SSH登录卡死在expecting SSH2_MSG_KEX_DH_GEX_GROUP-解决方法之一

目标主机是一个OpenStack 的centos6,从其它一些centos6,5的主机可以正常(password auth)登录到目标主机;
然而从centos7的却无法登录到目标主机
调试信息显示
SSH登录卡死在expecting SSH2_MSG_KEX_DH_GEX_GROUP
登录时DEBUG信息如下:
ssh -v root@192.168.108.201
OpenSSH_6.4, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 51: Applying options for *
debug1: Connecting to 192.168.108.201 [192.168.108.201] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

经过百度查找资料,发现可以通过修改/etc/ssh/ssh_config使
MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
这一行生效来解决这个问题。

解决方法之二
说是openstack部署在两台物理计算节点机上的两台虚机之间通过ssh执行大数据输出的命令时有hang的情况,
经研究、分析、搜索、试验、最后原因在于MTU:
修改前mtu 1500改为 mtu 1454
命令
ifconfig
eth0: flags=4163 mtu 1500
ip link set eth0 mtu 1454

openstack 方面的设置项
In /etc/neutron/dhcp_agent.ini:

[DEFAULT]

dnsmasq_config_file = /etc/neutron/dnsmasq-neutron.conf
In /etc/neutron/dnsmasq-neutron.conf:

dhcp-option-force=26,1454
Now

killall dnsmasq
service neutron-dhcp-agent restart

李海涛

关于李海涛

李海涛 lihaitao 山水 lihato 开源软件研究与服务
此条目发表在知识积累分类目录。将固定链接加入收藏夹。