☰

非互動式 SSH 連線失敗 - 錯誤：無法開啟 /dev/tty：沒有這樣的裝置或位址；主機金鑰驗證失敗

tag-icon • tag-icon ssh cygwin public-key
非互動式 SSH 連線失敗 - 錯誤：無法開啟 /dev/tty：沒有這樣的裝置或位址；主機金鑰驗證失敗

下面你可以看到日誌。該連線是從 Cygwin SSH 客戶端到 Cygwin SSHD 伺服器的。從命令列啟動時連接工作正常，但從 Jenkins（Java 持續整合伺服器）啟動時連線失敗。 /dev/tty 檔案存在並且對每個人來說都是可讀寫的。我嘗試刪除它並重新創建它，但我不能，因為 Cygwin 在我創建到 /dev/ttySO 的連結之前重新創建了它。

ssh -t -vvv [email protected] 'mv -v /cygdrive/z/deploy-scripts /cygdrive/z/deploy-scripts-`date +%F_%H-%M-%S`'
OpenSSH_6.0p1, OpenSSL 1.0.1c 10 May 2012
Pseudo-terminal will not be allocated because stdin is not a terminal.
debug2: ssh_connect: needpriv 0
debug1: Connecting to server.company.com [] port 22.
debug1: Connection established.
debug1: identity file /.ssh/id_rsa type -1
debug1: identity file /.ssh/id_rsa-cert type -1
debug1: identity file /.ssh/id_dsa type -1
debug1: identity file /.ssh/id_dsa-cert type -1
debug1: identity file /.ssh/id_ecdsa type -1
debug1: identity file /.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9
debug1: match: OpenSSH_5.9 pat OpenSSH_5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 
debug1: read_passphrase: can't open /dev/tty: No such device or address

答案1

您期望 Jenkins（Java 持續整合伺服器）如何輸入 ssh 金鑰的密碼？

如果這是開發或登台環境且不存在安全性問題，您可以嘗試暫時從金鑰中刪除密碼，看看是否效果更好。

編輯#1:

我可以重現您的問題的唯一方法是從 /dev/tty 中刪除權限，如 openssh 常見問題解答中所述，但我猜您已經檢查過了？

權限錯誤：

#ls -l /dev/tty
crw-r----- 1 root root 5, 0 Aug 23 21:47 /dev/tty
$ssh -T -vv -p 2222 <username>@127.0.0.1
[...]
debug1: read_passphrase: can't open /dev/tty: Permission denied
debug1: permanently_drop_suid: xxxx
[...]

具有良好的權限：

#chmod 666 /dev/tty
# ls -l /dev/tty
crw-rw-rw- 1 root root 5, 0 Aug 23 21:56 /dev/tty
[ssh client works]

答案2

對我來說是這樣git clone，我問是否信任指紋。它在容器中，因此為了盲目信任我設定StrictHostKeyChecking：

FROM node:16

COPY "id_rsa" /root/.ssh/id_rsa
COPY "id_rsa.pub" /root/.ssh/id_rsa.pub

ENV GIT_SSH_COMMAND "ssh -v -o 'PasswordAuthentication no' '-o StrictHostKeyChecking=accept-new'"
RUN git clone [email protected]:evil/project.git

答案3

...
debug1: Server host key: ECDSA 
debug1: read_passphrase: can't open /dev/tty: No such device or address

我遇到這個問題（10 年後），發現問題不是 tty 或密碼本身。 Jenkins ssh 金鑰可以透過此功能處理密碼短語ssh-agent。但無論如何我在測試時禁用了密碼。那不是問題。

參考read_passphrase必須是通用輸入「詢問問題代碼」。對我來說，它無法呈現此對話框：

The authenticity of host 'server.company.com (192.168.188.44)' can't be established.
RSA key fingerprint is SHA256:UNOzlP66WpDuEo34Wgs8mewypV0UzqHLsIFoqwe8dYo.
Are you sure you want to continue connecting (yes/no/[fingerprint])? no

若要以程式設計方式接受與伺服器關聯的所有位址的金鑰，您可以使用以下命令：

ssh-keyscan -p 22 `getent ahosts server.company.com | awk '$3 { print $1 " " $3 }' | sort -u` >> ~/.ssh/known_hosts

相關內容