Gitlab CI中rsync SSH连接被拒问题的排查与解决

问题描述 #

使用GitLab CI构建静态网站，并通过SSH密钥对结合Rsync部署到服务器时，始终遭遇服务器连接被拒的问题。已尝试以下方法但均无效：

• 从ED25519密钥更换为RSA密钥
• 在服务器的authorized_keys中添加所有对应公钥
• 通过gitlab-ci.yml调整文件及目录权限
• 使用ssh-keyscan将服务器地址添加到known_hosts

原gitlab-ci.yml配置 #

image: ruby:2

pages:
  stage: deploy
  before_script:
  - apt-get update
  - apt-get install rsync -y
  - eval $(ssh-agent -s)
  - chmod 400 "$SSH_PRIVATE_KEY"
  - ssh-add "$SSH_PRIVATE_KEY"
  - mkdir -p ~/.ssh
  - chmod 700 ~/.ssh
  - ssh-keyscan $SERVER >> ~/.ssh/known_hosts
  - chmod 644 ~/.ssh/known_hosts
  script:
  - bundle install
  - bundle exec jekyll build -d $LOCALDIR
  after_script:
  - rsync -paz $LOCALDIR $USER@$SERVER:$REMOTEDIR
  artifacts:
    paths:
    - $LOCALDIR
  only:
  - master
  - dev

错误日志输出 #

$ rsync -paz $LOCALDIR $USER@$SERVER:$REMOTEDIR
Permission denied, please try again.
Permission denied, please try again.
$SERVER: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
rsync: connection unexpectedly closed (0 bytes received so far) [sender]
rsync error: error in rsync protocol data stream (code 12) at io.c(228) [sender=3.2.3]

排查过程 #

使用ssh -vvvvvv ...命令获取SSH调试日志后，发现SSH未找到私钥文件，推测原配置中的ssh-add "$SSH_PRIVATE_KEY"未正常生效：

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug3: no such identity: /root/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_ecdsa
debug3: no such identity: /root/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /root/.ssh/id_ecdsa_sk
debug3: no such identity: /root/.ssh/id_ecdsa_sk: No such file or directory
debug1: Trying private key: /root/.ssh/id_ed25519
debug3: no such identity: /root/.ssh/id_ed25519: No such file or directory
debug1: Trying private key: /root/.ssh/id_ed25519_sk
debug3: no such identity: /root/.ssh/id_ed25519_sk: No such file or directory
debug1: Trying private key: /root/.ssh/id_xmss
debug3: no such identity: /root/.ssh/id_xmss: No such file or directory
debug2: we did not send a packet, disable method

解决方案 #

将SSH私钥直接复制到~/.ssh/id_ed25519路径后，问题得到解决。以下是最终可用的gitlab-ci.yml配置：

image: ruby:2

pages:
  stage: deploy
  before_script:
  - apt-get update
  - apt-get install rsync -y
  - eval $(ssh-agent -s)
  - mkdir -p ~/.ssh
  - chmod 700 ~/.ssh
  - cp "$SSH_PRIVATE_KEY" ~/.ssh/id_ed25519
  - chmod 600 ~/.ssh/id_ed25519
  - ssh-keyscan $SERVER >> ~/.ssh/known_hosts
  - chmod 644 ~/.ssh/known_hosts
  script:
  - bundle install
  - bundle exec jekyll build -d $LOCALDIR
  after_script:
  - rsync -auz --delete --omit-dir-times $LOCALDIR $USER@$SERVER:$REMOTEDIR
  artifacts:
    paths:
    - $LOCALDIR
  only:
  - master
  - dev

内容的提问来源于stack exchange，提问作者user2540800