SSHJ – Keypair登录EC2实例

我有一个看起来像SSHJ测试中的pem文件（虽然我没有看到它被引用）： https ： //github.com/shikhar/sshj/blob/master/src/test/resources/hostkey.pem 。 只需尝试通过pem文件validation到EC2实例（读为字符串），但有问题。 有人做过吗？

SSHClient ssh = new SSHClient(); ssh.connect("ec2-XXXXXXX.compute-1.amazonaws.com"); ssh.authPublickey("ubuntu", getPemAsString("/Users/me/ec2.pem")); final Session session = ssh.startSession(); session.exec("echo -e \"test\" >> /home/ubuntu/testfile"); 

错误如下：

 INFO [main] (TransportImpl.java:152) - Client identity string: SSH-2.0-SSHJ_0_8 INFO [main] (TransportImpl.java:161) - Server identity string: SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1 INFO [main] (KeyExchanger.java:195) - Sending SSH_MSG_KEXINIT INFO [reader] (KeyExchanger.java:357) - Received SSH_MSG_KEXINIT INFO [reader] (AbstractDHG.java:110) - Sending SSH_MSG_KEXDH_INIT INFO [reader] (KeyExchanger.java:370) - Received kex followup data INFO [reader] (AbstractDHG.java:120) - Received SSH_MSG_KEXDH_REPLY ERROR [reader] (TransportImpl.java:570) - Dying because - net.schmizz.sshj.transport.TransportException: [HOST_KEY_NOT_VERIFIABLE] Could not verify `ssh-rsa` host key with fingerprint `xx:0a:xx:b5:c2:fd:44:1d:e0:e4:fc:d8:5f:f8:dd:f6` for `ec2-XXXX.compute-1.amazonaws.com` on port 22 INFO [reader] (TransportImpl.java:302) - Setting active service to null-service ERROR [main] (Promise.java:171) - <> woke to: net.schmizz.sshj.transport.TransportException: [HOST_KEY_NOT_VERIFIABLE] Could not verify `ssh-rsa` host key with fingerprint `xx:0a:xx:b5:c2:fd:44:1d:e0:e4:fc:xx:5f:f8:dd:f6` for `ec2-XXXX.compute-1.amazonaws.com` on port 22 

编辑：仍然没有运气。 必须对AWS为登录生成的私钥做错事吗？

  SSHClient ssh = new SSHClient(); ssh.connect("ec2-XXX.compute-1.amazonaws.com"); ssh.addHostKeyVerifier("dd:9c:XX:fa:6a:XX:32:6a:2b:c3:e7:bd:2b:15:26:5f:76:b6:‌​c4:fe"); ssh.authPublickey("ubuntu", getRSAPrivateKeyAsString("mypem")); // Must be wrong? final Session session = ssh.startSession(); session.exec("echo -e \"test\" >> /home/ubuntu/testfile"); 

Answer 1

在我将BouncyCastleProvider添加到java.security.Security类之前，连接到EC2的示例最初并不适用于我。 对我有用的简单示例（为简单起见用Groovy编写）是：

 @Grab(group='net.schmizz', module='sshj', version='0.8.1') @Grab(group='org.bouncycastle', module='bcprov-jdk16', version='1.46') import net.schmizz.sshj.* import net.schmizz.sshj.userauth.keyprovider.* import net.schmizz.sshj.common.* import net.schmizz.sshj.transport.verification.PromiscuousVerifier import net.schmizz.sshj.connection.channel.direct.Session import net.schmizz.sshj.connection.channel.direct.Session.Command import java.security.* import java.util.concurrent.TimeUnit Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()); client = new SSHClient() client.addHostKeyVerifier(new PromiscuousVerifier()) client.connect("ec2-XXX-XXX-XXX-XXX.compute-1.amazonaws.com") PKCS8KeyFile keyFile = new PKCS8KeyFile() keyFile.init(new File("/dev/ec2/key/mykey.pem")) client.authPublickey("ubuntu",keyFile) final Session session = client.startSession() final Command cmd = session.exec("whoami") String response = IOUtils.readFully(cmd.getInputStream()).toString() cmd.join(10, TimeUnit.SECONDS) println response //ubuntu session.close() client.disconnect() 

Answer 2

这不是绊倒你的用户身份validation，而是主机密钥validation:)

在连接之前，像client.addHostKeyVerifier（“xx：0a：xx：b5：c2：fd：44：1d：e0：e4：fc：xx：5f：f8：dd：f6”）之类的东西。

Answer 3

我使用以下方法成功连接到Amazon EC2实例：

 final SSHClient ssh = new SSHClient(); ssh.addHostKeyVerifier("XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX"); ssh.connect("host"); PKCS8KeyFile keyFile = new PKCS8KeyFile(); keyFile.init(new File("server_pem.pem")); ssh.auth("ec2-user", new AuthPublickey(keyFile)); try { final Session session = ssh.startSession(); try { final Command command = session.exec("whoami"); String response = IOUtils.readFully(command.getInputStream()).toString(); command.join(10, TimeUnit.SECONDS); return response; } finally { session.close(); } } finally { ssh.disconnect(); }