问题描述
当我使用 ssh 命令手动连接到主机时，一切正常:
When I use ssh command to manually connect to the host, everything works fine:
$ ssh -v admin@mycli.abc.com -p 10000
OpenSSH_6.1p1, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /home/todd/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to mycli.abc.com [mycli.abc.com] port 10000.
debug1: Connection established.
debug1: identity file /home/todd/.ssh/id_rsa type 1
debug1: identity file /home/todd/.ssh/id_rsa-cert type -1
debug1: identity file /home/todd/.ssh/id_dsa type -1
debug1: identity file /home/todd/.ssh/id_dsa-cert type -1
debug1: identity file /home/todd/.ssh/id_ecdsa type -1
debug1: identity file /home/todd/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version SSHD-CORE-0.6.0
debug1: no match: SSHD-CORE-0.6.0
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug1: Server host key: DSA 6f:2c:48:80:86:ff:69:99:28:c2:21:5b:02:d4:7f:63
debug1: checking without port identifier
The authenticity of host '[mycli.abc.com]:10000 ([mycli.abc.com]:10000)' can't be established.
DSA key fingerprint is 6f:2c:48:80:86:ff:69:99:28:c2:21:5b:02:d4:7f:63.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[mycli.abc.com]:10000' (DSA) to the list of known hosts.
debug1: ssh_dss_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: password,publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/todd/.ssh/id_rsa
debug1: Authentications that can continue: password,publickey
debug1: Trying private key: /home/todd/.ssh/id_dsa
debug1: Trying private key: /home/todd/.ssh/id_ecdsa
debug1: Next authentication method: password
admin@mycli.abc.com's password:
debug1: Authentication succeeded (password).
Authenticated to mycli.abc.com ([mycli.abc.com]:10000).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: No xauth program.
Warning: No xauth data; using fake authentication data for X11 forwarding.
debug1: Requesting X11 forwarding with authentication spoofing.
X11 forwarding request failed on channel 0
Cli>
但是使用 paramiko 它总是失败:
But with paramiko it always fails:
DEBUG:paramiko.transport:starting thread (client mode): 0x22783e10L
INFO:paramiko.transport:Connected (version 2.0, client SSHD-CORE-0.6.0)
DEBUG:paramiko.transport:kex algos:['diffie-hellman-group1-sha1'] server key:['ssh-dss'] client encrypt:['aes128-cbc', '3des-cbc', 'blowfish-cbc'] server encrypt:['aes128-cbc', '3des-cbc', 'blowfish-cbc'] client mac:['hmac-md5', 'hmac-sha1', 'hmac-md5-96', 'hmac-sha1-96'] server mac:['hmac-md5', 'hmac-sha1', 'hmac-md5-96', 'hmac-sha1-96'] client compress:['none'] server compress:['none'] client lang:[''] server lang:[''] kex follows?False
DEBUG:paramiko.transport:Ciphers agreed: local=aes128-cbc, remote=aes128-cbc
DEBUG:paramiko.transport:using kex diffie-hellman-group1-sha1; server key type ssh-dss; cipher: local aes128-cbc, remote aes128-cbc; mac: local hmac-sha1, remote hmac-sha1; compression: local none, remote none
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Adding ssh-dss host key for [mycli.abc.com]:10000: 6f2c488086ff699928c2215b02d47f63
DEBUG:paramiko.transport:Trying discovered key d7ab335994d0e5c90f8886b515faff55 in /home/todd/.ssh/id_rsa
DEBUG:paramiko.transport:userauth is OK
INFO:paramiko.transport:Authentication (publickey) failed.
INFO:paramiko.transport:Disconnect (code 2): Protocol error: expected packet SSH_MSG_USERAUTH_REQUEST, got SSH_MSG_SERVICE_REQUEST
Traceback (most recent call last):
File "./mycli_test.py", line 13, in <module>
oc = MyCli(hostname=hostname, username=username, password=password)
File "/home/todd/devel/mylib/mycli.py", line 16, in __init__
key_filename, timeout, allow_agent, look_for_keys, compress)
File "/usr/lib/python2.7/site-packages/paramiko/client.py", line 338, in connect
self._auth(username, password, pkey, key_filenames, allow_agent, look_for_keys)
File "/usr/lib/python2.7/site-packages/paramiko/client.py", line 519, in _auth
raise saved_exception
paramiko.AuthenticationException: Authentication failed.
paramiko 脚本:
The paramiko script:
#!/usr/bin/env python2
import paramiko
paramiko.common.logging.basicConfig(level=paramiko.common.DEBUG)
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.MissingHostKeyPolicy())
ssh.connect(hostname='mycli.abc.com', port=10000, username='admin', password='abc123')
i, o, e = ssh.exec_command('uname -a')
print o.readlines()
ssh.close()
Paramiko 版本:1.9.0
Paramiko version: 1.9.0
为什么会抛出协议错误:预期数据包 SSH_MSG_USERAUTH_REQUEST，得到 SSH_MSG_SERVICE_REQUEST"错误?如何避免?
Why does it throw "Protocol error: expected packet SSH_MSG_USERAUTH_REQUEST, got SSH_MSG_SERVICE_REQUEST" error? How to avoid it?
推荐答案
TL;DR:将此:allow_agent=False 和/或 look_for_keys=False 添加到您的 connect() 调用中.
TL;DR:Add this: allow_agent=False and/or look_for_keys=False to your connect() call.
对此做了一些研究，我得出的结论是，Paramiko SSH 客户端的公钥身份验证并不总是适用于所有 SSH 服务器.我试图连接到 Cisco ASA 设备.错误日志的相关部分是:
Doing some research on this, I have come to the conclusion that public key auth by a Paramiko SSH client doesn't always work with all SSH servers. I was trying to connect to a Cisco ASA device. The relevant part of the error log was:
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Trying SSH agent key 5d081d52f889f2c224606d6b2065606e
DEBUG:paramiko.transport:userauth is OK
DEBUG:paramiko.transport:Authentication type (publickey) not permitted.
DEBUG:paramiko.transport:Allowed methods: ['password']
INFO:paramiko.transport:Disconnect (code 2): Protocol error: expected packet type 50, got 5
注意正在尝试 SSH 代理密钥..."部分?我不想那样，我想强制密码认证.OpenSSH 交互式客户端要么优雅地从公钥回退到密码，而 paramiko 则没有，强制它使用用户/密码身份验证为我解决了这个问题，它可能对你有用.
Notice the 'Trying SSH agent key...' part? I didn't want that, I wanted to force password auth. Where the OpenSSH interactive client either falls back gracefully from publickey to password, paramiko doesn't, forcing it to use user/pass authentication fixed the issue for me, it might work for you.
我不知道这是 paramiko 错误还是 SSH 服务器上的错误.在与 OpenSSH 服务器通信时，Paramiko 确实从公钥回退到密码或键盘交互.
I don't know if this is a paramiko bug or a bug on the SSH server. Paramiko does fall back from publickey to password or keyboard-interactive when talking to an OpenSSH server.
这篇关于Paramiko 协议错误:预期数据包 SSH_MSG_USERAUTH_REQUEST，得到 SSH_MSG_SERVICE_REQUEST的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！