ssh

SSH Management and Security

Overview

Skills such as SSH key management, jump host configuration, port forwarding, and security hardening.

Basic Connection

Connection Commands

# 基础连接
ssh user@hostname
ssh -p 2222 user@hostname           # 指定端口

# 执行远程命令
ssh user@hostname "command"
ssh user@hostname 'ls -la && df -h'

Verbose Output (Debugging)

ssh -v user@hostname ssh -vvv user@hostname # more verbose

### 配置文件
```bash
# ~/.ssh/config
Host myserver
    HostName 192.168.1.100
    User admin
    Port 22
    IdentityFile ~/.ssh/id_rsa_myserver

Host dev-*
    User developer
    IdentityFile ~/.ssh/id_rsa_dev

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    AddKeysToAgent yes

# 使用配置
ssh myserver

Key Management

Generate Key

# 生成 RSA 密钥（推荐 4096 位）
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

# 生成 Ed25519 密钥（推荐）
ssh-keygen -t ed25519 -C "your_email@example.com"

# 指定文件名
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_work

# 修改密码
ssh-keygen -p -f ~/.ssh/id_rsa

Deploy Public Key

# 方式1：ssh-copy-id
ssh-copy-id user@hostname
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@hostname

# 方式2：手动复制
cat ~/.ssh/id_ed25519.pub | ssh user@hostname "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

# 方式3：直接编辑
ssh user@hostname
echo "public_key_content" >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

SSH Agent

# 启动 agent
eval "$(ssh-agent -s)"

# 添加密钥
ssh-add ~/.ssh/id_rsa
ssh-add -l                          # 列出已添加的密钥

# 转发 agent（跳板机场景）
ssh -A user@jumphost

Port Forwarding

Local Forwarding

# 将本地端口转发到远程
ssh -L local_port:target_host:target_port user@ssh_server

# 示例：访问远程 MySQL
ssh -L 3306:localhost:3306 user@dbserver
mysql -h 127.0.0.1 -P 3306

# 示例：访问内网服务
ssh -L 8080:internal.server:80 user@jumphost
curl http://localhost:8080

Remote Forwarding

# 将远程端口转发到本地
ssh -R remote_port:local_host:local_port user@ssh_server

# 示例：暴露本地服务
ssh -R 8080:localhost:3000 user@public_server
# 现在可以通过 public_server:8080 访问本地 3000 端口

Dynamic Forwarding (SOCKS Proxy)

# 创建 SOCKS5 代理
ssh -D 1080 user@ssh_server

# 使用代理
curl --socks5 localhost:1080 http://example.com

Run in Background

# 后台运行隧道
ssh -fNL 3306:localhost:3306 user@server

# -f 后台运行
# -N 不执行远程命令
# -L 本地转发

Jump Host Configuration

ProxyJump (Recommended)

# 命令行
ssh -J jumphost user@target

# 配置文件
Host target
    HostName 192.168.1.100
    User admin
    ProxyJump jumphost

Host jumphost
    HostName jump.example.com
    User jumper

ProxyCommand

# 配置文件
Host target
    HostName 192.168.1.100
    User admin
    ProxyCommand ssh -W %h:%p jumphost

Security Hardening

sshd_config Configuration

# /etc/ssh/sshd_config

# 禁用密码登录
PasswordAuthentication no
ChallengeResponseAuthentication no

# 禁用 root 登录
PermitRootLogin no

# 限制用户
AllowUsers admin developer
AllowGroups sshusers

# 修改端口
Port 2222

# 限制登录尝试
MaxAuthTries 3
MaxSessions 5

# 空闲超时
ClientAliveInterval 300
ClientAliveCountMax 2

# 禁用不安全选项
X11Forwarding no
PermitEmptyPasswords no

Apply Configuration

# 测试配置
sshd -t

# 重载配置
systemctl reload sshd

Common Scenarios

Scenario 1: Batch Command Execution

# 使用 for 循环
for host in server1 server2 server3; do
    ssh $host "uptime"
done

# 使用 parallel-ssh
pssh -h hosts.txt -i "uptime"

Scenario 2: File Transfer

# scp
scp file.txt user@host:/path/
scp -r dir/ user@host:/path/
scp user@host:/path/file.txt ./

# rsync over SSH
rsync -avz -e ssh source/ user@host:/dest/

Scenario 3: Keep Connection Alive

# ~/.ssh/config
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    TCPKeepAlive yes

# 使用 autossh
autossh -M 0 -fN -L 3306:localhost:3306 user@server

Troubleshooting

Issue	Troubleshooting Method
Connection timeout	Check network, firewall, port
Permission denied	Check key permissions (600), authorized_keys
Host key changed	ssh-keygen -R hostname
Agent forwarding failed	Check AllowAgentForwarding
Connection dropped	Configure ServerAliveInterval

# 调试连接
ssh -vvv user@hostname

# 检查密钥权限
ls -la ~/.ssh/
# id_rsa: 600
# id_rsa.pub: 644
# authorized_keys: 600
# ~/.ssh: 700