Initial commit with translated description
This commit is contained in:
407
SKILL.md
Normal file
407
SKILL.md
Normal file
@@ -0,0 +1,407 @@
|
||||
---
|
||||
name: ssh-essentials
|
||||
description: "用于安全远程访问、密钥管理、隧道和文件传输的SSH基础命令。"
|
||||
homepage: https://www.openssh.com/
|
||||
metadata: {"clawdbot":{"emoji":"🔐","requires":{"bins":["ssh"]}}}
|
||||
---
|
||||
|
||||
# SSH Essentials
|
||||
|
||||
Secure Shell (SSH) for remote access and secure file transfers.
|
||||
|
||||
## Basic Connection
|
||||
|
||||
### Connecting
|
||||
```bash
|
||||
# Connect with username
|
||||
ssh user@hostname
|
||||
|
||||
# Connect to specific port
|
||||
ssh user@hostname -p 2222
|
||||
|
||||
# Connect with verbose output
|
||||
ssh -v user@hostname
|
||||
|
||||
# Connect with specific key
|
||||
ssh -i ~/.ssh/id_rsa user@hostname
|
||||
|
||||
# Connect and run command
|
||||
ssh user@hostname 'ls -la'
|
||||
ssh user@hostname 'uptime && df -h'
|
||||
```
|
||||
|
||||
### Interactive use
|
||||
```bash
|
||||
# Connect with forwarding agent
|
||||
ssh -A user@hostname
|
||||
|
||||
# Connect with X11 forwarding (GUI apps)
|
||||
ssh -X user@hostname
|
||||
ssh -Y user@hostname # Trusted X11
|
||||
|
||||
# Escape sequences (during session)
|
||||
# ~. - Disconnect
|
||||
# ~^Z - Suspend SSH
|
||||
# ~# - List forwarded connections
|
||||
# ~? - Help
|
||||
```
|
||||
|
||||
## SSH Keys
|
||||
|
||||
### Generating keys
|
||||
```bash
|
||||
# Generate RSA key
|
||||
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
|
||||
|
||||
# Generate ED25519 key (recommended)
|
||||
ssh-keygen -t ed25519 -C "your_email@example.com"
|
||||
|
||||
# Generate with custom filename
|
||||
ssh-keygen -t ed25519 -f ~/.ssh/id_myserver
|
||||
|
||||
# Generate without passphrase (automation)
|
||||
ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_deploy
|
||||
```
|
||||
|
||||
### Managing keys
|
||||
```bash
|
||||
# Copy public key to server
|
||||
ssh-copy-id user@hostname
|
||||
|
||||
# Copy specific key
|
||||
ssh-copy-id -i ~/.ssh/id_rsa.pub user@hostname
|
||||
|
||||
# Manual key copy
|
||||
cat ~/.ssh/id_rsa.pub | ssh user@hostname 'cat >> ~/.ssh/authorized_keys'
|
||||
|
||||
# Check key fingerprint
|
||||
ssh-keygen -lf ~/.ssh/id_rsa.pub
|
||||
|
||||
# Change key passphrase
|
||||
ssh-keygen -p -f ~/.ssh/id_rsa
|
||||
```
|
||||
|
||||
### SSH agent
|
||||
```bash
|
||||
# Start ssh-agent
|
||||
eval $(ssh-agent)
|
||||
|
||||
# Add key to agent
|
||||
ssh-add ~/.ssh/id_rsa
|
||||
|
||||
# List keys in agent
|
||||
ssh-add -l
|
||||
|
||||
# Remove key from agent
|
||||
ssh-add -d ~/.ssh/id_rsa
|
||||
|
||||
# Remove all keys
|
||||
ssh-add -D
|
||||
|
||||
# Set key lifetime (seconds)
|
||||
ssh-add -t 3600 ~/.ssh/id_rsa
|
||||
```
|
||||
|
||||
## Port Forwarding & Tunneling
|
||||
|
||||
### Local port forwarding
|
||||
```bash
|
||||
# Forward local port to remote
|
||||
ssh -L 8080:localhost:80 user@hostname
|
||||
# Access via: http://localhost:8080
|
||||
|
||||
# Forward to different remote host
|
||||
ssh -L 8080:database.example.com:5432 user@jumphost
|
||||
# Access database through jumphost
|
||||
|
||||
# Multiple forwards
|
||||
ssh -L 8080:localhost:80 -L 3306:localhost:3306 user@hostname
|
||||
```
|
||||
|
||||
### Remote port forwarding
|
||||
```bash
|
||||
# Forward remote port to local
|
||||
ssh -R 8080:localhost:3000 user@hostname
|
||||
# Remote server can access localhost:3000 via its port 8080
|
||||
|
||||
# Make service accessible from remote
|
||||
ssh -R 9000:localhost:9000 user@publicserver
|
||||
```
|
||||
|
||||
### Dynamic port forwarding (SOCKS proxy)
|
||||
```bash
|
||||
# Create SOCKS proxy
|
||||
ssh -D 1080 user@hostname
|
||||
|
||||
# Use with browser or apps
|
||||
# Configure SOCKS5 proxy: localhost:1080
|
||||
|
||||
# With Firefox
|
||||
firefox --profile $(mktemp -d) \
|
||||
--preferences "network.proxy.type=1;network.proxy.socks=localhost;network.proxy.socks_port=1080"
|
||||
```
|
||||
|
||||
### Background tunnels
|
||||
```bash
|
||||
# Run in background
|
||||
ssh -f -N -L 8080:localhost:80 user@hostname
|
||||
|
||||
# -f: Background
|
||||
# -N: No command execution
|
||||
# -L: Local forward
|
||||
|
||||
# Keep alive
|
||||
ssh -o ServerAliveInterval=60 -L 8080:localhost:80 user@hostname
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### SSH config file (`~/.ssh/config`)
|
||||
```
|
||||
# Simple host alias
|
||||
Host myserver
|
||||
HostName 192.168.1.100
|
||||
User admin
|
||||
Port 2222
|
||||
|
||||
# With key and options
|
||||
Host production
|
||||
HostName prod.example.com
|
||||
User deploy
|
||||
IdentityFile ~/.ssh/id_prod
|
||||
ForwardAgent yes
|
||||
|
||||
# Jump host (bastion)
|
||||
Host internal
|
||||
HostName 10.0.0.5
|
||||
User admin
|
||||
ProxyJump bastion
|
||||
|
||||
Host bastion
|
||||
HostName bastion.example.com
|
||||
User admin
|
||||
|
||||
# Wildcard configuration
|
||||
Host *.example.com
|
||||
User admin
|
||||
ForwardAgent yes
|
||||
|
||||
# Keep connections alive
|
||||
Host *
|
||||
ServerAliveInterval 60
|
||||
ServerAliveCountMax 3
|
||||
```
|
||||
|
||||
### Using config
|
||||
```bash
|
||||
# Connect using alias
|
||||
ssh myserver
|
||||
|
||||
# Jump through bastion automatically
|
||||
ssh internal
|
||||
|
||||
# Override config options
|
||||
ssh -o "StrictHostKeyChecking=no" myserver
|
||||
```
|
||||
|
||||
## File Transfers
|
||||
|
||||
### SCP (Secure Copy)
|
||||
```bash
|
||||
# Copy file to remote
|
||||
scp file.txt user@hostname:/path/to/destination/
|
||||
|
||||
# Copy file from remote
|
||||
scp user@hostname:/path/to/file.txt ./local/
|
||||
|
||||
# Copy directory recursively
|
||||
scp -r /local/dir user@hostname:/remote/dir/
|
||||
|
||||
# Copy with specific port
|
||||
scp -P 2222 file.txt user@hostname:/path/
|
||||
|
||||
# Copy with compression
|
||||
scp -C large-file.zip user@hostname:/path/
|
||||
|
||||
# Preserve attributes (timestamps, permissions)
|
||||
scp -p file.txt user@hostname:/path/
|
||||
```
|
||||
|
||||
### SFTP (Secure FTP)
|
||||
```bash
|
||||
# Connect to SFTP server
|
||||
sftp user@hostname
|
||||
|
||||
# Common SFTP commands:
|
||||
# pwd - Remote working directory
|
||||
# lpwd - Local working directory
|
||||
# ls - List remote files
|
||||
# lls - List local files
|
||||
# cd - Change remote directory
|
||||
# lcd - Change local directory
|
||||
# get file - Download file
|
||||
# put file - Upload file
|
||||
# mget *.txt - Download multiple files
|
||||
# mput *.jpg - Upload multiple files
|
||||
# mkdir dir - Create remote directory
|
||||
# rmdir dir - Remove remote directory
|
||||
# rm file - Delete remote file
|
||||
# exit/bye - Quit
|
||||
|
||||
# Batch mode
|
||||
sftp -b commands.txt user@hostname
|
||||
```
|
||||
|
||||
### Rsync over SSH
|
||||
```bash
|
||||
# Sync directory
|
||||
rsync -avz /local/dir/ user@hostname:/remote/dir/
|
||||
|
||||
# Sync with progress
|
||||
rsync -avz --progress /local/dir/ user@hostname:/remote/dir/
|
||||
|
||||
# Sync with delete (mirror)
|
||||
rsync -avz --delete /local/dir/ user@hostname:/remote/dir/
|
||||
|
||||
# Exclude patterns
|
||||
rsync -avz --exclude '*.log' --exclude 'node_modules/' \
|
||||
/local/dir/ user@hostname:/remote/dir/
|
||||
|
||||
# Custom SSH port
|
||||
rsync -avz -e "ssh -p 2222" /local/dir/ user@hostname:/remote/dir/
|
||||
|
||||
# Dry run
|
||||
rsync -avz --dry-run /local/dir/ user@hostname:/remote/dir/
|
||||
```
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### Hardening SSH
|
||||
```bash
|
||||
# Disable password authentication (edit /etc/ssh/sshd_config)
|
||||
PasswordAuthentication no
|
||||
PubkeyAuthentication yes
|
||||
|
||||
# Disable root login
|
||||
PermitRootLogin no
|
||||
|
||||
# Change default port
|
||||
Port 2222
|
||||
|
||||
# Use protocol 2 only
|
||||
Protocol 2
|
||||
|
||||
# Limit users
|
||||
AllowUsers user1 user2
|
||||
|
||||
# Restart SSH service
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
### Connection security
|
||||
```bash
|
||||
# Check host key
|
||||
ssh-keygen -F hostname
|
||||
|
||||
# Remove old host key
|
||||
ssh-keygen -R hostname
|
||||
|
||||
# Strict host key checking
|
||||
ssh -o StrictHostKeyChecking=yes user@hostname
|
||||
|
||||
# Use specific cipher
|
||||
ssh -c aes256-ctr user@hostname
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Debugging
|
||||
```bash
|
||||
# Verbose output
|
||||
ssh -v user@hostname
|
||||
ssh -vv user@hostname # More verbose
|
||||
ssh -vvv user@hostname # Maximum verbosity
|
||||
|
||||
# Test connection
|
||||
ssh -T user@hostname
|
||||
|
||||
# Check permissions
|
||||
ls -la ~/.ssh/
|
||||
# Should be: 700 for ~/.ssh, 600 for keys, 644 for .pub files
|
||||
```
|
||||
|
||||
### Common issues
|
||||
```bash
|
||||
# Fix permissions
|
||||
chmod 700 ~/.ssh
|
||||
chmod 600 ~/.ssh/id_rsa
|
||||
chmod 644 ~/.ssh/id_rsa.pub
|
||||
chmod 644 ~/.ssh/authorized_keys
|
||||
|
||||
# Clear known_hosts entry
|
||||
ssh-keygen -R hostname
|
||||
|
||||
# Disable host key checking (not recommended)
|
||||
ssh -o StrictHostKeyChecking=no user@hostname
|
||||
```
|
||||
|
||||
## Advanced Operations
|
||||
|
||||
### Jump hosts (ProxyJump)
|
||||
```bash
|
||||
# Connect through bastion
|
||||
ssh -J bastion.example.com user@internal.local
|
||||
|
||||
# Multiple jumps
|
||||
ssh -J bastion1,bastion2 user@final-destination
|
||||
|
||||
# Using config (see Configuration section above)
|
||||
ssh internal # Automatically uses ProxyJump
|
||||
```
|
||||
|
||||
### Multiplexing
|
||||
```bash
|
||||
# Master connection
|
||||
ssh -M -S ~/.ssh/control-%r@%h:%p user@hostname
|
||||
|
||||
# Reuse connection
|
||||
ssh -S ~/.ssh/control-user@hostname:22 user@hostname
|
||||
|
||||
# In config:
|
||||
# ControlMaster auto
|
||||
# ControlPath ~/.ssh/control-%r@%h:%p
|
||||
# ControlPersist 10m
|
||||
```
|
||||
|
||||
### Execute commands
|
||||
```bash
|
||||
# Single command
|
||||
ssh user@hostname 'uptime'
|
||||
|
||||
# Multiple commands
|
||||
ssh user@hostname 'cd /var/log && tail -n 20 syslog'
|
||||
|
||||
# Pipe commands
|
||||
cat local-script.sh | ssh user@hostname 'bash -s'
|
||||
|
||||
# With sudo
|
||||
ssh -t user@hostname 'sudo command'
|
||||
```
|
||||
|
||||
## Tips
|
||||
|
||||
- Use SSH keys instead of passwords
|
||||
- Use `~/.ssh/config` for frequently accessed hosts
|
||||
- Enable SSH agent forwarding carefully (security risk)
|
||||
- Use ProxyJump for accessing internal networks
|
||||
- Keep SSH client and server updated
|
||||
- Use fail2ban or similar to prevent brute force
|
||||
- Monitor `/var/log/auth.log` for suspicious activity
|
||||
- Use port knocking or VPN for additional security
|
||||
- Backup your SSH keys securely
|
||||
- Use different keys for different purposes
|
||||
|
||||
## Documentation
|
||||
|
||||
Official docs: https://www.openssh.com/manual.html
|
||||
Man pages: `man ssh`, `man ssh_config`, `man sshd_config`
|
||||
Reference in New Issue
Block a user