206 lines
6.4 KiB
Markdown
206 lines
6.4 KiB
Markdown
---
|
||
tags: [计算机网络, SSH, SFTP, SCP]
|
||
create time: 2026-05-18 03:20
|
||
---
|
||
|
||
# SSH 远程安全登录
|
||
|
||
## 概述
|
||
|
||
SSH（Secure Shell）是替代 Telnet、rlogin 等明文协议的加密外壳工具。它不仅仅用于远程登录——SSH 的隧道转发能力使其成为网络安全的瑞士军刀。
|
||
|
||
## SSH 架构三层模型
|
||
|
||
```
|
||
┌─────────────────────────────────┐
|
||
│ Application Layer │ ← SSH-CONNECT, SSH-USERAUTH, SSH-CONNECTION
|
||
│ • scp / sftp │ 每个子协议独立协商版本
|
||
│ • port forwarding │
|
||
│ • X11 forwarding │
|
||
├─────────────────────────────────┤
|
||
│ Transport Layer │ ← Host-key auth + encryption + integrity
|
||
│ • Server host-key authentication│ 一旦建立隧道，所有上层协议自动加密
|
||
│ • Server/pubkey exchange │
|
||
│ • Symmetric encryption │ 默认 AES-128-GCM or ChaCha20-Poly1305
|
||
│ • HMAC integrity │
|
||
├─────────────────────────────────┤
|
||
│ User Authentication Layer │ ← 多种认证方式
|
||
│ • password │ SSH-CONN USER_AUTH_REQUEST
|
||
│ • public key │
|
||
│ • keyboard-interactive │ MFA/TOTP
|
||
│ • GSSAPI (Kerberos) │
|
||
│ • OS Login / Certificate │
|
||
└─────────────────────────────────┘
|
||
```
|
||
|
||
## SSH 密钥交换过程
|
||
|
||
```mermaid
|
||
sequenceDiagram
|
||
participant C as Client
|
||
participant S as Server
|
||
|
||
Note over C,S: Phase 1: Key Exchange (Diffie-Hellman)
|
||
C->>S: KEXINIT (supported ciphers, DH groups, MACs, compressions)
|
||
S-->>C: KEXINIT (negotiated algorithms)
|
||
|
||
Note over C,S: 服务器选择双方都支持的最强算法
|
||
S->>C: Server Key Exchange (DH params)
|
||
S->>C: Server Host Key (RSA/ED25519) + signature
|
||
|
||
Note over C: Verify host key fingerprint!
|
||
C->>S: Client Key Exchange (DH response)
|
||
|
||
Note over C,S: Both compute shared secret → derive session keys
|
||
|
||
Note over C,S: Phase 2: User Authentication
|
||
C->>S: SSH_USERAUTH_REQUEST "root" "password"
|
||
S-->>C: SSH_USERAUTH_SUCCESS ✅
|
||
|
||
Note over C,S: Phase 3: Channel Open
|
||
C->>S: SSH_CHANNEL_OPEN "session"
|
||
S-->>C: SSH_CHANNEL_OPEN_CONFIRMATION
|
||
```
|
||
|
||
### SSH 支持的公钥算法
|
||
|
||
| 算法 | 密钥大小 | 安全性等级 | 备注 |
|
||
|------|---------|-----------|------|
|
||
| **ed25519** | 32 bytes | ~128 bits | ✅ **推荐**，EdDSA 椭圆曲线，速度快 |
|
||
| rsa | 4096 bits | ~128 bits | 通用兼容，但体积大 |
|
||
| ecdsa | 384 bits | ~128 bits | NIST 曲线，争议因 DualECDRBG |
|
||
| dsa | 1024 bits | ~80 bits | ❌ **已弃用**，OpenSSH 7.0+ 禁用 |
|
||
| ssh-rsa (SHA-1) | variable | 弱 | ❌ OpenSSH 8.8+ 默认禁用 |
|
||
|
||
```bash
|
||
# 生成 ed25519 密钥
|
||
$ ssh-keygen -t ed25519 -C "alice@example.com"
|
||
# 或带注释和自定义路径
|
||
$ ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_work -C "work@company.com"
|
||
|
||
# 复制公钥到远程服务器
|
||
$ ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-server
|
||
|
||
# 手动添加
|
||
$ cat ~/.ssh/id_ed25519.pub | ssh user@remote 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys'
|
||
```
|
||
|
||
## SSH 端口转发（Tunneling）
|
||
|
||
### 本地端口转发（Local Forwarding）⭐
|
||
|
||
```bash
|
||
# 通过 jump server 访问内网数据库
|
||
ssh -L 3307:db.internal:3306 user@jump.example.com
|
||
|
||
# 等效命令: ssh -L <local_port>:<dest_host>:<dest_port> <jump_host>
|
||
# 本地 localhost:3307 → SSH 隧道 → jump.example.com → db.internal:3306
|
||
```
|
||
|
||
```
|
||
Client Jump Server DB Server
|
||
──────── ─────────── ─────────
|
||
localhost:3307 ──→ [SSH Tunnel] ──→ db.internal:3306
|
||
↑ ↑
|
||
MySQL CLI SSH 加密通道 🔒
|
||
```
|
||
|
||
### 远程端口转发（Remote Forwarding）
|
||
|
||
```bash
|
||
# 让外网访问我本地服务（反向穿透 NAT）
|
||
ssh -R 8080:localhost:3000 user@public-server
|
||
|
||
# 我的 Mac:3000 ← SSH -R ← public-server:8080
|
||
# 任何人访问 public-server:8080 都能到我的本地服务!
|
||
```
|
||
|
||
### 动态端口转发（SOCKS Proxy）
|
||
|
||
```bash
|
||
# 创建 SOCKS5 代理
|
||
ssh -D 1080 user@bastion
|
||
|
||
# 浏览器设置 SOCKS proxy: 127.0.0.1:1080
|
||
# → 所有流量经过 bastion 转发
|
||
```
|
||
|
||
## SSH 配置文件
|
||
|
||
```bash
|
||
# ~/.ssh/config
|
||
Host github.com
|
||
HostName github.com
|
||
User git
|
||
IdentityFile ~/.ssh/id_ed25519_github
|
||
IdentitiesOnly yes
|
||
|
||
Host bastion
|
||
HostName 203.0.113.5
|
||
User deploy
|
||
IdentityFile ~/.ssh/id_ed25519_bastion
|
||
Port 2222
|
||
|
||
Host internal-*
|
||
ProxyJump bastion
|
||
User admin
|
||
IdentityFile ~/.ssh/id_ed25519_internal
|
||
ServerAliveInterval 60
|
||
ServerAliveCountMax 3
|
||
|
||
# 使用: ssh internal-webapp1 (自动经 bastion 跳转)
|
||
```
|
||
|
||
### 关键参数说明
|
||
|
||
| 参数 | 说明 |
|
||
|------|------|
|
||
| `ProxyJump` | 通过堡垒机跳转 |
|
||
| `ServerAliveInterval` | 客户端发送心跳间隔(秒)，防防火墙超时 |
|
||
| `ServerAliveCountMax` | 最多连续无响应次数后断开 |
|
||
| `IdentitiesOnly` | 仅使用指定的 identity file，不尝试其他密钥 |
|
||
| `StrictHostKeyChecking` | `ask`(默认) / `no`(不检查) / `accept-new`(首次接受) |
|
||
|
||
## Go 中的 SSH
|
||
|
||
```go
|
||
import (
|
||
"golang.org/x/crypto/ssh"
|
||
"os"
|
||
)
|
||
|
||
// 读取私钥文件
|
||
key, err := os.ReadFile("~/.ssh/id_ed25519")
|
||
if err != nil { panic(err) }
|
||
|
||
signer, err := ssh.ParsePrivateKey(key)
|
||
if err != nil { panic(err) }
|
||
|
||
config := &ssh.ClientConfig{
|
||
User: "admin",
|
||
Auth: []ssh.AuthMethod{
|
||
ssh.PublicKeys(signer),
|
||
},
|
||
HostKeyCallback: ssh.InsecureIgnoreHostKey(), // 生产环境用 ssh.FixedHostKey()
|
||
}
|
||
|
||
client, err := ssh.Dial("tcp", "server.example.com:22", config)
|
||
if err != nil { panic(err) }
|
||
|
||
// 执行远程命令
|
||
session, _ := client.NewSession()
|
||
defer session.Close()
|
||
output, _ := session.CombinedOutput("uname -a; uptime")
|
||
fmt.Println(string(output))
|
||
|
||
// SFTP client
|
||
sftpClient, _ := sftp.NewClient(client)
|
||
defer sftpClient.Close()
|
||
```
|
||
|
||
## 关联笔记
|
||
|
||
- [[hhs/NETWORK/HTTPS与TLS握手]] — SSH 也使用非对称加密 + 对称加密混合模式
|
||
- [[hhs/NETWORK/NAT原理与应用]] — SSH 端口转发可穿透 NAT
|
||
- [[hhs/NETWORK/MAC地址与广播域]] — SSH 在局域网内的常见部署场景
|