【发布时间】：2022-11-02 11:37:45
【问题描述】：
本地设置
我通过 ssh-keygen 命令创建了一个公共和私有 SSH 密钥。
我使用另一台笔记本电脑上的相同公钥成功地与服务器通信。
GitLab CI 设置
然后我决定在 gitlab CI 上设置私钥和通信。
在我的仓库中，我导航到设置 -> 持续集成 -> 变量，并添加了以下环境变量：
- $SSH_PRIVATE_KEY - 我使用了与本地相同的私钥
.gitlab-ci.yml
workflow:
rules:
- if: $CI_COMMIT_BRANCH != "main" && $CI_PIPELINE_SOURCE != "merge_request_event"
when: never
- when: always
stages:
- test
- build
- deploy
run_unit_tests:
image: node:17-alpine3.16.2
stage: test
tags:
- johnlap-fedora-shell
before_script:
- cd app
- npm install
script:
- npm run test
artifacts:
when: always
paths:
- app/junit.xml
reports:
junit:
- app/junit.xml
variables:
IMAGE_NAME: $CI_REGISTRY_IMAGE
IMAGE_TAG: "1.0"
DEV_SERVER_HOST: ?.?.?.?
build_image:
stage: build
tags:
- johnlap-fedora-shell
before_script:
# - echo "Linux user is $USER"
# - echo "Docker registry user is $CI_REGISTRY_USER"
# - echo "Docker registry name is $CI_REGISTRY"
# - echo "Docker registry image is $CI_REGISTRY_IMAGE"
script:
# - docker build -t registry.gitlab.com/?/mynodeapp-cicd-project:1.0 .
# - docker build -t $CI_REGISTRY_IMAGE/microservice/payment:1.0 .
- docker build -t $IMAGE_NAME:$IMAGE_TAG .
push_image:
stage: build
needs:
- build_image
tags:
- johnlap-fedora-shell
before_script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
script:
# - docker push registry.gitlab.com/?/mynodeapp-cicd-project:1.0
# - docker push $CI_REGISTRY_IMAGE/microservice/payment:1.0
- docker push $IMAGE_NAME:$IMAGE_TAG
deploy_to_dev:
stage: deploy
tags:
- johnlap-fedora-shell
before_script:
- chmod 644 $SSH_PRIVATE_KEY
script:
- ssh -v -o StrictHostKeyChecking=no -i $SSH_PRIVATE_KEY pala@$DEV_SERVER_HOST "
docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY &&
docker run -d -p 3000:3000 $IMAGE_NAME:$IMAGE_TAG"
作业输出
Running with gitlab-runner 15.4.0 (43b2dc3d)
on johnlap-fedora-shell FCNMb4yU
Preparing the "shell" executor
00:00
Using Shell executor...
Preparing environment
00:01
Running on fedora...
Getting source from Git repository
00:01
Fetching changes with git depth set to 20...
Reinitialized existing Git repository in /home/gitlab-runner/builds/FCNMb4yU/0/?/mynodeapp-cicd-project/.git/
Checking out 105f1987 as main...
Removing app/junit.xml
Skipping Git submodules setup
Downloading artifacts
00:01
Downloading artifacts for run_unit_tests (3199528349)...
Runtime platform arch=amd64 os=linux pid=27228 revision=43b2dc3d version=15.4.0
Downloading artifacts from coordinator... ok id=3199528349 responseStatus=200 OK token=r4U5kiaw
Executing "step_script" stage of the job script
00:01
$ chmod 644 $SSH_PRIVATE_KEY
$ ssh -v -o StrictHostKeyChecking=no -i $SSH_PRIVATE_KEY pala@$DEV_SERVER_HOST " docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY && docker run -d -p 3000:3000 $IMAGE_NAME:$IMAGE_TAG"
OpenSSH_8.8p1, OpenSSL 3.0.5 5 Jul 2022
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug1: Connecting to ?.?.?.? port 22.
debug1: Connection established.
debug1: identity file /home/gitlab-runner/builds/FCNMb4yU/0/?/mynodeapp-cicd-project.tmp/SSH_PRIVATE_KEY type 3
debug1: identity file /home/gitlab-runner/builds/FCNMb4yU/0/?/mynodeapp-cicd-project.tmp/SSH_PRIVATE_KEY-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.8 FreeBSD-openssh-portable-8.8.p1_1,1
debug1: compat_banner: match: OpenSSH_8.8 FreeBSD-openssh-portable-8.8.p1_1,1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to ?.?.?.?:22 as 'pala'
debug1: load_hostkeys: fopen /home/gitlab-runner/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:SSH_PRIVATE_KEY-HERE
debug1: load_hostkeys: fopen /home/gitlab-runner/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '?.?.?.?' is known and matches the ED25519 host key.
debug1: Found key in /home/gitlab-runner/.ssh/known_hosts:1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 4294967296 blocks
debug1: Will attempt key: /home/gitlab-runner/builds/FCNMb4yU/0/?/mynodeapp-cicd-project.tmp/SSH_PRIVATE_KEY ED25519 SHA256:PRIVATEKEYHERE explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /home/gitlab-runner/builds/FCNMb4yU/0/?/mynodeapp-cicd-project.tmp/SSH_PRIVATE_KEY ED25519 SHA256:PRIVATEKEYHERE explicit
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug1: Authentications that can continue: publickey,password,keyboard-interactive
Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: No such device or address
Received disconnect from ?.?.?.? port 22:2: Too many authentication failures
Disconnected from ?.?.?.? port 22
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: exit status 1
此行表明它找到了私钥：
debug1: Found key in /home/gitlab-runner/.ssh/known_hosts:1
这些行表明它正在尝试使用 /dev/tty 文件与终端通信。当然，这个脚本是在非交互式庄园中运行的，所以它失败了。它不应该使用我的密钥而不是从终端请求密码吗？ 私钥/公钥一定有问题。
debug1: Next authentication method: keyboard-interactive
debug1: read_passphrase: can't open /dev/tty
【问题讨论】：
-
您的私钥密码是否受到保护？如果是，您是否尝试过使用没有密码的创建？
-
根据调试输出，ssh 将 /home/gitlab-runner/builds/FCNMb4yU/0/?/mynodeapp-cicd-project.tmp/SSH_PRIVATE_KEY 中的密钥提供给服务器，服务器不接受它。所有关于 /dev/tty 的行都只是 ssh 在用完要尝试的密钥后退回到一种密码身份验证形式。