服务器运维笔记：SSH 安全加固与跳板机

# Ed25519（推荐）
ssh-keygen -t ed25519 -C "your_name@company.com"

# RSA 4096-bit（兼容性兜底）
ssh-keygen -t rsa -b 4096 -C "your_name@company.com"

# 带 passphrase 的密钥（生产环境必须）
ssh-keygen -t ed25519 -C "ops@prod" -f ~/.ssh/id_ed25519_prod

# 启动 agent 并添加密钥
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# 查看已加载的密钥
ssh-add -l

# 删除所有已加载密钥
ssh-add -D

# 设置密钥自动过期（3600 秒后从 agent 中移除）
ssh-add -t 3600 ~/.ssh/id_ed25519_prod

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Host *
  AddKeysToAgent yes
  UseKeychain yes

# 1. 生成新密钥
ssh-keygen -t ed25519 -C "ops@2026-rotate" -f ~/.ssh/id_ed25519_new

# 2. 部署新公钥到目标机器
ssh-copy-id -i ~/.ssh/id_ed25519_new.pub user@target

# 3. 验证新密钥可用
ssh -i ~/.ssh/id_ed25519_new user@target "echo ok"

# 4. 从目标机器移除旧公钥
ssh user@target "sed -i '/old_key_comment/d' ~/.ssh/authorized_keys"

# 5. 本地替换旧密钥
mv ~/.ssh/id_ed25519_new ~/.ssh/id_ed25519
mv ~/.ssh/id_ed25519_new.pub ~/.ssh/id_ed25519.pub

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@<server>

ssh user@<server>

mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...........xxx user@host" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# 验证权限
ls -la ~/.ssh/

drwx------ 2 user user .          (.ssh 700)
-rw------- 1 user user authorized_keys   (600)

ssh -i ~/.ssh/id_ed25519 user@<server>

# 文件权限必须正确
chmod 700 ~/.ssh
chmod 600 ~/.ssh/config

# === 全局默认配置 ===
Host *
  ServerAliveInterval 60
  ServerAliveCountMax 3
  AddKeysToAgent yes
  IdentitiesOnly yes
  Compression yes
  HashKnownHosts yes

# === 生产环境 Web 服务器 ===
Host prod-web
  HostName 10.0.1.50
  User deploy
  Port 2222
  IdentityFile ~/.ssh/id_ed25519_prod
  StrictHostKeyChecking ask

# === GitHub ===
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_github
  IdentitiesOnly yes

# === GitLab（公司内部）===
Host gitlab-internal
  HostName gitlab.company.com
  User git
  IdentityFile ~/.ssh/id_ed25519_gitlab
  Port 2222

# === 生产数据库（通过跳板机）===
Host prod-db
  HostName 10.0.2.100
  User dbadmin
  ProxyJump bastion
  IdentityFile ~/.ssh/id_ed25519_prod

# === 跳板机 ===
Host bastion
  HostName bastion.company.com
  User ops
  Port 2222
  IdentityFile ~/.ssh/id_ed25519_bastion
  ForwardAgent yes

# 测试哪个密钥能连接某台服务器
ssh -vT git@github.com 2>&1 | grep "Offering\|Accepted"

Host *
  # 每 60 秒发送一次心跳
  ServerAliveInterval 60
  # 连续 3 次无响应则断开
  ServerAliveCountMax 3

ClientAliveInterval 60
ClientAliveCountMax 3

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Port 2222

sudo sshd -t

sudo ufw allow 2222/tcp
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

sudo systemctl restart sshd
sudo systemctl status sshd

sudo ss -tlnp | grep ssh
# LISTEN 0 128 0.0.0.0:2222 0.0.0.0:* users:(("sshd",pid=xxx,fd=3))

ssh -p 2222 user@<server>
sudo ufw delete allow 22

# /etc/ssh/sshd_config

# 只允许指定用户登录
AllowUsers deploy ops admin

# 或者按组限制
AllowGroups ssh-users

# 禁止 root 直接登录
PermitRootLogin no

# 禁止空密码
PermitEmptyPasswords no

# 只允许办公网段和跳板机 IP
AllowUsers deploy@10.0.0.0/24 deploy@203.0.113.50

# 或者用防火墙层面限制
sudo ufw allow from 10.0.0.0/24 to any port 2222

# /etc/ssh/sshd_config

# 最多尝试 3 次密码/密钥认证
MaxAuthTries 3

# 登录宽限时间 30 秒
LoginGraceTime 30

# 关闭密码认证（只允许密钥）
PasswordAuthentication no

# 关闭挑战响应认证
ChallengeResponseAuthentication no

# /etc/ssh/sshd_config — 安全加固版

Port 2222
Protocol 2
AddressFamily inet

PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

MaxAuthTries 3
LoginGraceTime 30
MaxSessions 5
MaxStartups 10:30:60

AllowGroups ssh-users
AllowUsers deploy ops

X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no

UsePAM yes
PrintMotd no

# 日志级别
LogLevel VERBOSE

# 使用强加密算法
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org

sudo apt install fail2ban

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600
backend = auto

# 家庭/办公 IP 加白名单，避免误封自己
ignoreip = 127.0.0.1/8 ::1 <你的家庭 IP>

sudo systemctl enable --now fail2ban
sudo systemctl status fail2ban

sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd banip 1.2.3.4
sudo fail2ban-client set sshd unbanip 1.2.3.4

┌──────────┐     SSH      ┌────────────┐    SSH    ┌──────────────┐
│  运维PC   │ ──────────→ │  跳板机      │ ───────→ │  内网服务器    │
│ (公网)    │             │ (Bastion)   │          │  (私有网络)   │
└──────────┘             └────────────┘          └──────────────┘

# 命令行方式
ssh -J bastion:2222 user@internal-host

# 多级跳板
ssh -J bastion1:2222,bastion2:2222 user@final-host

# ~/.ssh/config 配置方式
Host bastion
  HostName bastion.company.com
  User ops
  Port 2222
  IdentityFile ~/.ssh/id_ed25519_bastion

Host internal-*
  ProxyJump bastion
  User deploy
  IdentityFile ~/.ssh/id_ed25519_internal

Host internal-web
  HostName 10.0.1.50

Host internal-db
  HostName 10.0.2.100

# ~/.ssh/config
Host internal-host
  HostName 10.0.1.50
  User deploy
  ProxyCommand ssh -W %h:%p bastion

# 跳板机的 sshd_config 特殊配置
Port 2222
PermitRootLogin no
PasswordAuthentication no

# 允许 TCP 转发（ProxyJump 需要）
AllowTcpForwarding yes

# 禁止在跳板机上开 shell（可选，极端安全场景）
# ForceCommand /bin/false

# 记录所有通过跳板机的会话
ForceCommand /usr/bin/log-session.sh

#!/bin/bash
# /usr/bin/log-session.sh
LOG_DIR="/var/log/ssh-sessions"
mkdir -p "$LOG_DIR"
LOG_FILE="$LOG_DIR/$(date +%Y%m%d-%H%M%S)-${USER}-$(echo $SSH_CLIENT | awk '{print $1}').log"
script -qf "$LOG_FILE"

# 将本地 13306 端口转发到内网 MySQL
ssh -L 13306:10.0.2.100:3306 user@bastion

# 然后用本地客户端连接
mysql -h 127.0.0.1 -P 13306 -u root -p

# 后台运行，不打开 shell
ssh -fNL 13306:10.0.2.100:3306 user@bastion

# 将公网服务器的 8080 端口转发到你本地的 3000 端口
ssh -R 8080:localhost:3000 user@public-server

# 同事访问 http://public-server:8080 即可看到你的服务

# /etc/ssh/sshd_config
GatewayPorts yes   # 或 clientspecified

# 启动 SOCKS5 代理，监听本地 1080 端口
ssh -D 1080 user@remote-server

# 后台运行
ssh -fND 1080 user@remote-server

# 通过跳板机将本地 8443 映射到内网 K8s Dashboard
ssh -J bastion -L 8443:10.0.3.50:6443 user@internal-host

# 浏览器打开 https://localhost:8443

# 方法一：ProxyJump 链式跳转（推荐）
ssh -J user1@bastion1:2222,user2@bastion2:2222 user3@target

# 方法二：多级本地转发
ssh -L 2222:bastion2:2222 user1@bastion1 &
ssh -L 3306:target-db:3306 -p 2222 user2@localhost &

# 方法三：在 ~/.ssh/config 中配置
Host bastion1
  HostName bastion1.company.com
  User ops1
  Port 2222

Host bastion2
  HostName bastion2.company.com
  User ops2
  Port 2222
  ProxyJump bastion1

Host target
  HostName 10.0.3.100
  User deploy
  ProxyJump bastion2

# 方法一：ServerAlive 配置（客户端侧）
ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -L 3306:db:3306 user@bastion

# 方法二：TCPKeepAlive（更底层）
ssh -o TCPKeepAlive=yes -o ServerAliveInterval=30 -L 3306:db:3306 user@bastion

sudo apt install autossh    # Debian/Ubuntu
sudo yum install autossh    # CentOS/RHEL

autossh -M 20000 -fNL 13306:10.0.2.100:3306 user@bastion

# 参数说明
# -M 20000: 使用 20000 端口做连接监控（偶数端口发，奇数端口收）
# -f: 后台运行
# -N: 不执行远程命令
# -L: 本地转发

autossh -M 0 -fNL 13306:10.0.2.100:3306 user@bastion \
  -o "ServerAliveInterval 30" \
  -o "ServerAliveCountMax 3"

# /etc/systemd/system/ssh-tunnel-mysql.service
[Unit]
Description=SSH Tunnel to MySQL
After=network-online.target
Wants=network-online.target

[Service]
User=ops
Environment="AUTOSSH_GATETIME=0"
ExecStart=/usr/bin/autossh -M 0 -NL 13306:10.0.2.100:3306 -o ServerAliveInterval=30 -o ServerAliveCountMax=3 user@bastion
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now ssh-tunnel-mysql
sudo systemctl status ssh-tunnel-mysql

# 安装
sudo apt install pssh    # Debian/Ubuntu
sudo yum install pssh    # CentOS/RHEL

# 创建主机列表
cat > hosts.txt << 'EOF'
web1 ansible_host=10.0.1.11 ansible_user=deploy
web2 ansible_host=10.0.1.12 ansible_user=deploy
web3 ansible_host=10.0.1.13 ansible_user=deploy
EOF

# 并行执行命令
pssh -h hosts.txt -i "uptime"

# 并行复制文件
pscp -h hosts.txt /tmp/app.conf /opt/app/conf/

# 并行同步目录
prsync -h hosts.txt -r /opt/app/ /opt/app/

# 带日志输出
pssh -h hosts.txt -o /tmp/pssh-out -e /tmp/pssh-err "df -h"

# 安装
sudo apt install mussh

# 对多台主机执行命令
mussh -H "10.0.1.11 10.0.1.12 10.0.1.13" -c "systemctl restart nginx"

# 使用主机文件
mussh -H hosts.txt -c "free -m"

# inventory/hosts.yml
all:
  children:
    webservers:
      hosts:
        web1: { ansible_host: 10.0.1.11 }
        web2: { ansible_host: 10.0.1.12 }
        web3: { ansible_host: 10.0.1.13 }
  vars:
    ansible_user: deploy
    ansible_ssh_private_key_file: ~/.ssh/id_ed25519_prod
    ansible_ssh_common_args: '-o ProxyJump=bastion'

# 批量执行命令
ansible webservers -m shell -a "df -h"

# 批量部署配置
ansible webservers -m template -a "src=nginx.conf.j2 dest=/etc/nginx/nginx.conf"

# 批量更新并重启服务
ansible webservers -m apt -a "name=nginx state=latest" --become
ansible webservers -m service -a "name=nginx state=restarted" --become

# 查看最近的 SSH 登录
journalctl -u ssh --since "1 hour ago"

# 查看失败的登录尝试
grep "Failed password" /var/log/auth.log

# 统计每个 IP 的失败尝试次数
grep "Failed password" /var/log/auth.log | \
  awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20

# 查看成功的登录
grep "Accepted" /var/log/auth.log

# /etc/ssh/sshd_config
LogLevel VERBOSE

#!/bin/bash
# /etc/ssh/login-notify.sh
# 在 /etc/ssh/sshd_config 中配置:
# PermitUserEnvironment yes
# 然后在 ~/.ssh/environment 中设置触发

LOG_FILE="/var/log/ssh-login-alerts.log"
DATE=$(date '+%Y-%m-%d %H:%M:%S')

# 获取登录信息
USER=$1
IP=$2
TTY=$3

# 写入日志
echo "[$DATE] SSH Login: User=$USER IP=$IP TTY=$TTY" >> "$LOG_FILE"

# 发送告警（示例：通过 webhook 发送到飞书/钉钉/Slack）
curl -s -X POST "https://open.feishu.cn/open-apis/bot/v2/hook/YOUR_HOOK_ID" \
  -H "Content-Type: application/json" \
  -d "{
    "msg_type": "text",
    "content": {
      "text": "SSH 登录告警\n用户: $USER\nIP: $IP\n时间: $DATE"
    }
  }" &

exit 0

# /etc/pam.d/sshd 末尾添加
session optional pam_exec.so /etc/ssh/login-notify.sh

# 详细模式查看卡在哪一步
ssh -vvv user@host

# 服务端
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 755 ~          # home 目录不能是 777

# 客户端
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/config

# 检查所有者
ls -la ~/.ssh/
# authorized_keys 必须属于当前用户，不能是 root

# 查看服务器端接受的日志
ssh -vT user@host 2>&1 | grep -i "key\|identity\|offer\|accept"

# 验证公钥指纹是否一致
ssh-keygen -lf ~/.ssh/id_ed25519.pub
ssh-keygen -lf ~/.ssh/id_ed25519

# 在服务器端检查
cat ~/.ssh/authorized_keys | ssh-keygen -lf -

# 确保公钥格式正确（单行，以 ssh-ed25519 或 ssh-rsa 开头）
cat ~/.ssh/id_ed25519.pub

# 检查 agent 是否运行
ssh-add -l

# 检查 agent forwarding 是否启用
ssh -o ForwardAgent=yes user@host "echo \$SSH_AUTH_SOCK"

# 如果 AUTH_SOCK 为空，检查：
# 1. 客户端 ~/.ssh/config 中 ForwardAgent yes
# 2. 服务端 /etc/ssh/sshd_config 中 AllowAgentForwarding yes
# 3. 服务端 ~/.ssh/environment 中 SSH_AUTH_SOCK 设置

# 调试：在中间机器上测试
ssh -A bastion "ssh-add -l && ssh internal-host 'whoami'"

# 密钥生成
ssh-keygen -t ed25519 -C "comment"

# 部署公钥
ssh-copy-id -i ~/.ssh/key.pub user@host

# 跳板机连接
ssh -J bastion user@internal

# 本地转发
ssh -L local_port:target:remote_port user@via

# 远程转发
ssh -R remote_port:localhost:local_port user@public

# SOCKS 代理
ssh -D 1080 user@host

# 自动重连隧道
autossh -M 0 -fNL 3306:db:3306 user@bastion

# 并行执行
pssh -h hosts.txt -i "command"

# 查看登录日志
journalctl -u ssh --since "1 hour ago"
last -a
lastb -a