Linux 101 系列:ssh OpenSSH 客户端工具

使用 *nix 服务器肯定会用到 ssh,它是一个链接到远程服务器终端的工具。

基本常识

基本组成部分

$ man ssh
ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
     [-D [bind_address:]port] [-e escape_char] [-F configfile] [-I pkcs11]
     [-i identity_file] [-L [bind_address:]port:host:hostport]
     [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
     [-R [bind_address:]port:host:hostport] [-S ctl_path] [-W host:port]
     [-w local_tun[:remote_tun]] [user@]hostname [command]

有没有被帮助手册的参数吓到,那我们精简一下:

ssh [user@]hostname [-p port]

登录到远程服务器和登录本地电脑系统没什么大的区别,都需要用户名,密码,除此之外我们还需要知道远程服务器的地址(IP 地址或域名均可)及允许的端口(默认 22 端口)。

$ ssh root@10.10.10.10 -p 22

有些时候大家发现一些教程没有提到用户,实际上 ssh 很聪明,默认会使用当前系统的用户名:

(icyleaf) $ ssh 10.10.10.10

这个就等同于

$ ssh icyleaf@10.10.10.10

有些服务器可能为了安全期间修改了默认的端口,比如 2020:

$ ssh icyleaf@10.10.10.10 -p 2020

高级参数

Socket 代理

呐,你可能因为 GFW 的威力,尝试使用 ssh 的 socket 代理,实际上就是用到的 -D 参数:

-D [bind_address:]port
   Specifies a local ``dynamic application-level port forwarding.
   This works by allocating a socket to listen to port on the local
   side, optionally bound to the specified bind_address.  Whenever a
   connection is made to this port, the connection is forwarded over
   the secure channel, and the application protocol is then used to
   determine where to connect to from the remote machine.  Currently
   the SOCKS4 and SOCKS5 protocols are supported, and ssh will act
   as a SOCKS server.  Only root can forward privileged ports.

我们来简单画下它的工作流程:

|----client----|                    |-----server----|
|              |                    |               |
|   local port<|  <incoming         |               |
|    ssh port<>|  <-------------->  |<> ssh port    |
                                    |    forwarding>|  >outgoing connection

                                     <<<------------local network-----------

它首先需要登录到远程服务器,并把本地的请求全部转发到服务器指定的端口上,然后通过由服务器再去请求。例如我们设置 8624 端口:

$ ssh -D8624 icyleaf@10.10.10.10 -p 22

这样保持这个连接,我们在设置浏览器或系统的 socket4/5 代理就能达到翻墙的目的。当前这个最大的前提是你的服务器在不手 GFW 的控制下(任意海外未被 GFW 服务器)

跳板代理

或许曾经你在看某本黑客杂志或电影出现过这样的片段,黑客使用肉鸡跳板不断的增加难度避开警察的追踪,实际上我们通过 ssh 也能非常简单又很酷的实现。

-L [bind_address:]port:host:hostport
   Specifies that the given port on the local (client) host is to be
   forwarded to the given host and port on the remote side.  This
   works by allocating a socket to listen to port on the local side,
   optionally bound to the specified bind_address.  Whenever a con-
   nection is made to this port, the connection is forwarded over
   the secure channel, and a connection is made to host port
   hostport from the remote machine.

同样给出工作流程:

|----client----|                    |-----server----|                 |-----host-----|
|              |                    |               |                 |              |
|   local port<|  <incoming         |               |                 |              |
|    ssh port<>|  <-------------->  |<> ssh port    |                 |              |
                                    |    forwarding>|  -------------> |>host port    |

                                     <<<------------local network------------------->>>

实际上我只需要操作 -L [bind_address:]port:host:hostport 即可。这里假设我们想登录的目标服务器 target(10.10.10.10),而我们希望在肉鸡 chicken(20.20.20.20) 上做成跳板:

$ ssh -L2020:20.20.20.20:22 10.10.10.10

简化配置

反复的输入这些繁琐的参数,甚是苦恼,能不能通过一种起个别名就能把上面的参数全部自动设置好呢?!没问题!

创建 ~/.ssh/config 文件:

Host linode
HostName 10.10.10.10
Port 22
User icyleaf

这个就是基本组成部分。如果你想配置更多,下面是完整的参数:

AddressFamily
BatchMode
BindAddress
ChallengeResponseAuthentication
CheckHostIP
Cipher
Ciphers
ClearAllForwardings
Compression
CompressionLevel
ConnectionAttempts
ConnectTimeout
ControlMaster
ControlPath
ControlPersist
DynamicForward
EscapeChar
ExitOnForwardFailure
ForwardAgent
ForwardX11
ForwardX11Timeout
ForwardX11Trusted
GatewayPorts
GlobalKnownHostsFile
GSSAPIAuthentication
GSSAPIDelegateCredentials
HashKnownHosts
Host
HostbasedAuthentication
HostKeyAlgorithms
HostKeyAlias
HostName
IdentityFile
IdentitiesOnly
IPQoS
KbdInteractiveAuthentication
KbdInteractiveDevices
KexAlgorithms
LocalCommand
LocalForward
LogLevel
MACs
NoHostAuthenticationForLocalhost
NumberOfPasswordPrompts
PasswordAuthentication
PermitLocalCommand
PKCS11Provider
Port
PreferredAuthentications
Protocol
ProxyCommand
PubkeyAuthentication
RekeyLimit
RemoteForward
RequestTTY
RhostsRSAAuthentication
RSAAuthentication
SendEnv
ServerAliveInterval
ServerAliveCountMax
StrictHostKeyChecking
TCPKeepAlive
Tunnel
TunnelDevice
UsePrivilegedPort
User
UserKnownHostsFile
VerifyHostKeyDNS
VisualHostKey
XAuthLocation

配置文件

刚才讲到的 ~/.ssh/config 是配置 ssh 服务器的文件,其实除了这些还有好多,比如大家可能会经常见到的:

~/.ssh/config
  This is the per-user configuration file.  The file format and
  configuration options are described in ssh_config(5).  Because of
  the potential for abuse, this file must have strict permissions:
  read/write for the user, and not accessible by others.

~/.ssh/authorized_keys
  Lists the public keys (DSA/ECDSA/RSA) that can be used for log-
  ging in as this user.  The format of this file is described in
  the sshd(8) manual page.  This file is not highly sensitive, but
  the recommended permissions are read/write for the user, and not
  accessible by others.

~/.ssh/identity
~/.ssh/id_dsa
~/.ssh/id_ecdsa
~/.ssh/id_rsa
  Contains the private key for authentication.  These files contain
  sensitive data and should be readable by the user but not acces-
  sible by others (read/write/execute).  ssh will simply ignore a
  private key file if it is accessible by others.  It is possible
  to specify a passphrase when generating the key which will be
  used to encrypt the sensitive part of this file using 3DES.

~/.ssh/identity.pub
~/.ssh/id_dsa.pub
~/.ssh/id_ecdsa.pub
~/.ssh/id_rsa.pub
  Contains the public key for authentication.  These files are not
  sensitive and can (but need not) be readable by anyone.

~/.ssh/known_hosts
  Contains a list of host keys for all hosts the user has logged
  into that are not already in the systemwide list of known host
  keys.  See sshd(8) for further details of the format of this
  file.

更多文件:

~/.rhosts
  This file is used for host-based authentication (see above).  On
  some machines this file may need to be world-readable if the
  user's home directory is on an NFS partition, because sshd(8)
  reads it as root.  Additionally, this file must be owned by the
  user, and must not have write permissions for anyone else.  The
  recommended permission for most machines is read/write for the
  user, and not accessible by others.

~/.shosts
  This file is used in exactly the same way as .rhosts, but allows
  host-based authentication without permitting login with
  rlogin/rsh.

~/.ssh/
  This directory is the default location for all user-specific con-
  figuration and authentication information.  There is no general
  requirement to keep the entire contents of this directory secret,
  but the recommended permissions are read/write/execute for the
  user, and not accessible by others.

~/.ssh/environment
  Contains additional definitions for environment variables; see
  ENVIRONMENT, above.

~/.ssh/rc
  Commands in this file are executed by ssh when the user logs in,
  just before the user's shell (or command) is started.  See the
  sshd(8) manual page for more information.

/etc/hosts.equiv
  This file is for host-based authentication (see above).  It
  should only be writable by root.

/etc/shosts.equiv
  This file is used in exactly the same way as hosts.equiv, but
  allows host-based authentication without permitting login with
  rlogin/rsh.

/etc/ssh/ssh_config
  Systemwide configuration file.  The file format and configuration
  options are described in ssh_config(5).

/etc/ssh/ssh_host_key
/etc/ssh/ssh_host_dsa_key
/etc/ssh/ssh_host_ecdsa_key
/etc/ssh/ssh_host_rsa_key
  These files contain the private parts of the host keys and are
  used for host-based authentication.  If protocol version 1 is
  used, ssh must be setuid root, since the host key is readable
  only by root.  For protocol version 2, ssh uses ssh-keysign(8) to
  access the host keys, eliminating the requirement that ssh be
  setuid root when host-based authentication is used.  By default
  ssh is not setuid root.

/etc/ssh/ssh_known_hosts
  Systemwide list of known host keys.  This file should be prepared
  by the system administrator to contain the public host keys of
  all machines in the organization.  It should be world-readable.
  See sshd(8) for further details of the format of this file.

/etc/ssh/sshrc
  Commands in this file are executed by ssh when the user logs in,
  just before the user's shell (or command) is started.  See the
  sshd(8) manual page for more information.

资料参考:

  1. [Linux] man ssh
  2. Advanced SSH usage

icyleaf

热爱户外的码农、下厨初心者

Beijing, China http://icyleaf.com