Sequel Ace无法通过SSH连接MySQL 求助排查原因

我正将MySQL服务器从5.7版本升级到8.0版本，同时从Sequel Pro迁移至Sequel Ace。迁移设置的官方文档有一定帮助，但使用与Sequel Pro相同的配置信息时，Sequel Ace无法连接服务器。能否通过Sequel Ace输出的OpenSSH错误信息，推测其连接失败而Sequel Pro正常的原因？

OpenSSH_9.0p1, LibreSSL 3.3.6
debug1: Reading configuration data /Applications/Sequel Ace.app/Contents/Resources/ssh_config
debug1: /Applications/Sequel Ace.app/Contents/Resources/ssh_config line 1: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to REDACTED port 22.
debug1: fd 5 clearing O_NONBLOCK
debug1: Connection established.
debug1: identity file /Users/REDACTED/.keys/id_rsa type -1
debug1: identity file /Users/REDACTED/.keys/id_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.0
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.9
debug1: compat_banner: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.9 pat OpenSSH* compat 0x04000000
debug1: Authenticating to REDACTED:22 as 'REDACTED'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:XHJJUykh+CMmszPSY+hp8nkdNLxiS17RcVIxC01UnRw
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'REDACTED' is known and matches the ED25519 host key.
debug1: Found key in /Users/REDACTED/Library/Containers/com.sequel-ace.sequel-ace/Data/.keys/ssh_known_hosts_strict:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: ssh_get_authentication_socket: Operation not permitted
debug1: Will attempt key: /Users/REDACTED/.keys/id_rsa  explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/REDACTED/.keys/id_rsa
no such identity: /Users/REDACTED/.keys/id_rsa: No such file or directory
debug1: No more authentication methods to try.
REDACTED@REDACTED: Permission denied (publickey).
The SSH Tunnel could not authenticate with the remote host. Please check your password and ensure you still have access.

错误原因分析 #

从日志里可以定位到几个核心问题：

• SSH Agent访问权限不足：日志中debug1: get_agent_identities: ssh_get_authentication_socket: Operation not permitted表明Sequel Ace没有权限访问系统的SSH Agent。Sequel Pro可能已获得该权限，因此能通过Agent自动获取密钥完成认证。
• 指定密钥文件不存在：no such identity: /Users/REDACTED/.keys/id_rsa: No such file or directory显示Sequel Ace尝试加载的私钥文件路径错误，文件实际不存在。而Sequel Pro可能使用的是默认~/.ssh/目录下的密钥，或者依赖SSH Agent提供密钥，无需指定路径。
• 服务器仅允许公钥认证：服务器返回Authentications that can continue: publickey，没有开启密码等其他认证方式，一旦密钥加载失败，就会直接认证失败。

解决建议 #

• 配置Sequel Ace的系统权限：打开系统设置→「隐私与安全性」，确保Sequel Ace被授予「完全磁盘访问」权限，或者允许其访问SSH Agent相关权限。
• 修正密钥文件路径：在Sequel Ace的SSH连接配置中，将密钥路径改为实际存在的私钥文件路径（比如默认的~/.ssh/id_rsa），或者将私钥文件移动到/Users/REDACTED/.keys/目录下。
• 手动将密钥添加到SSH Agent：在终端执行ssh-add /path/to/your/private-key（替换为实际私钥路径），将密钥加入Agent后重启Sequel Ace尝试连接。
• 检查私钥文件权限：确保私钥文件的权限设置为600（仅当前用户可读可写），执行chmod 600 /path/to/your/private-key修改权限，避免SSH因权限过高拒绝使用该密钥。

内容的提问来源于stack exchange，提问作者Tom