{"id":4482,"date":"2025-07-06T20:15:15","date_gmt":"2025-07-06T11:15:15","guid":{"rendered":"https:\/\/eternalsphere.net\/echoes\/?p=4482"},"modified":"2026-06-06T09:16:36","modified_gmt":"2026-06-06T00:16:36","slug":"buat7t1cajp9cq2","status":"publish","type":"post","link":"https:\/\/eternalsphere.net\/echoes\/index.php\/2025\/07\/06\/buat7t1cajp9cq2\/","title":{"rendered":"SSH \u914d\u7f6e\u6587\u4ef6\u89e3\u6790\u4e0e\u5b89\u5168\u4f18\u5316\u6307\u5357"},"content":{"rendered":"\n

\u5728\u8fdb\u884c\u670d\u52a1\u5668\u7ba1\u7406\u65f6\uff0cSSH (Secure Shell) \u914d\u7f6e\u6587\u4ef6\u662f\u975e\u5e38\u91cd\u8981\u7684\u4e00\u90e8\u5206\uff0c\u5b83\u51b3\u5b9a\u4e86\u8fdc\u7a0b\u8fde\u63a5\u7684\u5b89\u5168\u6027\u548c\u53ef\u8bbf\u95ee\u6027\u3002\u672c\u7bc7\u6587\u7ae0\u5c06\u8be6\u7ec6\u89e3\u6790\u4e00\u4e2a\u5178\u578b\u7684 sshd_config<\/code> \u914d\u7f6e\u6587\u4ef6\uff0c\u65e8\u5728\u5e2e\u52a9\u7ba1\u7406\u5458\u4e86\u89e3\u5982\u4f55\u4f18\u5316 SSH \u914d\u7f6e\uff0c\u4ee5\u63d0\u5347\u670d\u52a1\u5668\u7684\u5b89\u5168\u6027\u3002<\/p>\n\n\n\n

\u57fa\u7840\u914d\u7f6e<\/h4>\n\n\n\n
# Include external configuration files
Include \/etc\/ssh\/sshd_config.d\/*.conf
<\/code><\/pre>\n\n\n\n
\u8be5\u884c\u6307\u793a SSH \u670d\u52a1\u4f7f\u7528 \/etc\/ssh\/sshd_config.d\/<\/code> \u76ee\u5f55\u4e0b\u7684\u5176\u4ed6\u914d\u7f6e\u6587\u4ef6\u3002\u8fd9\u79cd\u65b9\u5f0f\u6709\u52a9\u4e8e\u5206\u79bb\u914d\u7f6e\uff0c\u4fbf\u4e8e\u7ba1\u7406\u548c\u66f4\u65b0\u3002<\/p>\n\n\n\n
\u7aef\u53e3\u4e0e\u7f51\u7edc\u914d\u7f6e<\/h4>\n\n\n\n
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
<\/code><\/pre>\n\n\n\n
    \n
  • Port<\/code> \u8bbe\u7f6e\u4e86 SSH \u670d\u52a1\u76d1\u542c\u7684\u7aef\u53e3\uff0c\u9ed8\u8ba4\u4e3a 22\u3002\u5efa\u8bae\u6839\u636e\u5b9e\u9645\u9700\u6c42\u4fee\u6539\u4e3a\u975e\u9ed8\u8ba4\u7aef\u53e3\uff0c\u4ee5\u589e\u5f3a\u5b89\u5168\u6027\u3002<\/li>\n\n\n\n
  • AddressFamily<\/code> \u8bbe\u7f6e\u5141\u8bb8\u7684\u7f51\u7edc\u534f\u8bae\u7c7b\u578b\uff0cany<\/code> \u8868\u793a\u540c\u65f6\u652f\u6301 IPv4 \u548c IPv6\u3002<\/li>\n\n\n\n
  • ListenAddress<\/code> \u914d\u7f6e SSH \u670d\u52a1\u7ed1\u5b9a\u7684\u5730\u5740\uff0c\u901a\u5e38\u4f7f\u7528 0.0.0.0<\/code> \u8868\u793a\u6240\u6709\u5730\u5740\uff0c\u6216\u8005\u53ef\u4ee5\u9650\u5236\u4e3a\u7279\u5b9a\u7684 IP\u3002<\/li>\n<\/ul>\n\n\n\n
    \u4e3b\u673a\u5bc6\u94a5\u914d\u7f6e<\/h4>\n\n\n\n
    #HostKey \/etc\/ssh\/ssh_host_rsa_key
    #HostKey \/etc\/ssh\/ssh_host_ecdsa_key
    #HostKey \/etc\/ssh\/ssh_host_ed25519_key
    <\/code><\/pre>\n\n\n\n
    \u8fd9\u4e9b\u662f SSH \u670d\u52a1\u4f7f\u7528\u7684\u4e3b\u673a\u5bc6\u94a5\u6587\u4ef6\uff0c\u5206\u522b\u7528\u4e8e\u4e0d\u540c\u7684\u52a0\u5bc6\u7b97\u6cd5\u3002\u6839\u636e\u9700\u8981\uff0c\u53ef\u4ee5\u542f\u7528\u5bf9\u5e94\u7684\u5bc6\u94a5\u3002<\/p>\n\n\n\n
    \u8ba4\u8bc1\u4e0e\u8bbf\u95ee\u63a7\u5236<\/h4>\n\n\n\n
    #PermitRootLogin prohibit-password
    #MaxAuthTries 6
    #MaxSessions 10
    #PubkeyAuthentication yes
    <\/code><\/pre>\n\n\n\n
      \n
    • PermitRootLogin<\/code> \u63a7\u5236\u662f\u5426\u5141\u8bb8 root \u7528\u6237\u76f4\u63a5\u767b\u5f55\u3002\u51fa\u4e8e\u5b89\u5168\u8003\u8651\uff0c\u901a\u5e38\u5efa\u8bae\u8bbe\u7f6e\u4e3a prohibit-password<\/code>\uff0c\u53ea\u5141\u8bb8\u4f7f\u7528\u5bc6\u94a5\u8ba4\u8bc1\u3002<\/li>\n\n\n\n
    • MaxAuthTries<\/code> \u63a7\u5236\u6700\u5927\u8ba4\u8bc1\u5c1d\u8bd5\u6b21\u6570\uff0c\u9632\u6b62\u66b4\u529b\u7834\u89e3\u653b\u51fb\u3002<\/li>\n\n\n\n
    • PubkeyAuthentication<\/code> \u542f\u7528\u516c\u94a5\u8ba4\u8bc1\u65b9\u5f0f\uff0c\u63a8\u8350\u542f\u7528\u3002<\/li>\n<\/ul>\n\n\n\n
      \u8eab\u4efd\u9a8c\u8bc1\u4e0e\u5b89\u5168\u9009\u9879<\/h4>\n\n\n\n
      KbdInteractiveAuthentication no
      <\/code><\/pre>\n\n\n\n
      KbdInteractiveAuthentication<\/code> \u7981\u7528\u57fa\u4e8e\u952e\u76d8\u4ea4\u4e92\u7684\u8ba4\u8bc1\uff0c\u8fd9\u6837\u53ef\u4ee5\u907f\u514d\u4e00\u4e9b\u6f5c\u5728\u7684\u5b89\u5168\u98ce\u9669\u3002<\/p>\n\n\n\n
      PAM\uff08\u53ef\u63d2\u62d4\u8ba4\u8bc1\u6a21\u5757\uff09\u652f\u6301<\/h4>\n\n\n\n
      UsePAM yes
      <\/code><\/pre>\n\n\n\n
      \u542f\u7528 PAM \u8ba4\u8bc1\u6a21\u5757\uff0c\u5141\u8bb8\u901a\u8fc7 PAM \u5b9e\u73b0\u66f4\u7075\u6d3b\u7684\u8eab\u4efd\u9a8c\u8bc1\u3001\u8d26\u6237\u5904\u7406\u548c\u4f1a\u8bdd\u7ba1\u7406\u3002\u5f00\u542f\u540e\uff0c\u53ef\u4ee5\u4f7f\u7528\u5404\u79cd\u8ba4\u8bc1\u65b9\u5f0f\uff0c\u5982\u4e24\u6b65\u9a8c\u8bc1\u7b49\u3002<\/p>\n\n\n\n
      \u8fdc\u7a0b\u8fde\u63a5\u4e0e\u7aef\u53e3\u8f6c\u53d1\u8bbe\u7f6e<\/h4>\n\n\n\n
      X11Forwarding yes
      AllowTcpForwarding yes
      GatewayPorts yes
      <\/code><\/pre>\n\n\n\n
        \n
      • X11Forwarding<\/code> \u542f\u7528 X11 \u8f6c\u53d1\uff0c\u5141\u8bb8\u5ba2\u6237\u7aef\u5c06\u56fe\u5f62\u754c\u9762\u5e94\u7528\u901a\u8fc7 SSH \u663e\u793a\u5728\u672c\u5730\u3002<\/li>\n\n\n\n
      • AllowTcpForwarding<\/code> \u542f\u7528 TCP \u8f6c\u53d1\uff0c\u5141\u8bb8\u901a\u8fc7 SSH \u96a7\u9053\u8f6c\u53d1\u6d41\u91cf\u3002<\/li>\n\n\n\n
      • GatewayPorts<\/code> \u5141\u8bb8\u5ba2\u6237\u7aef\u7ed1\u5b9a\u5230\u4efb\u610f\u7aef\u53e3\u3002<\/li>\n<\/ul>\n\n\n\n
        \u65e5\u5fd7\u4e0e\u8c03\u8bd5\u8bbe\u7f6e<\/h4>\n\n\n\n
        SyslogFacility AUTHPRIV
        <\/code><\/pre>\n\n\n\n
        SyslogFacility<\/code> \u63a7\u5236 SSH \u65e5\u5fd7\u8bb0\u5f55\u7684\u65e5\u5fd7\u8bbe\u65bd\u7c7b\u578b\uff0cAUTHPRIV<\/code> \u8868\u793a\u8bb0\u5f55\u4e0e\u8ba4\u8bc1\u76f8\u5173\u7684\u4fe1\u606f\u3002<\/p>\n\n\n\n
        \u7f51\u7edc\u5c42\u9762\u7684\u4f18\u5316<\/h4>\n\n\n\n
        UseDNS no
        <\/code><\/pre>\n\n\n\n
        UseDNS<\/code> \u8bbe\u7f6e\u4e3a no<\/code>\uff0c\u53ef\u4ee5\u907f\u514d DNS \u67e5\u8be2\u5ef6\u8fdf\u95ee\u9898\uff0c\u63d0\u5347 SSH \u8fde\u63a5\u901f\u5ea6\u3002<\/p>\n\n\n\n
        \u5176\u4ed6\u5b89\u5168\u8bbe\u7f6e<\/h4>\n\n\n\n
        PermitRootLogin yes
        PasswordAuthentication yes
        <\/code><\/pre>\n\n\n\n
          \n
        • PermitRootLogin<\/code> \u8bbe\u7f6e\u4e3a yes<\/code> \u5141\u8bb8 root \u7528\u6237\u767b\u5f55\u3002\u5f3a\u70c8\u5efa\u8bae\u6539\u4e3a no<\/code> \u6216 prohibit-password<\/code>\uff0c\u4ee5\u63d0\u5347\u5b89\u5168\u6027\u3002<\/li>\n\n\n\n
        • PasswordAuthentication<\/code> \u542f\u7528\u5bc6\u7801\u8ba4\u8bc1\uff0c\u8fd9\u610f\u5473\u7740\u5bc6\u7801\u767b\u5f55\u4ecd\u7136\u662f\u53ef\u80fd\u7684\u3002\u4e3a\u4e86\u66f4\u9ad8\u7684\u5b89\u5168\u6027\uff0c\u63a8\u8350\u7981\u7528\u5e76\u4f7f\u7528\u516c\u94a5\u8ba4\u8bc1\u3002<\/li>\n<\/ul>\n\n\n\n
          \u6587\u4ef6\u4f20\u8f93\u4e0e\u5b50\u7cfb\u7edf<\/h4>\n\n\n\n
          Subsystem sftp \/usr\/lib\/openssh\/sftp-server
          <\/code><\/pre>\n\n\n\n
          Subsystem<\/code> \u914d\u7f6e\u4e86 SFTP \u5b50\u7cfb\u7edf\uff0c\u5141\u8bb8 SSH \u4f7f\u7528 SFTP \u534f\u8bae\u8fdb\u884c\u6587\u4ef6\u4f20\u8f93\u3002<\/p>\n\n\n\n
          \u603b\u7ed3<\/h4>\n\n\n\n
          \u901a\u8fc7\u5bf9 sshd_config<\/code> \u914d\u7f6e\u6587\u4ef6\u7684\u5408\u7406\u914d\u7f6e\uff0c\u53ef\u4ee5\u663e\u8457\u63d0\u9ad8 SSH \u670d\u52a1\u7684\u5b89\u5168\u6027\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u6700\u4f73\u5b9e\u8df5\uff1a<\/p>\n\n\n\n
            \n
          • \u66f4\u6539\u9ed8\u8ba4\u7aef\u53e3\uff0c\u907f\u514d\u4f7f\u7528 22\u3002<\/li>\n\n\n\n
          • \u7981\u7528 root \u7528\u6237\u7684\u5bc6\u7801\u767b\u5f55\uff0c\u53ea\u5141\u8bb8\u901a\u8fc7\u5bc6\u94a5\u8ba4\u8bc1\u767b\u5f55\u3002<\/li>\n\n\n\n
          • \u542f\u7528 PAM \u8ba4\u8bc1\u6a21\u5757\u5e76\u8bbe\u7f6e\u5408\u7406\u7684\u8ba4\u8bc1\u7b56\u7565\u3002<\/li>\n\n\n\n
          • \u7981\u7528\u4e0d\u5fc5\u8981\u7684\u529f\u80fd\uff08\u5982 X11 \u8f6c\u53d1\u548c TCP \u8f6c\u53d1\uff09\u6765\u51cf\u5c11\u653b\u51fb\u9762\u3002<\/li>\n\n\n\n
          • \u4f18\u5316\u65e5\u5fd7\u548c\u8c03\u8bd5\u914d\u7f6e\uff0c\u4ee5\u4fbf\u53ca\u65f6\u53d1\u73b0\u5b89\u5168\u4e8b\u4ef6\u3002<\/li>\n<\/ul>\n\n\n\n
            \u6bcf\u4e2a\u914d\u7f6e\u9009\u9879\u90fd\u5f71\u54cd\u7740 SSH \u670d\u52a1\u7684\u8fd0\u884c\u4e0e\u5b89\u5168\uff0c\u7ba1\u7406\u8005\u5e94\u6839\u636e\u5b9e\u9645\u60c5\u51b5\u7075\u6d3b\u8c03\u6574\uff0c\u5e76\u786e\u4fdd\u6240\u6709\u8bbe\u7f6e\u90fd\u7b26\u5408\u6700\u4f73\u5b89\u5168\u5b9e\u8df5\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
            \u5728\u8fdb\u884c\u670d\u52a1\u5668\u7ba1\u7406\u65f6\uff0cSSH (Secure Shell) \u914d\u7f6e\u6587\u4ef6\u662f\u975e\u5e38\u91cd\u8981\u7684\u4e00\u90e8\u5206\uff0c\u5b83\u51b3\u5b9a\u4e86\u8fdc\u7a0b\u8fde\u63a5\u7684\u5b89\u5168\u6027\u548c\u53ef\u8bbf\u95ee\u6027\u3002\u672c\u7bc7\u6587\u7ae0\u5c06\u8be6\u7ec6\u89e3\u6790\u4e00\u4e2a\u5178\u578b\u7684 sshd_config \u914d\u7f6e\u6587\u4ef6\uff0c\u65e8\u5728\u5e2e\u52a9\u7ba1\u7406\u5458\u4e86\u89e3\u5982\u4f55\u4f18\u5316 SSH \u914d\u7f6e\uff0c\u4ee5\u63d0\u5347\u670d\u52a1\u5668\u7684\u5b89\u5168\u6027\u3002 \u57fa\u7840\u914d\u7f6e # Include external configuration filesInclude \/etc\/ssh\/sshd_config.d\/*.conf \u8be5\u884c\u6307\u793a SSH \u670d\u52a1\u4f7f\u7528 \/etc\/ssh\/sshd_config.d\/ \u76ee\u5f55\u4e0b\u7684\u5176\u4ed6\u914d\u7f6e\u6587\u4ef6\u3002\u8fd9\u79cd\u65b9\u5f0f\u6709\u52a9\u4e8e\u5206\u79bb\u914d\u7f6e\uff0c\u4fbf\u4e8e\u7ba1\u7406\u548c\u66f4\u65b0\u3002 \u7aef\u53e3\u4e0e\u7f51\u7edc\u914d\u7f6e #Port 22#AddressFamily any#ListenAddress 0.0.0.0#ListenAddress :: \u4e3b\u673a\u5bc6\u94a5\u914d\u7f6e #HostKey \/etc\/ssh\/ssh_host_rsa_key#HostKey \/etc\/ssh\/ssh_host_ecdsa_key#HostKey \/etc\/ssh\/ssh_host_ed25519_key \u8fd9\u4e9b\u662f SSH \u670d\u52a1\u4f7f\u7528\u7684\u4e3b\u673a\u5bc6\u94a5\u6587\u4ef6\uff0c\u5206\u522b\u7528\u4e8e\u4e0d\u540c\u7684\u52a0\u5bc6\u7b97\u6cd5\u3002\u6839\u636e\u9700\u8981\uff0c\u53ef\u4ee5\u542f\u7528\u5bf9\u5e94\u7684\u5bc6\u94a5\u3002 \u8ba4\u8bc1\u4e0e\u8bbf\u95ee\u63a7\u5236 #PermitRootLogin prohibit-password#MaxAuthTries 6#MaxSessions 10#PubkeyAuthentication yes \u8eab\u4efd\u9a8c\u8bc1\u4e0e\u5b89\u5168\u9009\u9879 KbdInteractiveAuthentication no KbdInteractiveAuthentication \u7981\u7528\u57fa\u4e8e\u952e\u76d8\u4ea4\u4e92\u7684\u8ba4\u8bc1\uff0c\u8fd9\u6837\u53ef\u4ee5\u907f\u514d\u4e00\u4e9b\u6f5c\u5728\u7684\u5b89\u5168\u98ce\u9669\u3002 PAM\uff08\u53ef\u63d2\u62d4\u8ba4\u8bc1\u6a21\u5757\uff09\u652f\u6301 UsePAM yes \u542f\u7528 PAM …<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42],"tags":[],"class_list":["post-4482","post","type-post","status-publish","format-standard","hentry","category-jtcspxsyrult"],"_links":{"self":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/4482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/comments?post=4482"}],"version-history":[{"count":1,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/4482\/revisions"}],"predecessor-version":[{"id":4483,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/posts\/4482\/revisions\/4483"}],"wp:attachment":[{"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/media?parent=4482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/categories?post=4482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eternalsphere.net\/echoes\/index.php\/wp-json\/wp\/v2\/tags?post=4482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}