N天学习一个linux命令之ssh

用途

通过加密连接，远程登录主机和在远程主机执行命令，也可以用于转发x11和tcp，也可用于搭建VPN。第一次连接时，会弹出远程主机公钥指纹确认信息，通过这个方式防止中间人攻击。

用法

ssh [options] [user@]hostname [command]

常用选项

-1

使用协议版本1

-2

使用协议版本2

-4

使用IPv4地址

-6

使用IPv6地址

-A

开启授权代理转发，有安全问题，一般不开启

-a

禁用authentication agent connection的转发

-b bind_address

设置连接的源地址

-C

传输时压缩数据，针对慢网速有明显的效果

-c cipher_spec

指定加密会话的算法，对于协议2版本可以指定多个且使用逗号隔开(指定多个好像没神马用><)

-D [bind_address:]port

本地动态端口转发配置，目前支持SOCKS4和SOCKS5协议

-e escape_char

给会话设置转义字符，默认是~(不知道这个选项是有什么用？)

-F configfile

指定配置文件路径，默认是/etc/ssh/ssh_config

-f

执行命令之前，ssh在后台执行

-g

允许远程主机连接本地转发端口

-I pkcs11

(Specify the PKCS#11 shared libarary ssh should use to communicate with a PKCS#11 token used for storing the user’s private RSA key.)

-i identity_file

使用私钥登录时，私钥所在的文件路径

-K

(Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI credentials to the server.)

-k

(Disables forwarding (delegation) of GSSAPI credentials to the server.)

-L [bind_address:]port:host:hostport

(Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the remote machine. Port forwardings can also be specified in the configuration file.)

-l login_name

设置登录远程主机用户名

-N

禁止执行远程命令，对于只是用于转发很有用

-n

(Redirects stdin from /dev/null (actually, prevents reading from stdin). This must be used when ssh is run in the background. A common trick is to use this to run X11 programs on a remote machine.)

-o option

(Can be used to give options in the format used in the configuration file. This is useful for specifying options for which there is no separate command-line flag.)

-p port

指定连接远程主机的端口，默认是22

-q

安静模式

-R [bind_address:]port:host:hostport

(Specifies that the given port on the remote (server) host is to be forwarded to the given host and port on the local side. This works by allocating a socket to listen to port on the remote side, and whenever a connection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport from the local machine.)

-s

(May be used to request invocation of a subsystem on the remote system. Subsystems are a feature of the SSH2 protocol which facilitate the use of SSH as a secure transport for other applications (eg. sftp(1)). The subsystem is specified as the remote command.)

-T

(Disable pseudo-tty allocation.)

-t

(Force pseudo-tty allocation. This can be used to execute arbitrary screen-based programs on a remote machine, which can be very useful, e.g. when implementing menu services.)

-V

显示程序版本

-v

开启调试模式

-W host:port

(Requests that standard input and output on the client be forwarded to host on port over the secure channel. Implies -N, -T, ExitOnForwardFailure and ClearAllForwardings and works with Protocol version 2 only.)

-w local_tun[:remote_tun]

( Requests tunnel device forwarding with the specified tun(4) devices between the client (local_tun) and the server (remote_tun).)

-X

(Enables X11 forwarding.)

-x

(Disables X11 forwarding.)

-Y

(Enables trusted X11 forwarding. Trusted X11 forwardings are not subjected to the X11 SECURITY extension controls.)

-y

(Send log information using the syslog(3) system module. By default this information is sent to stderr.)

识别用户身份方式

1 GSSAPI-based authentication

2 host-based authentication

3 public key authentication

4 challenge-response authentication

5 password authentication

转移字符含义

~. Disconnect.

~^Z Background ssh.

~# List forwarded connections.

~& Background ssh at logout when waiting for forwarded connection / X11 sessions to terminate.

~? Display a list of escape characters.

~B Send a BREAK to the remote system (only useful for SSH protocol version 2 and if the peer supports it).

~C Open command line.

~R Request rekeying of the connection

实践

1 使用私钥登录

[root@vm ~]# ssh -p 22 -i wadeyu.pem wadeyu@192.168.2.42

2 使用账号密码登录

[root@vm ~]# ssh -p 22 wadeyu@192.168.2.42
wadeyu@192.168.2.42's password:
Last login: Tue Apr 17 11:49:11 2018 from 192.168.2.8

参考资料

【0】 man ssh

【1】实战SSH端口转发

https://www.ibm.com/developerworks/cn/linux/l-cn-sshforward/