM3YwDEYqE+CFzyWQDiSVCLhgMjPLWBJXYPl1BZs
debug1:主机“localhost”已知，并且与ECDSA主机密钥匹配。
debug1:在/home/ubuntu/.ssh/known_hosts:5中找到密钥
debug1:在134217728块之后重新键入
debug1:SSH2\u MSG\u已发送新密钥
debug1:应为SSH2\u MSG\u NEWKEYS
debug1:在134217728块之后重新键入
debug1:SSH2\u MSG\u接收到新密钥
debug1:SSH2\u MSG\u EXT\u接收到信息
debug1:kex_输入_外部_信息：服务器信号algs=
debug1:SSH2\u消息\u服务\u接收
debug1:可以继续的身份验证：公钥
debug1:下一个身份验证方法：公钥
debug1:正在尝试私钥：/home/ubuntu/.ssh/id\u rsa
debug1:正在尝试私钥：/home/ubuntu/.ssh/id\u dsa
debug1:正在尝试私钥：/home/ubuntu/.ssh/id\u ecdsa
debug1:正在尝试私钥：/home/ubuntu/.ssh/id\u ed25519
debug1:不再尝试验证方法。
权限被拒绝（公钥）。

这里发生了什么事？为什么它不让我连接

EDIT1

---

我发现，当我使用

autossh-M 20000-R 19999:localhost:22-I mycert.pem

时，我实际上可以很好地建立连接，但目标机器将保持登录状态，这不是我想要的！为什么

-fN

会导致这不起作用？

我也为此挣扎了一段时间。我的回答可能非常基本，是一个典型的初学者错误，可能不是你的答案，但我会在这里发布此消息，以防其他人遇到问题，这有助于他们：

您试图从中反转ssh的计算机的公钥需要存在于本地计算机上的authorized_keys文件中

反向SSH连接到一个本地端口，该端口实际上是您自己的本地机器，因此它将在您的本地机器上查找不存在的公钥。这很容易让人混淆，因为您使用的是“localhost”作为地址，但只要想象一下，您正在某个随机端口打开一个入口到一个远程位置，然后作为该远程用户从该位置连接到您创建的端口。当它连接到端口时，仍然需要通过端口请求权限才能向下发送命令。因为它是进入你家的入口，它会在那里寻找钥匙。如果端口的另一端没有钥匙，它将无法工作

ELI5风格：

你想让另一个世界给你寄东西，但是他们不能，因为你在一个秘密的地方，所以你在另一个世界做了一个红色端口和一个蓝色端口

你跳过红港，但另一端的人不知道蓝港在哪里，所以你必须告诉他们蓝港在哪里。他们试图通过港口，但无法进入，因为你还没有授权他们过来，安全部门今天也没有授权

所以你让他们在那里制作一张钥匙卡，然后你把它带回你自己的世界，告诉你自己的安全人员“这张钥匙卡很好，让他们进来”

现在你可以再回去，叫他们敲门。这次保安发现他们是朋友，就让他们进来了

因此：

localuser@localmachine：~$ssh-r:localhost:localportremoteuser@remoteaddress
remoteuser@remoteaddress：~$ssh-keygen
生成公共/私有rsa密钥对。
输入保存密钥的文件（/home/$USER/.ssh/id\u rsa）：
输入密码短语（无密码短语为空）：
再次输入相同的密码短语：
您的标识已保存在/home/$USER/.ssh/id\u rsa中。
您的公钥已保存在/home/$USER/.ssh/id_rsa.pub中。
关键指纹是：
SHA256:sadfhjkljashdlkfjahw039ufrg094utremoteuser@remotemachine
密钥的随机艺术图像为：
+---[RSA 2048]----+
|=+ +. ..+  哦|
|哦，艺术之神|
localuser@localmachine:~$ ssh -r <remote port>:localhost:localport remoteuser@remoteaddress
remoteuser@remoteaddress:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/$USER/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/$USER/.ssh/id_rsa.
Your public key has been saved in /home/$USER/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:sadfhjkljashdlkfjahw039ufrg094ut remoteuser@remotemachine
The key's randomart image is:
+---[RSA 2048]----+
|=+ +. ..+  o .   |
|o ofake art. .   |
|asdfghjk         |
|+ .  .o. .  + .  |
|.+R . fx s ++ o  |
|B +  ..     . .  |
|=+ +.. .     .   |
|..o .. 0. 0.     |
| + o  ++      ==o|
+----[SHA256]-----+
remoteuser@remoteaddress:~$ clip ./ssh/id_rsa.pub (or copy it however you can)
remoteuser@remoteaddress:~$ exit
localuser@localmachine:~$ nano/vi/whatever .ssh/authorized_keys (paste the public key there)
localuser@localmachine:~$ ssh -r <remote port>:localhost:localport remoteuser@remoteaddress
remoteuser@remoteaddress:~$ ssh localhost -p <remote port>