ssh

中文man手册

SSH åè®®ç¬¬ä¸ç

ç¬¬äºç§è®¤è¯æ¹æ³æ¯ rhosts æ hosts.equiv æä»¶ç»ååºäº RSA çä¸»æºè®¤è¯. è¿æå³çå¦æ $HOME/.rhosts, $HOME/.shosts, /etc/hosts.equiv, æ /etc/ssh/shosts.equiv åè®¸ç»å½, å¹¶ä¸å¦ææå¡å¨è½å¤éªè¯å®¢æ·çä¸»æºå¯é¥(host key) (åè§ “æä»¶(FILE)” èç /etc/ssh/ssh_known_hosts å $HOME/.ssh/known_hosts ), ä¸»æºæåè®¸å®¢æ·ç»å½. è¿ä¸ªè®¤è¯æ¹æ³å³éäºå IP æ¬ºéª, DNS æ¬ºéªåè·¯ç±æ¬ºéªé æçå®å¨æ¼æ´. [ç³»ç»ç®¡çåæ³¨æ: ä¸è¬è¯´æ¥ /etc/hosts.equiv, $HOME/.rhosts, å rlogin/rsh åè®®çæ¬è´¨æ¯ä¸å¯é å°, è¦å®å¨å°±åºè¯¥å³æå®ä»¬.]

ssh è½å¤èªå¨æ§è¡ RSA è®¤è¯åè®®. ç¨æ·éè¿è¿è¡ ssh-keygen(1) åå»ºä»/å¥¹ç RSA å¯é¥å¯¹. ç§é¥åæ¾å¨ç¨æ·æ ¹ç®å½ä¸ç $HOME/.ssh/identity ä¸, èå¬é¥åæ¾å¨ $HOME/.ssh/identity.pub ä¸. éå, ç¨æ·åºè¯¥æ identity.pub å¤å¶å°è¿ç¨æå¡å¨ä¸, ä½ä¸º $HOME/.ssh/authorized_keys å- æ¾å°ä»/å¥¹çç¨æ·æ ¹ç®å½ä¸ ( authorized_keys å¯¹åºä¼ ç»ç $HOME/.rhosts æä»¶, æ¯ä¸è¡åªæä¸åªå¯é¥, å°½ç®¡ä¸è¡å¯ä»¥å¾é¿). ç¨æ·æ é¡»å¯ç å°±å¯ä»¥ç´æ¥ç»å½. RSA è®¤è¯è¿æ¯ rhosts è®¤è¯å®å¨.

RAS è®¤è¯æä¾¿æ·çç¨æ³å¤§æ¦å°±æ¯ä½¿ç¨è®¤è¯ä»£ç(authentication agent) äº. è¯¦è§ ssh-agent(1) æåé¡µ.

SSH åè®®ç¬¬äºç

è¿ä¸ªå¬å¼å¯é¥æ¹æ³ç±»ä¼¼äºä¸ä¸èæè¿°ç RAS è®¤è¯, å¹¶ä¸åè®¸ä½¿ç¨ RAS æ DSA ç®æ³: å®¢æ·ç«¯ç¨ä»çç§é¥ ( $HOME/.ssh/id_dsa æ $HOME/.ssh/id_rsa ) å¯¹ä¼è¯æ è¯ç¬¦(session identifier)ç¾å, ç¶åæç»æéå°æå¡å¨. æå¡å¨æ£æ¥ $HOME/.ssh/authorized_keys ä¸æ¯å¦æå¹éçå¬é¥, å¦æå¯é¥åç¾åé½æ£ç¡®, è®¿é®å°±å¯ä»¥ç»§ç»è¿è¡. ä¼è¯æ è¯ç¬¦æ¥èªå±äº«ç Diffie-Hellman å¼, åªæå®¢æ·ç«¯åæå¡å¨ç«¯æç¥éè¿ä¸ªå¼.

å¦å¤, ssh æ¯æåºäºä¸»æºææµè¯åºççè®¤è¯æ¹å¼.

åè®®ç¬¬äºçæä¾éå æºå¶å¢å¼ºä¿å¯æ§ (æ°æ®æµç¨ 3DES, Blowfish, CAST128 æ Arcfour å å¯) åå®æ´æ§ (hmac-md5, hmac-sha1). æ³¨æ, åè®®ç¬¬ä¸çç¼ºå°å¼ºæåçæºå¶ç¡®ä¿è¿æ¥çå®æ´æ§.

ç»å½ä¼è¯åè¿ç¨æ§è¡

å¦æåéäºä¼ªç»ç«¯(pseudo-terminal)(æ®éçç»å½ä¼è¯), ç¨æ·å¯ä»¥ä½¿ç¨åé¢å° æå°ç escape åç¬¦.

å½è¿ç¨ä¸»æºä¸çå½ä»¤æ shell éåºæ¶, ä¼è¯å³ç»æ, å¹¶å³éææ X11 å TCP/IP è¿æ¥. è¿ç«¯ç¨åºçè¿åç åä¸º ssh çè¿åç è¿å.

Escape åç¬¦

å·²æ¯æç escape å½ä»¤ (åè®¾æ¯é»è®¤ç ‘˜’) æ:

˜.

æå¼è¿æ¥

˜ˆZ

æ ssh éå°åå°

˜#

ååºè½¬åçè¿æ¥ (forwarded connection)

˜&

å½çå¾è½¬åçè¿æ¥/X11ä¼è¯ç»ææ¶, ssh å¨åå°éåºç»å½

˜?

æ¾ç¤º escape åç¬¦çåè¡¨

˜C

æå¼å½ä»¤è¡ (ä»ç¨äº -L å -R éé¡¹å¢å ç«¯å£è½¬å)

˜R

X11 å TCP è½¬å (forwarding)

ssh å°èªå¨å¨æå¡å¨ä¸è®¾ç½® Xauthority æ°æ®. ç®çæ¯è¿æ ·ç: SSH çæä¸ä¸ªéæºçææ cookie, åæ¾å¨æå¡å¨ç Xauthority ä¸. SSH æ£æ¥å¹¶ç¡®ä¿è½¬åçè¿æ¥æºå¸¦äºè¿ä¸ª cookie, æå¼è¿æ¥å, æå®æ¿æ¢ä¸ºçæ£ç cookie. çæ£çè®¤è¯ cookie ç»ä¸ä¼éå¾æå¡å¨ (ä¹ä¸ä¼æä»»ä½ææä¼ éç cookie).

å¦æ ForwardAgent åéè®¾ä¸º “yes” (æåè§åé¢å¯¹ -A å -a éé¡¹çæè¿°), å¹¶ä¸ç¨æ·æ£å¨ä½¿ç¨è®¤è¯ä»£ç(authentication agent), ååä»£ççè¿æ¥å°èªå¨è½¬åå°è¿ç¨ä¸»æº.

æå¡å¨è®¤è¯

å½ä»¤è¡éé¡¹æ:

-a

ç¦æ¢è½¬åè®¤è¯ä»£ççè¿æ¥.

-A

-b bind_address

å¨æ¥æå¤ä¸ªæ¥å£æå°åå«åçæºå¨ä¸, æå®æ¶åæ¥å£.

-c blowfish|3des|des

éæ©å å¯ä¼è¯çå¯ç æ¯. 3des æ¯é»è®¤ç®æ³. 3des (triple-des) ç¨ä¸æ¯ä¸åçå¯é¥åå å¯-è§£å¯-å å¯ä¸æ¬¡è¿ç®, è¢«è®¤ä¸ºæ¯è¾å¯é . blowfish æ¯ä¸ç§å¿«éçåç»å å¯æ¯(block cipher), éå¸¸å®å¨, èä¸éåº¦æ¯ 3des å¿«çå¤. des ä»æ¯æ ssh å®¢æ·ç«¯, ç®çæ¯è½å¤åèå¼çä¸æ¯æ 3des çåè®®ç¬¬ä¸çäºæä½. ç±äºå¶å¯ç ç®æ³ä¸çå¼±ç¹, å¼ºçå»ºè®®é¿åä½¿ç¨.

-c cipher_spec

-e ch|ˆch|none

è®¾ç½® pty ä¼è¯ç escape åç¬¦ (é»è®¤åç¬¦: ‘˜’). escape å- ç¬¦åªå¨è¡é¦ææ, escape åç¬¦åé¢è·ä¸ä¸ªç¹ (‘.’) è¡¨ç¤ºç»æè¿æ¥, è·ä¸ä¸ª control-Z è¡¨ç¤ºæèµ·è¿æ¥(suspend), è· escape åç¬¦èªå·± è¡¨ç¤ºè¾åºè¿ä¸ªåç¬¦. æè¿ä¸ªåç¬¦è®¾ä¸º “none” åç¦æ¢ escape åè½, ä½¿ä¼è¯å®å¨éæ.

-f

-g

åè®¸è¿ç«¯ä¸»æºè¿æ¥æ¬å°è½¬åçç«¯å£.

-i identity_file

æå®ä¸ä¸ª RSA æ DSA è®¤è¯æéçèº«ä»½(ç§é¥)æä»¶. é»è®¤æä»¶æ¯åè®®ç¬¬ä¸çç $HOME/.ssh/identity ä»¥ååè®®ç¬¬äºçç $HOME/.ssh/id_rsa å $HOME/.ssh/id_dsa æä»¶. ä¹å¯ä»¥å¨éç½®æä»¶ä¸å¯¹æ¯ä¸ªä¸»æºåç¬æå®èº«ä»½æä»¶. å¯ä»¥åæ¶ä½¿ç¨å¤ä¸ª -i éé¡¹ (ä¹å¯ä»¥å¨éç½®æä»¶ä¸- æå®å¤ä¸ªèº«ä»½æä»¶).

-I smartcard_device

-k

-l login_name

-m mac_spec

å¦å¤, å¯¹äºåè®®ç¬¬äºç, è¿éå¯ä»¥æå®ä¸ç»ç¨éå·éå¼, æä¼åé¡ºåºæåç MAC(æ¶æ¯éªè¯ç )ç®æ³ (message authentication code). è¯¦æä»¥ MACs ä¸ºå³é®åæ¥è¯¢.

-n

æ stdin éå®åå° /dev/null (å®éä¸é²æ¢ä» stdin è¯»åæ°æ®). ssh å¨åå°è¿è¡æ¶ä¸å®ä¼ç¨å°è¿ä¸ªéé¡¹. å®çå¸¸ç¨æå·§æ¯è¿ç¨è¿è¡ X11 ç¨åº. ä¾å¦, ssh -n shadows.cs.hut.fi emacs & å°ä¼å¨ shadows.cs.hut.fi ä¸å¯å¨ emacs, åæ¶èªå¨å¨å å¯ééä¸è½¬å X11 è¿æ¥. ssh å¨åå°è¿è¡. (ä½æ¯å¦æ ssh è¦æ±å£ä»¤æå¯è¯, è¿ç§æ¹å¼å°±æ æ³å·¥ä½; åè§ -f éé¡¹.)

-N

ä¸æ§è¡è¿ç¨å½ä»¤. ç¨äºè½¬åç«¯å£. (ä»éåè®®ç¬¬äºç)

-o option

-p port

-q

å®éæ¨¡å¼. æ¶é¤ææçè¦ååè¯æä¿¡æ¯.

-s

-t

-T

ç¦æ¢åéä¼ªç»ç«¯.

-v

-x

ç¦æ¢ X11 è½¬å.

-X

-C

è¦æ±è¿è¡æ°æ®åç¼© (åæ¬ stdin, stdout, stderr ä»¥åè½¬å X11 å TCP/IP è¿æ¥ çæ°æ®). åç¼©ç®æ³å gzip(1) çä¸æ ·, åè®®ç¬¬ä¸çä¸, åç¼©çº§å« “level” ç¨ CompressionLevel éé¡¹æ§å¶. åç¼©ææ¯å¨ modem çº¿è·¯æå¶ä»æ¢éè¿æ¥ä¸å¾æç¨, ä½æ¯å¨é«éç½ç»ä¸åè å¯è½éä½éåº¦. å¯ä»¥å¨éç½®æä»¶ä¸å¯¹æ¯ä¸ªä¸»æºåç¬è®¾å®è¿ä¸ªåæ°. å¦è§ Compression éé¡¹.

-F configfile

æå®ä¸ä¸ªç¨æ·çº§éç½®æä»¶. å¦æå¨å½ä»¤è¡ä¸æå®äºéç½®æä»¶, ç³»ç»çº§éç½®æä»¶ (/etc/ssh/ssh_config) å°è¢«å¿½ç¥. é»è®¤çç¨æ·çº§éç½®æä»¶æ¯ $HOME/.ssh/config.

-L port:host:hostport

-R port:host:hostport

-D port

-1

å¼ºå¶ ssh åªä½¿ç¨åè®®ç¬¬ä¸ç.

-2

å¼ºå¶ ssh åªä½¿ç¨åè®®ç¬¬äºç.

-4

å¼ºå¶ ssh åªä½¿ç¨ IPv4 å°å.

-6

å¼ºå¶ ssh åªä½¿ç¨ IPv6 å°å.

éç½®æä»¶ (CONFIGURATION FILES)

ssh å¯ä»¥ä»ç¨æ·çº§éç½®æä»¶åç³»ç»çº§éç½®æä»¶ä¸è·åæ´å¤çéç½®æ°æ®. éç½®æä»¶çæ ¼å¼åå¶åå®¹åè§ ssh_config(5).

ç¯å¢åé (ENVIRONMENT)

ssh ä¸è¬å°è®¾ç½®ä¸é¢çç¯å¢åé:

DISPLAY

ç¯å¢åé DISPLAY æåº X11 æå¡å¨çä½ç½®. ssh èªå¨è®¾ç½®è¿ä¸ªåé, åéæå “hostname:n” æ ¼å¼çæ°æ®, å¶ä¸ hostname æåºè¿è¡ shell çä¸»æº, è n æ¯å¤§äºçäº 1 çæ´æ°. ssh æ ¹æ®è¿ä¸ªæ°æ®, ç¨å®å¨éè·¯è½¬å X11 è¿æ¥. ç¨æ·ä¸è¬ä¸éè¦ä¸»å¨è®¾ç½® DISPLAY åé, å¦åä¼å¯¼è´ X11 è¿æ¥ä¸å®å¨ (èä¸ä¼å¯¼è´ç¨æ·æå·¥å¤å¶æéçææ cookie).

HOME

è®¾ç½®ä¸ºç¨æ·æ ¹ç®å½çè·¯å¾.

LOGNAME

çäº USER; ç¨æ¥å¼å®¹ä½¿ç¨è¿ä¸ªåéçç³»ç».

MAIL

è®¾ç½®ä¸ºç¨æ·é®ç®±çè·¯å¾.

PATH

è®¾ç½®ä¸ºé»è®¤ç PATH, å¦åç¼è¯ ssh æ¶è¦æ±çä¸æ ·.

SSH_ASKPASS

å¦æ ssh éè¦ä¸ä¸ªå¯è¯(passphrase), åªè¦å®æ¯ç»ç«¯ä¸å¯å¨ç, å®ä¼ä»å½åç»ç«¯ä¸è¯»å. å¦æ ssh æ²¡æèæ¥ç»ç«¯, ä½æ¯è®¾ç½®äº DISPLAY å SSH_ASKPASS åé, ssh å°±è¿è¡ SSH_ASKPASS æå®çç¨åº, æå¼ä¸ä¸ª X11 çªå£è¯»åå¯è¯. å½ä» .Xsession æç±»ä¼¼ç script ä¸- è°ç¨ ssh æ¶, è¿ä¸ªåè½ç¹å«æç¨. (æ³¨æ, æäºæºå¨ä¸å¯è½éè¦å°è¾å¥éå®åä¸º /dev/null æè½å·¥ä½.)

SSH_AUTH_SOCK

æ è¯æä¸ª UNIX å socket çè·¯å¾, ç¨äºåä»£çéä¿¡.

SSH_CONNECTION

SSH_ORIGINAL_COMMAND

SSH_TTY

USER

è®¾ç½®ä¸ºç»å½çç¨æ·å.

å¦å¤, å¦æåè®¸ç¨æ·æ¹åä»ä»¬çç¯å¢æ°æ®, èä¸æ $HOME/.ssh/environment è¿ä¸ªæä»¶, ssh å°è¯»åå¶ä¸æ°æ®, æ “VARNAME=value” è¿ç§æ ¼å¼çæ°æ®è¡æ·»å è¿ç¯å¢æ°æ®åº. å¦è§ sshd_config(5) ç PermitUserEnvironment éé¡¹.

æä»¶ (FILES)
$HOME/.ssh/known_hosts

ä¸»æºå¯é¥çè®°å½, è®°å½æç¨æ·ç»å½ä¸æ¥, ä½æ¯æ²¡æåå¨ /etc/ssh/ssh_known_hosts ä¸çä¸»æº. åè§ sshd(8).

$HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa

$HOME/.ssh/identity.pub, $HOME/.ssh/id_dsa.pub, $HOME/.ssh/id_rsa.pub

åå«è®¤è¯ç¨çå¬é¥ (ä»¥ææ¬æ ¼å¼ä¿åçèº«ä»½æä»¶çå¬å¼é¨å). å¦æç¨æ·å¸æç¨åè®®ç¬¬ä¸çç RSA è®¤è¯ç»å½è¿äºæºå¨, $HOME/.ssh/identity.pub çåå®¹åºè¯¥æ·»å å°æææºå¨ç $HOME/.ssh/authorized_keys ä¸. å¦æç¨æ·å¸æç¨åè®®ç¬¬äºçç DSA/RSA è®¤è¯ç»å½è¿äºæºå¨, $HOME/.ssh/id_dsa.pub å $HOME/.ssh/id_rsa.pub çåå®¹åºè¯¥æ·»å å°æææºå¨ç $HOME/.ssh/authorized_keys ä¸. è¿äºæä»¶æ²¡ææææ°æ®, å¯ä»¥(ä½ä¸æ¯å¿é¡»)è®©ä»»ä½äººè¯»å. ssh ç»ä¸ä¼èªå¨è®¿é®è¿äºæä»¶, å®ä»¬ä¹ä¸æ¯ä¸å¯æç¼º; åªæ¯ä¸ºäºç¨æ·æ¹ä¾¿ææä¾è¿äºæä»¶.

$HOME/.ssh/config

ç¨æ·çº§éç½®æä»¶. ssh_config(5) æè¿°äºæä»¶æ ¼å¼åå¶éç½®éé¡¹.

$HOME/.ssh/authorized_keys

/etc/ssh/ssh_known_hosts

/etc/ssh/ssh_config

ç³»ç»çº§éç½®æä»¶. ssh_config(5) æè¿°äºæä»¶æ ¼å¼åéç½®éé¡¹.

/etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key

è¿ä¸ä¸ªæä»¶åå«äºä¸»æºå¯é¥çç§æé¨å, å®ä»¬ç¨äº RhostsRSAAuthentication å HostbasedAuthentication. å¦æä½¿ç¨äºåè®®ç¬¬ä¸çç RhostsRSAAuthentication æ¹æ³, ssh å¿é¡»æ¯ setuid root, å ä¸ºåªæ root æè½è¯»åä¸»æºå¯é¥. èå¯¹äºåè®®ç¬¬äºçç HostbasedAuthentication æ¹æ³, ssh ä½¿ç¨ ssh-keysign(8) è®¿é®ä¸»æºå¯é¥. è¿æ ·æ¶é¤äºéªè¯èº«ä»½æ¶å¯¹ ssh setuid root çè¦æ±. é»è®¤æåµä¸ ssh ä¸æ¯ setuid root.

$HOME/.rhosts

æ³¨æ, é»è®¤æåµä¸ä¼å®è£ sshd(8) , å æ¤å¨åè®¸ . rhosts è®¤è¯å, sshd(8) è¦æ±æåè¿è¡äº RSA ä¸»æºéªè¯. å¦ææ²¡æ /etc/ssh/ssh_known_hosts æä»¶åæ¾å®¢æ·çä¸»æºå¯é¥, å¯é¥å¯ä»¥åæ¾å¨ $HOME/.ssh/known_hosts ä¸. æç®åçåæ³æ¯ç¨ ssh ä»æå¡å¨åè¿å®¢æ·æº; è¿æ ·ä¼èªå¨æä¸»æºå¯é¥æ·»å å° $HOME/.ssh/known_hosts.

$HOME/.shosts

è¿ä¸ªæä»¶çç¨æ³å .rhosts å®å¨ä¸æ ·. å®çç®çæ¯åè®¸ ssh å rhosts è®¤è¯çåæ¶é²æ¢ rlogin æ rsh(1) ç»å½.

/etc/hosts.equiv

/etc/ssh/shosts.equiv

è¿ä¸ªæä»¶çç¨æ³å /etc/hosts.equiv å®å¨ä¸æ ·. ç¨äºåè®¸ ssh ç»å½, ä½ä¸åè®¸ rsh/rlogin çæ¶å.

/etc/ssh/sshrc

å½ç¨æ·ç»å½å, è¿è¡ shell (æå½ä»¤)å, ssh æ§è¡è¿ä¸ªæä»¶ä¸çå½ä»¤. è¯¦è§ sshd(8) æåé¡µ.

$HOME/.ssh/rc

å½ç¨æ·ç»å½å, è¿è¡ shell (æå½ä»¤)å, ssh æ§è¡è¿ä¸ªæä»¶ä¸çå½ä»¤. è¯¦è§ sshd(8) æåé¡µ.

$HOME/.ssh/environment

å«æå³äºç¯å¢åéçéå å®ä¹, å¦è§åé¢ç “ENVIRONMENT” è.

è¯æ (DIAGNOSTICS)

ä½è (AUTHORS)

OpenSSH æºèªæå Tatu Ylonen åè¡¨çèªç± ssh 1.2.12. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt å Dug Song æ¶é¤äºè®¸å¤ BUGS, å¢å æ°çç¹å¾, ä»èåå»ºäº OpenSSH. Markus Friedl è´¡ç®äºå¯¹ SSH åè®®1.5çå2.0ççæ¯æ.

å¦è§ (SEE ALSO)

rsh(1), scp(1), sftp(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), telnet(1), ssh_config(5), ssh-keysign(8), sshd(8)

T. Ylonen ,
T. Kivinen ,
M. Saarinen ,
T. Rinne , and
S. Lehtinen ,
SSH Protocol Architecture ,
draft-ietf-secsh-architecture-12.txt ,
January 2002 ,
work in progress material .

[ä¸æçç»´æ¤äºº]

å¾æ <xuming@users.sourceforge.net>

[ä¸æçææ°æ´æ°]

2004/06/11 ç¬¬ä¸ç

ãä¸å½Linuxè®ºåmanæåé¡µç¿»è¯è®¡åã

http://cmpp.linuxforum.net

è·

æ¬é¡µé¢ä¸æçç±ä¸æ man æåé¡µè®¡åæä¾ã
ä¸æ man æåé¡µè®¡åï¼https://github.com/man-pages-zh/manpages-zh Debian September 25, 1999 SSH(1)

手册导航

man1

man2

man3

man4

man5

man6

man7

man8

ssh

目录