docker - 如何从外部计算机到ec2 ubuntu主机上的SSH容器

Question

我在ubuntu ec2主机上运行docker Demon。

我能够在此ubuntu ec2主机上设置sshd容器，并能够从docker主机ssh进入。

ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker run -d -P --name ssh-enabled ssh-enabled
bb7f535124b3df403ae97da770fe2e4a4969a7ecddfb5d546aaddfe00e40374d

ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker port ssh-enabled
22/tcp -> 0.0.0.0:32768

ubuntu@ip-172-16-27-205:~/docker-work$ ssh root@127.0.0.1 -p 32768

The authenticity of host '[127.0.0.1]:32768 ([127.0.0.1]:32768)' can't be established.
ECDSA key fingerprint is e6:74:aa:52:8e:3d:19:7a:92:da:85:d4:b9:f9:ed:f1.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:32768' (ECDSA) to the list of known      hosts.
root@127.0.0.1's password:
Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.19.0-30-generic x86_64)

* Documentation:  https://help.ubuntu.com/

 The programs included with the Ubuntu system are free software;
 the exact distribution terms for each program are described in the
 individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

root@bb7f535124b3:~#

但是我不确定如何从外部Docker主机连接到该容器。

我可以从如下所示的外部计算机SSH到Docker主机

 ssh -i /home/xxxxxx/xxxxxxxxx.pem ubuntu@172.16.27.205

但是我希望直接ssh到容器

docker容器启动，如下命令响应所示

ubuntu@ip-172-16-27-205:~/docker-work$ sudo docker ps -as

CONTAINER ID        IMAGE               COMMAND                  CREATED                  STATUS                      PORTS                   NAMES               SIZE
bb7f535124b3        ssh-enabled         "/usr/sbin/sshd -D"      8 minutes ago       Up 8 minutes                0.0.0.0:32768->22/tcp   ssh-enabled         32.51 kB (virtual 868.4 MB)

因为Docker主机正在侦听端口32768，所以当我尝试以root用户身份使用ssh容器时失败

rbharadwaj@syd01-devops-ansible02:~$ ssh -i '/home/xxxxx/xxxxxxx.pem' root@172.16.27.205 -p 32768 -v
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1  Ubuntu-2ubuntu2.8
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.8 pat OpenSSH_6.6.1* compat  0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ED25519   3e:6a:c6:9e:34:98:2e:81:b5:e1:88:d1:15:63:bb:41
debug1: checking without port identifier
 The authenticity of host '[172.16.27.205]:32768 ([172.16.27.205]:32768)' can't be established.
 ED25519 key fingerprint is 3e:6a:c6:9e:34:98:2e:81:b5:e1:88:d1:15:63:bb:41.
 Are you sure you want to continue connecting (yes/no)? yes
 Warning: Permanently added '[172.16.27.205]:32768' (ED25519) to the list of   known hosts.
 debug1: ssh_ed25519_verify: signature correct
 debug1: SSH2_MSG_NEWKEYS sent
 debug1: expecting SSH2_MSG_NEWKEYS
 debug1: SSH2_MSG_NEWKEYS received
 debug1: SSH2_MSG_SERVICE_REQUEST sent
 debug1: SSH2_MSG_SERVICE_ACCEPT received
 debug1: Authentications that can continue: publickey,password
 debug1: Next authentication method: publickey
 debug1: Trying private key: /home/rbharadwaj/syd01-devops-ruc-app-instances
 debug1: key_parse_private2: missing begin marker
 debug1: read PEM private key done: type RSA
 debug1: Authentications that can continue: publickey,password
 debug1: No more authentication methods to try.
 Permission denied (publickey,password).

认为私钥是用户Ubuntu的，我也尝试将ssh放入如下容器中，但是失败了

ssh -i '/home/xxxx/xxxxx.pem' ubuntu@172.16.27.205 -p 32768

请建议在上述情况下如何直接连接到容器

Answer 1

ssh的输出看起来好像您没有正确设置私钥。它是否在容器中的正确位置(/root/.ssh/authorized_keys)中，并且具有正确的权限？

chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys