减少SSH主机密钥协商连接

backend/internal/deployment/ssh.go

@@ -107,7 +107,15 @@ func (f SSHFactory) connect(ctx context.Context, server Server, requireSFTP bool
 func (f SSHFactory) secureHostKeyAlgorithms() ([]string, error) {
 	supported := ssh.SupportedAlgorithms().HostKeys
 	if len(f.HostKeyAlgorithms) == 0 {
-		return append([]string(nil), supported...), nil
+		algorithms := make([]string, 0, len(supported))
+		for _, algorithm := range supported {
+			// 默认只尝试普通主机密钥算法，避免为不可能存在的证书算法重复建立 SSH 连接。
+			if strings.HasSuffix(algorithm, "-cert-v01@openssh.com") {
+				continue
+			}
+			algorithms = append(algorithms, algorithm)
+		}
+		return algorithms, nil
 	}
 	supportedSet := make(map[string]struct{}, len(supported))
 	for _, algorithm := range supported {

backend/internal/deployment/ssh_hostkey_test.go

@@ -162,6 +162,20 @@ func TestSSHFactoryStopsAfterMatchedHostKeyAuthenticationFailure(t *testing.T) {
 	}
 }
 
+func TestSSHFactoryDefaultHostKeyAlgorithmsExcludeCertificates(t *testing.T) {
+	algorithms, err := (SSHFactory{}).secureHostKeyAlgorithms()
+	if err != nil {
+		t.Fatalf("默认 SSH 主机密钥算法过滤失败：%v", err)
+	}
+	if len(algorithms) == 0 {
+		t.Fatal("默认 SSH 主机密钥算法不能为空")
+	}
+	for _, algorithm := range algorithms {
+		if strings.HasSuffix(algorithm, "-cert-v01@openssh.com") {
+			t.Fatalf("默认算法不应包含 OpenSSH 证书算法：%s", algorithm)
+		}
+	}
+}
 func TestSSHFactoryFiltersUnsupportedAndDuplicateHostKeyAlgorithms(t *testing.T) {
 	factory := SSHFactory{HostKeyAlgorithms: []string{
 		"ssh-dss",