From 17ef04bba45fb3417b97843dfd1e68a899665635 Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Wed, 30 Sep 2026 18:14:55 +0800
Subject: [PATCH] =?UTF-8?q?=E5=87=8F=E5=B0=91SSH=E4=B8=BB=E6=9C=BA?=
 =?UTF-8?q?=E5=AF=86=E9=92=A5=E5=8D=8F=E5=95=86=E8=BF=9E=E6=8E=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/deployment/ssh.go              | 10 +++++++++-
 backend/internal/deployment/ssh_hostkey_test.go | 14 ++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/backend/internal/deployment/ssh.go b/backend/internal/deployment/ssh.go
index 3ad067e..3179c5e 100644
--- a/backend/internal/deployment/ssh.go
+++ b/backend/internal/deployment/ssh.go
@@ -107,7 +107,15 @@ func (f SSHFactory) connect(ctx context.Context, server Server, requireSFTP bool
 func (f SSHFactory) secureHostKeyAlgorithms() ([]string, error) {
 	supported := ssh.SupportedAlgorithms().HostKeys
 	if len(f.HostKeyAlgorithms) == 0 {
-		return append([]string(nil), supported...), nil
+		algorithms := make([]string, 0, len(supported))
+		for _, algorithm := range supported {
+			// 默认只尝试普通主机密钥算法，避免为不可能存在的证书算法重复建立 SSH 连接。
+			if strings.HasSuffix(algorithm, "-cert-v01@openssh.com") {
+				continue
+			}
+			algorithms = append(algorithms, algorithm)
+		}
+		return algorithms, nil
 	}
 	supportedSet := make(map[string]struct{}, len(supported))
 	for _, algorithm := range supported {
diff --git a/backend/internal/deployment/ssh_hostkey_test.go b/backend/internal/deployment/ssh_hostkey_test.go
index bf4f0d7..1c43efa 100644
--- a/backend/internal/deployment/ssh_hostkey_test.go
+++ b/backend/internal/deployment/ssh_hostkey_test.go
@@ -162,6 +162,20 @@ func TestSSHFactoryStopsAfterMatchedHostKeyAuthenticationFailure(t *testing.T) {
 	}
 }
 
+func TestSSHFactoryDefaultHostKeyAlgorithmsExcludeCertificates(t *testing.T) {
+	algorithms, err := (SSHFactory{}).secureHostKeyAlgorithms()
+	if err != nil {
+		t.Fatalf("默认 SSH 主机密钥算法过滤失败：%v", err)
+	}
+	if len(algorithms) == 0 {
+		t.Fatal("默认 SSH 主机密钥算法不能为空")
+	}
+	for _, algorithm := range algorithms {
+		if strings.HasSuffix(algorithm, "-cert-v01@openssh.com") {
+			t.Fatalf("默认算法不应包含 OpenSSH 证书算法：%s", algorithm)
+		}
+	}
+}
 func TestSSHFactoryFiltersUnsupportedAndDuplicateHostKeyAlgorithms(t *testing.T) {
 	factory := SSHFactory{HostKeyAlgorithms: []string{
 		"ssh-dss",