SSH隧道到docker集装箱
我试图build立一个SSH隧道到我的远程虚拟服务器上运行我的docker容器。
基本上我遵循这个post的指示，你也可以find更多关于我想要实现的细节：
Stackoverflow的链接后： 如何SSH到Docker？
其实我正确地设置了一切，但我的连接每次都会终止，并显示以下消息：
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is <rsa-key>. Please contact your system administrator. Add correct host key in /home/rico/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /home/rico/.ssh/known_hosts:31 remove with: ssh-keygen -f "/home/rico/.ssh/known_hosts" -R [<server-ip>]:33 RSA host key for [<server-ip>]:33 has changed and you have requested strict checking. Host key verification failed. 我在这里附上截图： https ： //s18.postimg.org/ivnnxj7a1/connection_closed.png
我的命令行是：
ssh -p 33 root@<server-ip>
其中'33'是docker集装箱的ssh端口。
为了让我的虚拟服务器接受连接，我必须做些什么？
[UPDATE]
运行命令也添加-v标志并发布输出：
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to <server-ip> [<server-ip>] port 44. debug1: Connection established. debug1: identity file /home/rico/.ssh/id_rsa type 1 debug1: identity file /home/rico/.ssh/id_rsa-cert type -1 debug1: identity file /home/rico/.ssh/id_dsa type -1 debug1: identity file /home/rico/.ssh/id_dsa-cert type -1 debug1: identity file /home/rico/.ssh/id_ecdsa type -1 debug1: identity file /home/rico/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/rico/.ssh/id_ed25519 type -1 debug1: identity file /home/rico/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 Debian-5+deb8u3 debug1: match: OpenSSH_6.7p1 Debian-5+deb8u3 pat OpenSSH* compat 0x04000000 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-sha1-etm@openssh.com none debug1: kex: client->server aes128-ctr hmac-sha1-etm@openssh.com none debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA <server-mac-address> debug1: Host '[<server-ip>]:44' is known and matches the ECDSA host key. debug1: Found key in /home/rico/.ssh/known_hosts:32 debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/rico/.ssh/id_rsa debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: <my-email>@gmail.com debug1: Authentications that can continue: publickey,password debug1: Offering RSA public key: <my-email>@gmail.com debug1: Authentications that can continue: publickey,password debug1: Trying private key: /home/rico/.ssh/id_dsa debug1: Trying private key: /home/rico/.ssh/id_ecdsa debug1: Trying private key: /home/rico/.ssh/id_ed25519 debug1: Next authentication method: password root@<server-ip>'s password:
即使我设置了一个新的root密码也不行
您可能需要重新考虑使用SSH。 正如您链接post中的评论指出的那样，这违背了Docker的概念。 而且，运行addtional SSH服务器会增加潜在的攻击面。
有两种方法可以访问你的容器：
- SSH到您的虚拟机，并使用
docker exec，例如docker exec -it <yourcontainer> bash - 将您的本地客户端连接到虚拟机中运行的docker守护程序。 这是一个高级的方法，但是Docker有一个很好的文档，如何安全地执行它。 在一个nuthshell中：在虚拟机上configuration守护进程来侦听TCP套接字，例如
dockerd -H=0.0.0.0:2376。 然后你把你的本地客户端指向相应的IP，docker -H=$HOST:2376 version。 每个人都必须使用签名的TLS证书来保证安全 。
我希望这有帮助！
你可以通过添加到你的ssh命令来绕过这个问题：
-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
要解决身份validation问题，请按照本指南创build一个authorized_keys文件，最后使用Dockerfile将其添加到您的映像中：
ADD authorized_keys /home/docker/.ssh/authorized_keys
注意 ：由于@stepf注释ssh不是用来访问docker容器的方法。