2.2 SSH服务器与OpenSSH
SSH服务器
配置SSH服务器配置文件 /etc/ssh/sshd_config
[root@CentOS7 ~]# cat /etc/ssh/sshd_config
# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22 #默认监听端口，建议修改
#AddressFamily any #支持IP协议，默认v4、v6都支持
#ListenAddress 0.0.0.0 #默认监听的IP地址，建议修改为内网地址
#ListenAddress ::
HostKey /etc/ssh/ssh_host_rsa_key #密钥文件名
#HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
# Ciphers and keying
#RekeyLimit default none
# Logging #日志的配置，默认存放在/var/log/secure
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
#PermitRootLogin yes #是否允许root直接登陆，建议no
#StrictModes yes #是否检查密钥文件的权限
#MaxAuthTries 6 #最大尝试登录次数，实际为二分之一
#MaxSessions 10 #相同会话最多同时连接次数
#PubkeyAuthentication yes #是否允许基于Key验证连接
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys #公钥文件存放路径
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes #是否允许通过用户口令进行连接
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
#KerberosUseKuserok yes
# GSSAPI options
GSSAPIAuthentication no #是否使用此类验证，建议no
GSSAPICleanupCredentials no
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
#GSSAPIEnablek5users no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
# problems.
UsePAM yes
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0 #客户端连接活动间隔，单位是秒
#ClientAliveCountMax 3 #客户端活动间隔探测次数，超出即断开连接
#ShowPatchLevel no
UseDNS no #是否使用DNS反向解析，建议no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100 #支持最大的未验证连接数，10个未验证连接:超过后，断开30%未验证连接:超过100个时断开所有未验证连接#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none #提示信息
# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server 添加 AllowUsers 用户... 可以限制远程主机允许通过那些用户登陆 ssh 服务器，不再此列表中的用户，远程主机皆不能访问，包括 root 用户；
添加 DenyUsers 用户... 可以限制远程主机不能通过那些用户登陆 ssh 服务器。
当一个用户同时出现在 AllowUsers 与 DenyUsers 列表中时，ssh 会拒绝远程主机通过此用户访问 ssh 服务器。
sftp命令类似与传统的 ftp 工具，但是在链接基于在 SSH 协议，可以安全的传输数据。
[root@CentOS6 ~]# sftp [email protected] #sftp是交互式命令
Connecting to 192.168.30.74...
sftp> ls
11 Desktop Documents Downloads Music Pictures Public Templates
Videos aa anaconda-ks.cfg app bin initial-setup-ks.cfg user.txt useradd
sftp> pwd
Remote working directory: /root
sftp> get /etc/fstab /data
Fetching /etc/fstab to /data/fstab
/etc/fstab 100% 595 0.6KB/s 00:00
sftp> exit
pssh工具
pssh命令用于在多台主机上通过 SSH 连接并发执行命令。
语法：pssh 目标主机 [选项] 动作
[root@CentOS6 ~]# pssh -H 192.168.30.74 -H 192.168.30.75 -A -i pwd
Warning: do not enter your password if anyone else has superuser
privileges or access to your account.
Password:
[1] 13:50:51 [SUCCESS] 192.168.30.74
/root
[2] 13:50:57 [SUCCESS] 192.168.30.75
/root
[root@CentOS6 ~]# pssh -H 192.168.30.74 -H 192.168.30.75 -i pwd
[1] 13:52:55 [SUCCESS] 192.168.30.74
/root
[2] 13:52:56 [SUCCESS] 192.168.30.75
/root
选项：
-h：主机文件列表，内容格式每行为”[user@]host[:port]”
-H：主机字符串
-l：登录使用的用户名
-p：并发的线程数
-o：输出的文件目录，输出时会覆盖原文件内容
-e：错误输入文件
-t：TIMEOUT 超时时间设置，0无限制
-O：SSH的选项
-v：详细模式
-A：手动输入密码模式，不使用 -A 选项需要两台主机已完成基于Key验证
-x：额外的命令行参数使用空白符号，引号，反斜线处理
-X：额外的命令行参数，单个参数模式，同-x
-i：每个服务器内部处理信息输出
-P：打印出服务器返回信息
[root@CentOS7 err.log]#⮀ssh [email protected] 'echo $PATH'
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
[root@CentOS7 err.log]#⮀ssh [email protected] 'echo $PATH'
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
[root@CentOS7 err.log]#⮀ssh [email protected] 'echo $PATH'
/app/bin:/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin由此可见，在当需要执行的命令或者脚本不再上述 PATH变量 中，则需要使用绝对路径。
pscp.pssh命令用于向多台主机推送文件。
语法：pscp.pssh 目标主机 [选项] 本地文件 远程目录
[root@CentOS7 data]# pscp.pssh -H 192.168.30.75 -H 192.168.30.69 host.sh /root/bin
[1] 14:32:29 [SUCCESS] 192.168.30.69
[2] 14:32:30 [SUCCESS] 192.168.30.75
选项：与 pssh 差别不大，多了 -r 递归复制
-r：递归复制
-h：主机文件列表，内容格式每行为”[user@]host[:port]”
-H：主机字符串
-O：SSH的选项
-o：输出的文件目录，输出时会覆盖原文件内容
-e：错误输入文件
-t：TIMEOUT 超时时间设置，0无限制
-x：额外的命令行参数使用空白符号，引号，反斜线处理
-X：额外的命令行参数，单个参数模式，同-x
pslurp命令用于从多台主机拉取文件。
语法：pslurp.pssh 目标主机 [选项] -L 本地目录 远程文件 [输出文件名]
[root@CentOS7 err.log]#⮀pslurp -H [email protected] -H 192.168.30.69 -L /data/ /var/log/messages maa
[1] 16:02:27 [SUCCESS] 192.168.30.69
[2] 16:02:28 [SUCCESS] [email protected]
SSH端口转发
搭建实验环境
1、创建iptables，拒绝 192.168.30.69 连接 192.168.30.75
[root@CentOS7 ~]# iptables -A INPUT -s 192.168.30.69 -j REJECT
[root@CentOS7 ~]# iptables -L -n -v
Chain INPUT (policy ACCEPT 92 packets, 15050 bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- * * 192.168.30.69 0.0.0.0/0 reject-with icmp-port-unreachable
2、启用 192.168.30.75 上的 telnet 服务端口
[root@CentOS7 ~]# systemctl status telnet.socket
● telnet.socket - Telnet Server Activation Socket
Loaded: loaded (/usr/lib/systemd/system/telnet.socket; disabled; vendor preset: disabled)
Active: active (listening) since Fri 2018-05-25 00:19:27 CST; 8min ago
Docs: man:telnetd(8)
Listen: [::]:23 (Stream)
Accepted: 0; Connected: 0
May 25 00:19:27 CentOS7.Miriam systemd[1]: Listening on Telnet Server Activation Socket.
May 25 00:19:27 CentOS7.Miriam systemd[1]: Starting Telnet Server Activation Socket.本地端口转发
本地主机是192.168.30.69
语法：ssh -L 本地端口:目标主机地址:目标端口 SSH服务器地址
[root@CentOS6 ~]# ssh -L 1024:192.168.30.75:23 192.168.30.74 #建立192.168.30.69与192.168.30.74的ssh端口转发连接
Last login: Thu May 24 13:51:17 2018 from 192.168.30.69
[root@CentOS7 ~]# [root@CentOS6 ~]# telnet 127.0.0.1 1024 #使用本地1024端口连接telnet服务
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Kernel 3.10.0-862.el7.x86_64 on an x86_64
CentOS7 login: jiangbowen
Password:
[jiangbowen@CentOS7 ~]$ #连接成功[root@CentOS7 ~]# ss -nt #查看192.168.30.74的端口状态
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 192.168.30.74:22 192.168.30.69:55416
ESTAB 0 0 192.168.30.74:54308 192.168.30.75:23
ESTAB 0 52 192.168.30.74:22 192.168.30.1:1799 选项：
-f 后台启用
-N 不打开远程shell，处于等待状态
-g 启用网关功能
转发过程：data<->localhost:1024<->localhost:XXXXX<->sshsrv:22 <->sshsrv:YYYYY<->telnetsrv:23
远程端口转发
本地主机是192.168.30.74
语法：ssh -R 远程端口:目标主机地址:目标端口 SSH服务器地址
[root@CentOS7 ~]# ssh -R 1024:192.168.30.75:23 192.168.30.69 #建立192.168.30.74与192.168.30.69的ssh端口转发连接
Last login: Thu May 24 17:14:38 2018 from 192.168.30.74
[root@CentOS6 ~]#[root@CentOS6 ~]# ss -nt #192.168.30.69上的端口状态
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 192.168.30.69:22 192.168.30.1:1796
ESTAB 0 0 192.168.30.69:22 192.168.30.74:50658
[root@CentOS6 ~]# ss -ntl #本地1024端口已经处于监听状态
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 127.0.0.1:1024 *:*
LISTEN 0 128 ::1:1024 :::*
LISTEN 0 128 :::33959 :::*
LISTEN 0 128 :::111 :::*
LISTEN 0 128 *:111 *:*
LISTEN 0 128 :::22 :::*
LISTEN 0 128 *:22 *:*
LISTEN 0 128 127.0.0.1:631 *:*
LISTEN 0 128 ::1:631 :::*
LISTEN 0 100 ::1:25 :::*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 *:44351 *:*
[root@CentOS6 ~]# telnet 127.0.0.1 1024 #使用telney访问本地的1024端口
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Kernel 3.10.0-862.el7.x86_64 on an x86_64
CentOS7 login: jiangbowen
Password:
Last login: Fri May 25 00:54:56 from ::ffff:192.168.30.74
[jiangbowen@CentOS7 ~]$ #连接成功转发过程：data<->sshsrv:1024<->sshsrv:22<->localhost:XXXXX<->localhost:YYYYY<->telnetsrv:23