如何从外部机器 ssh 到 ec2 ubuntu 主机上的 docker 容器
How to ssh to a docker container on ec2 ubuntu host from outside machine
我在 ubuntu ec2 主机上有 docker 恶魔 运行。
我能够在这个 ubuntu ec2 主机上设置一个 sshd conatainer 并且能够从 docker 主机 ssh 进入。即
ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker run -d -P --name ssh-enabled ssh-enabled
bb7f535124b3df403ae97da770fe2e4a4969a7ecddfb5d546aaddfe00e40374d
ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker port ssh-enabled
22/tcp -> 0.0.0.0:32768
ubuntu@ip-172-16-27-205:~/docker-work$ ssh root@127.0.0.1 -p 32768
The authenticity of host '[127.0.0.1]:32768 ([127.0.0.1]:32768)' can't be established.
ECDSA key fingerprint is e6:74:aa:52:8e:3d:19:7a:92:da:85:d4:b9:f9:ed:f1.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:32768' (ECDSA) to the list of known hosts.
root@127.0.0.1's password:
Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.19.0-30-generic x86_64)
* Documentation: https://help.ubuntu.com/
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
root@bb7f535124b3:~#
但是我不确定如何从 docker 主机外部连接到这个容器。
我可以从外部机器通过 ssh 连接到 docker 主机，如下所示
ssh -i /home/xxxxxx/xxxxxxxxx.pem ubuntu@172.16.27.205
但是我希望直接通过 ssh 连接到容器
docker 容器启动如下命令响应
ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker ps -as
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE
bb7f535124b3 ssh-enabled "/usr/sbin/sshd -D" 8 minutes ago Up 8 minutes 0.0.0.0:32768->22/tcp ssh-enabled 32.51 kB (virtual 868.4 MB)
因为 docker 主机正在侦听端口 32768 当我尝试使用 root 用户连接容器时失败
rbharadwaj@syd01-devops-ansible02:~$ ssh -i '/home/xxxxx/xxxxxxx.pem' root@172.16.27.205 -p 32768 -v
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ED25519 3e:6a:c6:9e:34:98:2e:81:b5:e1:88:d1:15:63:bb:41
debug1: checking without port identifier
The authenticity of host '[172.16.27.205]:32768 ([172.16.27.205]:32768)' can't be established.
ED25519 key fingerprint is 3e:6a:c6:9e:34:98:2e:81:b5:e1:88:d1:15:63:bb:41.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[172.16.27.205]:32768' (ED25519) to the list of known hosts.
debug1: ssh_ed25519_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/rbharadwaj/syd01-devops-ruc-app-instances
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).
认为私钥是用户 Ubuntu 我也尝试像下面那样通过 ssh 进入容器但是它失败了
ssh -i '/home/xxxx/xxxxx.pem' ubuntu@172.16.27.205 -p 32768
请建议我如何在上述情况下直接连接到容器
并不总是建议将容器设置为 运行 ssh。如果您需要监控日志、控制服务等，那么您最好找到其他方法来完成此操作（日志聚合器等），而不是设置对容器的直接 ssh 访问。
有关详细信息，请参阅 https://jpetazzo.github.io/2014/06/23/docker-ssh-considered-evil/。
我知道这不能直接回答您的问题。但是，除了方便之外，您还不清楚为什么需要直接访问您的容器。您如何管理 ssh 密钥？
ssh 的输出看起来您没有正确设置私钥。它是否位于容器中的正确位置 (/root/.ssh/authorized_keys) 并且是否具有正确的权限？
chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys
我按照上面的建议在容器中没有 /root/.ssh 文件夹。
1.) 在容器中创建了 /root/.ssh 目录
2.) 创建授权文件
3.) 从主机中放置 public 密钥的内容 我正在尝试连接到此主机
并且我能够连接
我在 ubuntu ec2 主机上有 docker 恶魔 运行。
我能够在这个 ubuntu ec2 主机上设置一个 sshd conatainer 并且能够从 docker 主机 ssh 进入。即
ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker run -d -P --name ssh-enabled ssh-enabled
bb7f535124b3df403ae97da770fe2e4a4969a7ecddfb5d546aaddfe00e40374d
ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker port ssh-enabled
22/tcp -> 0.0.0.0:32768
ubuntu@ip-172-16-27-205:~/docker-work$ ssh root@127.0.0.1 -p 32768
The authenticity of host '[127.0.0.1]:32768 ([127.0.0.1]:32768)' can't be established.
ECDSA key fingerprint is e6:74:aa:52:8e:3d:19:7a:92:da:85:d4:b9:f9:ed:f1.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:32768' (ECDSA) to the list of known hosts.
root@127.0.0.1's password:
Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.19.0-30-generic x86_64)
* Documentation: https://help.ubuntu.com/
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
root@bb7f535124b3:~#
但是我不确定如何从 docker 主机外部连接到这个容器。
我可以从外部机器通过 ssh 连接到 docker 主机，如下所示
ssh -i /home/xxxxxx/xxxxxxxxx.pem ubuntu@172.16.27.205
但是我希望直接通过 ssh 连接到容器
docker 容器启动如下命令响应
ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker ps -as
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES SIZE
bb7f535124b3 ssh-enabled "/usr/sbin/sshd -D" 8 minutes ago Up 8 minutes 0.0.0.0:32768->22/tcp ssh-enabled 32.51 kB (virtual 868.4 MB)
因为 docker 主机正在侦听端口 32768 当我尝试使用 root 用户连接容器时失败
rbharadwaj@syd01-devops-ansible02:~$ ssh -i '/home/xxxxx/xxxxxxx.pem' root@172.16.27.205 -p 32768 -v
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8 pat OpenSSH_6.6.1* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ED25519 3e:6a:c6:9e:34:98:2e:81:b5:e1:88:d1:15:63:bb:41
debug1: checking without port identifier
The authenticity of host '[172.16.27.205]:32768 ([172.16.27.205]:32768)' can't be established.
ED25519 key fingerprint is 3e:6a:c6:9e:34:98:2e:81:b5:e1:88:d1:15:63:bb:41.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[172.16.27.205]:32768' (ED25519) to the list of known hosts.
debug1: ssh_ed25519_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/rbharadwaj/syd01-devops-ruc-app-instances
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).
认为私钥是用户 Ubuntu 我也尝试像下面那样通过 ssh 进入容器但是它失败了
ssh -i '/home/xxxx/xxxxx.pem' ubuntu@172.16.27.205 -p 32768
请建议我如何在上述情况下直接连接到容器
并不总是建议将容器设置为 运行 ssh。如果您需要监控日志、控制服务等，那么您最好找到其他方法来完成此操作（日志聚合器等），而不是设置对容器的直接 ssh 访问。
有关详细信息，请参阅 https://jpetazzo.github.io/2014/06/23/docker-ssh-considered-evil/。
我知道这不能直接回答您的问题。但是，除了方便之外，您还不清楚为什么需要直接访问您的容器。您如何管理 ssh 密钥？
ssh 的输出看起来您没有正确设置私钥。它是否位于容器中的正确位置 (/root/.ssh/authorized_keys) 并且是否具有正确的权限？
chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys
我按照上面的建议在容器中没有 /root/.ssh 文件夹。
1.) 在容器中创建了 /root/.ssh 目录
2.) 创建授权文件
3.) 从主机中放置 public 密钥的内容 我正在尝试连接到此主机
并且我能够连接