From 370f1eb284e27eb76abc8a674bc864d47ce7f2f1 Mon Sep 17 00:00:00 2001 From: Cat Tom Date: Sun, 8 Nov 2026 16:54:59 +0800 Subject: [PATCH] fix: format of macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md --- ...login-and-change-the-SSH-listening-port.md | 271 +++++++++--------- 1 file changed, 138 insertions(+), 133 deletions(-) diff --git a/docs/tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md b/docs/tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md index 6953574..32d918e 100644 --- a/docs/tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md +++ b/docs/tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md @@ -7,205 +7,210 @@ 1. **在 Mac 上开启“远程登录”** -系统设置 → 通用 → 共享 → 远程登录旁边的 ⓘ + 系统设置 → 通用 → 共享 → 远程登录旁边的 ⓘ -开启“远程登录”，在“允许访问”中选择“仅这些用户”，添加你准备使用的账户。 + 开启“远程登录”，在“允许访问”中选择“仅这些用户”，添加你准备使用的账户。 -“允许远程用户对磁盘进行完全访问”按实际文件访问需求决定。 + “允许远程用户对磁盘进行完全访问”按实际文件访问需求决定。 2. **在客户端生成 SSH 密钥**: 参照[创建和管理 Linux 服务器用于身份验证的 SSH 密钥](https://blog.cattom.site/tech/Creating-and-Managing-SSH-Keys-for-Authentication-on-Linux-Servers/) 3. **把公钥安装到 Mac** -```bash -cat your-public-key.pub > ~/.ssh/authorized_keys + ```bash + cat your-public-key.pub > ~/.ssh/authorized_keys -chmod 700 ~/.ssh + chmod 700 ~/.ssh -chmod 600 ~/.ssh/authorized_keys -``` + chmod 600 ~/.ssh/authorized_keys + ``` 4. **验证“只用密钥”可以登录** -```bash -ssh -v \ - -i ~/.ssh/your-private-key \ - -o IdentitiesOnly=yes \ - -o PreferredAuthentications=publickey \ - -o PasswordAuthentication=no \ - -o KbdInteractiveAuthentication=no \ - -o ControlPath=none \ - username@192.168.1.123 -``` + ```bash + ssh -v \ + -i ~/.ssh/your-private-key \ + -o IdentitiesOnly=yes \ + -o PreferredAuthentications=publickey \ + -o PasswordAuthentication=no \ + -o KbdInteractiveAuthentication=no \ + -o ControlPath=none \ + username@192.168.1.123 + ``` -成功时，调试信息中应出现类似信息: + 成功时，调试信息中应出现类似信息: -``` -Authenticated to ... using "publickey". -``` + ``` + Authenticated to ... using "publickey". + ``` 5. **在 Mac 上设置仅允许密钥登录** -```bash -sudo tee /etc/ssh/sshd_config.d/00-user.conf >/dev/null <<'EOF' -PubkeyAuthentication yes -PasswordAuthentication no -KbdInteractiveAuthentication no -AuthenticationMethods publickey -EOF + ```bash + sudo tee /etc/ssh/sshd_config.d/00-user.conf >/dev/null <<'EOF' + PubkeyAuthentication yes + PasswordAuthentication no + KbdInteractiveAuthentication no + AuthenticationMethods publickey + EOF -sudo chown root:wheel /etc/ssh/sshd_config.d/00-user.conf -sudo chmod 644 /etc/ssh/sshd_config.d/00-user.conf -``` + sudo chown root:wheel /etc/ssh/sshd_config.d/00-user.conf + sudo chmod 644 /etc/ssh/sshd_config.d/00-user.conf + ``` -上述四项设置分别表示: + 上述四项设置分别表示: -| 配置 | 作用 | -| --------------------------------- | ---------------------------- | -| `PubkeyAuthentication yes` | 启用公钥认证 | -| `PasswordAuthentication no` | 禁用密码认证 | -| `KbdInteractiveAuthentication no` | 禁用键盘交互认证 | -| `AuthenticationMethods publickey` | 明确要求通过公钥认证才能登录 | + | 配置 | 作用 | + | --------------------------------- | ---------------------------- | + | `PubkeyAuthentication yes` | 启用公钥认证 | + | `PasswordAuthentication no` | 禁用密码认证 | + | `KbdInteractiveAuthentication no` | 禁用键盘交互认证 | + | `AuthenticationMethods publickey` | 明确要求通过公钥认证才能登录 | 6. **检查语法和配置是否正确生效** -检查配置语法: + 检查配置语法: -```bash -sudo /usr/sbin/sshd -t -``` + ```bash + sudo /usr/sbin/sshd -t + ``` -正常情况下没有输出。有报错时，按提示修正。 + 正常情况下没有输出。有报错时，按提示修正。 -查看配置是否正确生效: + 查看配置是否正确生效: -```bash -sudo /usr/sbin/sshd -T | grep -E '^(PubkeyAuthentication|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)' -``` + ```bash + sudo /usr/sbin/sshd -T | grep -E '^(PubkeyAuthentication|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)' + ``` -预期结果如下: + 预期结果如下: -``` -PubkeyAuthentication yes -PasswordAuthentication no -KbdInteractiveAuthentication no -AuthenticationMethods publickey -``` + ``` + PubkeyAuthentication yes + PasswordAuthentication no + KbdInteractiveAuthentication no + AuthenticationMethods publickey + ``` 7. 验证密码无法登录 SSH -执行下面的反向测试：关闭客户端公钥认证，只尝试两种密码相关认证，并禁止连接复用。 + 执行下面的反向测试：关闭客户端公钥认证，只尝试两种密码相关认证，并禁止连接复用。 -```bash -ssh \ - -o PubkeyAuthentication=no \ - -o PreferredAuthentications=password,keyboard-interactive \ - -o PasswordAuthentication=yes \ - -o KbdInteractiveAuthentication=yes \ - -o ControlPath=none \ - username@192.168.1.123 -``` + ```bash + ssh \ + -o PubkeyAuthentication=no \ + -o PreferredAuthentications=password,keyboard-interactive \ + -o PasswordAuthentication=yes \ + -o KbdInteractiveAuthentication=yes \ + -o ControlPath=none \ + username@192.168.1.123 + ``` -预期应被拒绝，例如: + 预期应被拒绝，例如: -``` -username@192.168.1.123: Permission denied (publickey). -``` + ``` + username@192.168.1.123: Permission denied (publickey). + ``` ## 修改 SSH 监听端口 1. **修改 `/etc/ssh/sshd_config.d/00-user.conf`** -在 `/etc/ssh/sshd_config.d/00-user.conf` 中，加入 `Port 2233` + 在 `/etc/ssh/sshd_config.d/00-user.conf` 中，加入 `Port 2233` 2. **检查配置是否正确生效** -```bash -sudo /usr/sbin/sshd -T | grep -E "Port" -Port 2233 -GatewayPorts no -``` + ```bash + sudo /usr/sbin/sshd -T | grep -E "Port" + ``` + + 预期输出: + + ``` + Port 2233 + GatewayPorts no + ``` 3. **创建服务配置** -```bash -sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF' - - - - - Label - local.sshd-2233 - - ProgramArguments - - /usr/libexec/sshd-keygen-wrapper - - - Sockets + ```bash + sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF' + + + - Listeners + Label + local.sshd-2233 + + ProgramArguments + + /usr/libexec/sshd-keygen-wrapper + + + Sockets - SockServiceName - 2233 + Listeners + + SockServiceName + 2233 + + + + inetdCompatibility + + Wait + - - inetdCompatibility - - Wait - - - - -EOF -``` + + EOF + ``` 4. **检查并加载服务** -```bash -sudo chown root:wheel /Library/LaunchDaemons/local.sshd-2233.plist -sudo chmod 644 /Library/LaunchDaemons/local.sshd-2233.plist + ```bash + sudo chown root:wheel /Library/LaunchDaemons/local.sshd-2233.plist + sudo chmod 644 /Library/LaunchDaemons/local.sshd-2233.plist -plutil -lint /Library/LaunchDaemons/local.sshd-2233.plist -sudo /usr/sbin/sshd -t -``` + plutil -lint /Library/LaunchDaemons/local.sshd-2233.plist + sudo /usr/sbin/sshd -t + ``` -`plutil` 应显示 OK，`sshd -t` 正常时没有输出。 + `plutil` 应显示 OK，`sshd -t` 正常时没有输出。 -``` bash -sudo launchctl enable system/local.sshd-2233 -sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist -``` + ``` bash + sudo launchctl enable system/local.sshd-2233 + sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist + ``` -然后检查服务状态和端口监听情况: + 然后检查服务状态和端口监听情况: -```bash -sudo launchctl print system/local.sshd-2233 -sudo lsof -nP -iTCP:2233 -sTCP:LISTEN -``` + ```bash + sudo launchctl print system/local.sshd-2233 + sudo lsof -nP -iTCP:2233 -sTCP:LISTEN + ``` -如果以后需要修改上述 plist，修改完成后记得重新加载服务: + 如果以后需要修改上述 plist，修改完成后记得重新加载服务: -```bash -sudo launchctl bootout system/local.sshd-2233 -sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist -``` + ```bash + sudo launchctl bootout system/local.sshd-2233 + sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist + ``` 5. **停用默认 SSH 服务** -```bash -sudo launchctl disable system/com.openssh.sshd -sudo launchctl bootout system/com.openssh.sshd -``` + ```bash + sudo launchctl disable system/com.openssh.sshd + sudo launchctl bootout system/com.openssh.sshd + ``` -再次检查端口监听情况: + 再次检查端口监听情况: -```bash -sudo lsof -nP -iTCP:22 -sTCP:LISTEN -sudo lsof -nP -iTCP:2233 -sTCP:LISTEN -``` + ```bash + sudo lsof -nP -iTCP:22 -sTCP:LISTEN + sudo lsof -nP -iTCP:2233 -sTCP:LISTEN + ``` !!! warning "注意"