Android 上的 Dropbear ssh 隧道段错误

Question

我是一名 android 开发人员，我们正在尝试在 Android 设备和 Linux 主机之间建立 ssh 隧道。我正在为这个解决方案使用 dropbear。

这是我的步骤：

1) 我正在通过带有 0 端口的 dbclient 连接到我的主机

dbclient -i "$RSA_KEY" -f -N -R 0:localhost:22 "$HOST" -y &> /sdcard/out

2) 那我就是运行ning dropbear

dropbear -E -R

3) 现在我可以使用 public 密钥和 /sdcard/out

中的端口从我的主机通过 ssh 连接到设备

ssh -i ssh_rsa_key root@localhost -p 50216

就是它了，而且效果很好。对于我的解决方案，我需要自动建立隧道。

我在 /system/bin/ 下创建了 bash 脚本（使用脚本构建 android 图像）。自动将 init.rc 中的相应服务添加到运行我的脚本。

 service myScript /system/bin/myScript
      class core
      user root
      group root
      disabled

脚本实际上每 5 秒由系统运行执行一次。但是当我尝试连接到设备时，我收到以下错误消息：

Aiee, segfault! You should probably report this as a bug to the developer

最奇怪的是，当我手动运行运行我的脚本时，它工作正常，但是当系统运行s same 脚本时，我收到上面描述的错误信息。

"dmesg"、"logcat"、甚至"ssh ... -vvv"都不给出任何错误信息。

我认为问题出在 "dropbear" 本身，因为当系统运行s "dbclient" 然后我手动运行 "dropbear -E -R" 时，隧道工作正常。

这是我 "ssh ... -v"

的输出

  OpenSSH_7.6p1, LibreSSL 2.6.2
  debug1: Reading configuration data /etc/ssh/ssh_config
  debug1: /etc/ssh/ssh_config line 48: Applying options for *
  debug1: Connecting to localhost port 50643.
  debug1: Connection established.
  debug1: key_load_public: No such file or directory
  debug1: identity file ssh_rsa_key_to_box type -1
  debug1: key_load_public: No such file or directory
  debug1: identity file ssh_rsa_key_to_box-cert type -1
  debug1: Local version string SSH-2.0-OpenSSH_7.6
  debug1: Remote protocol version 2.0, remote software version dropbear_2017.75
  debug1: no match: dropbear_2017.75
  debug1: Authenticating to localhost:50643 as 'root'
  debug1: SSH2_MSG_KEXINIT sent
  debug1: SSH2_MSG_KEXINIT received
  debug1: kex: algorithm: curve25519-sha256@libssh.org
  debug1: kex: host key algorithm: ssh-rsa
  debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
  debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
  debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
  debug1: Server host key: ssh-rsa SHA256:M1PmvueMNfm4q47UlzVWZMdB6YzxyYBy4I5hden9ctU
  debug1: Host '[localhost]:50643' is known and matches the RSA host key.
  debug1: Found key in /Users/haykbeglaryan/.ssh/known_hosts:23
  debug1: rekey after 4294967296 blocks
  debug1: SSH2_MSG_NEWKEYS sent
  debug1: expecting SSH2_MSG_NEWKEYS
  debug1: SSH2_MSG_NEWKEYS received
  debug1: rekey after 4294967296 blocks
  debug1: SSH2_MSG_SERVICE_ACCEPT received
  debug1: Authentications that can continue: publickey
  debug1: Next authentication method: publickey
  debug1: Trying private key: ssh_rsa_key_to_box
  debug1: Authentication succeeded (publickey).
  Authenticated to localhost ([::1]:50643).
  debug1: channel 0: new [client-session]
  debug1: Entering interactive session.
  debug1: pledge: network
  debug1: Sending environment.
  debug1: Sending env LC_CTYPE = UTF-8
  debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
  Aiee, segfault! You should probably report this as a bug to the developer
  debug1: channel 0: free: client-session, nchannels 1
  debug1: fd 1 clearing O_NONBLOCK
  Connection to localhost closed.
  Transferred: sent 2640, received 1816 bytes, in 0.0 seconds
  Bytes per second: sent 312354.4, received 214861.9
  debug1: Exit status 1

Answer 1

问题出在dropbear使用的环境变量“LD_LIBRARY_PATH”中。当我打印它时

$ echo $LD_LIBRARY_PATH
/vendor/lib:/system/lib

但是当init.rc 尝试读取它时，它是空的。我刚刚在 dropbear 源代码中修改了这一行，现在它可以正常工作了。

Android 上的 Dropbear ssh 隧道段错误

Dropbear ssh tunneling segfault on Android

ssh

android

init

dbclient

dropbear