fix: format of macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md

docs/tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md

@@ -7,205 +7,210 @@
 
 1. **在 Mac 上开启“远程登录”**
 
-系统设置 → 通用 → 共享 → 远程登录旁边的 ⓘ
+    系统设置 → 通用 → 共享 → 远程登录旁边的 ⓘ
 
-开启“远程登录”，在“允许访问”中选择“仅这些用户”，添加你准备使用的账户。
+    开启“远程登录”，在“允许访问”中选择“仅这些用户”，添加你准备使用的账户。
 
-“允许远程用户对磁盘进行完全访问”按实际文件访问需求决定。
+    “允许远程用户对磁盘进行完全访问”按实际文件访问需求决定。
 
 2. **在客户端生成 SSH 密钥**: 参照[创建和管理 Linux 服务器用于身份验证的 SSH 密钥](https://blog.cattom.site/tech/Creating-and-Managing-SSH-Keys-for-Authentication-on-Linux-Servers/)
 
 3. **把公钥安装到 Mac**
 
-```bash
+    ```bash
-cat your-public-key.pub > ~/.ssh/authorized_keys
+    cat your-public-key.pub > ~/.ssh/authorized_keys
 
-chmod 700 ~/.ssh
+    chmod 700 ~/.ssh
 
-chmod 600 ~/.ssh/authorized_keys
+    chmod 600 ~/.ssh/authorized_keys
-```
+    ```
 
 4. **验证“只用密钥”可以登录**
 
-```bash
+    ```bash
-ssh -v \
+    ssh -v \
-  -i ~/.ssh/your-private-key \
+    -i ~/.ssh/your-private-key \
-  -o IdentitiesOnly=yes \
+    -o IdentitiesOnly=yes \
-  -o PreferredAuthentications=publickey \
+    -o PreferredAuthentications=publickey \
-  -o PasswordAuthentication=no \
+    -o PasswordAuthentication=no \
-  -o KbdInteractiveAuthentication=no \
+    -o KbdInteractiveAuthentication=no \
-  -o ControlPath=none \
+    -o ControlPath=none \
-  username@192.168.1.123
+    username@192.168.1.123
-```
+    ```
 
-成功时，调试信息中应出现类似信息: 
+    成功时，调试信息中应出现类似信息: 
 
-```
+    ```
-Authenticated to ... using "publickey".
+    Authenticated to ... using "publickey".
-```
+    ```
 
 5. **在 Mac 上设置仅允许密钥登录**
 
-```bash
+    ```bash
-sudo tee /etc/ssh/sshd_config.d/00-user.conf >/dev/null <<'EOF'
+    sudo tee /etc/ssh/sshd_config.d/00-user.conf >/dev/null <<'EOF'
-PubkeyAuthentication yes
+    PubkeyAuthentication yes
-PasswordAuthentication no
+    PasswordAuthentication no
-KbdInteractiveAuthentication no
+    KbdInteractiveAuthentication no
-AuthenticationMethods publickey
+    AuthenticationMethods publickey
-EOF
+    EOF
 
-sudo chown root:wheel /etc/ssh/sshd_config.d/00-user.conf
+    sudo chown root:wheel /etc/ssh/sshd_config.d/00-user.conf
-sudo chmod 644 /etc/ssh/sshd_config.d/00-user.conf
+    sudo chmod 644 /etc/ssh/sshd_config.d/00-user.conf
-```
+    ```
 
-上述四项设置分别表示: 
+    上述四项设置分别表示: 
 
-| 配置                              | 作用                         |
+    | 配置                              | 作用                         |
-| --------------------------------- | ---------------------------- |
+    | --------------------------------- | ---------------------------- |
-| `PubkeyAuthentication yes`        | 启用公钥认证                 |
+    | `PubkeyAuthentication yes`        | 启用公钥认证                 |
-| `PasswordAuthentication no`       | 禁用密码认证                 |
+    | `PasswordAuthentication no`       | 禁用密码认证                 |
-| `KbdInteractiveAuthentication no` | 禁用键盘交互认证             |
+    | `KbdInteractiveAuthentication no` | 禁用键盘交互认证             |
-| `AuthenticationMethods publickey` | 明确要求通过公钥认证才能登录 |
+    | `AuthenticationMethods publickey` | 明确要求通过公钥认证才能登录 |
 
 
 6. **检查语法和配置是否正确生效**
 
-检查配置语法:
+    检查配置语法:
 
-```bash
+    ```bash
-sudo /usr/sbin/sshd -t
+    sudo /usr/sbin/sshd -t
-```
+    ```
 
-正常情况下没有输出。有报错时，按提示修正。
+    正常情况下没有输出。有报错时，按提示修正。
 
-查看配置是否正确生效:
+    查看配置是否正确生效:
 
-```bash
+    ```bash
-sudo /usr/sbin/sshd -T | grep -E '^(PubkeyAuthentication|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)'
+    sudo /usr/sbin/sshd -T | grep -E '^(PubkeyAuthentication|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)'
-```
+    ```
 
-预期结果如下:
+    预期结果如下:
 
-```
+    ```
-PubkeyAuthentication yes
+    PubkeyAuthentication yes
-PasswordAuthentication no
+    PasswordAuthentication no
-KbdInteractiveAuthentication no
+    KbdInteractiveAuthentication no
-AuthenticationMethods publickey
+    AuthenticationMethods publickey
-```
+    ```
 
 7. 验证密码无法登录 SSH
 
-执行下面的反向测试：关闭客户端公钥认证，只尝试两种密码相关认证，并禁止连接复用。
+    执行下面的反向测试：关闭客户端公钥认证，只尝试两种密码相关认证，并禁止连接复用。
 
-```bash
+    ```bash
-ssh \
+    ssh \
-  -o PubkeyAuthentication=no \
+    -o PubkeyAuthentication=no \
-  -o PreferredAuthentications=password,keyboard-interactive \
+    -o PreferredAuthentications=password,keyboard-interactive \
-  -o PasswordAuthentication=yes \
+    -o PasswordAuthentication=yes \
-  -o KbdInteractiveAuthentication=yes \
+    -o KbdInteractiveAuthentication=yes \
-  -o ControlPath=none \
+    -o ControlPath=none \
-  username@192.168.1.123
+    username@192.168.1.123
-```
+    ```
 
-预期应被拒绝，例如:
+    预期应被拒绝，例如:
 
-```
+    ```
-username@192.168.1.123: Permission denied (publickey).
+    username@192.168.1.123: Permission denied (publickey).
-```
+    ```
 
 ## 修改 SSH 监听端口
 
 1. **修改 `/etc/ssh/sshd_config.d/00-user.conf`**
 
-在 `/etc/ssh/sshd_config.d/00-user.conf` 中，加入 `Port 2233`
+    在 `/etc/ssh/sshd_config.d/00-user.conf` 中，加入 `Port 2233`
 
 2. **检查配置是否正确生效**
 
-```bash
+    ```bash
-sudo /usr/sbin/sshd -T | grep -E "Port"
+    sudo /usr/sbin/sshd -T | grep -E "Port"
-Port 2233
+    ```
-GatewayPorts no
+
-```
+    预期输出:
+
+    ```
+    Port 2233
+    GatewayPorts no
+    ```
 
 3. **创建服务配置**
 
-```bash
+    ```bash
-sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF'
+    sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF'
-<?xml version="1.0" encoding="UTF-8"?>
+    <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
+    <plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>local.sshd-2233</string>
-
-    <key>ProgramArguments</key>
-    <array>
-        <string>/usr/libexec/sshd-keygen-wrapper</string>
-    </array>
-
-    <key>Sockets</key>
     <dict>
-        <key>Listeners</key>
+        <key>Label</key>
+        <string>local.sshd-2233</string>
+
+        <key>ProgramArguments</key>
+        <array>
+            <string>/usr/libexec/sshd-keygen-wrapper</string>
+        </array>
+
+        <key>Sockets</key>
         <dict>
-            <key>SockServiceName</key>
+            <key>Listeners</key>
-            <string>2233</string>
+            <dict>
+                <key>SockServiceName</key>
+                <string>2233</string>
+            </dict>
+        </dict>
+
+        <key>inetdCompatibility</key>
+        <dict>
+            <key>Wait</key>
+            <false/>
         </dict>
     </dict>
-
+    </plist>
-    <key>inetdCompatibility</key>
+    EOF
-    <dict>
+    ```
-        <key>Wait</key>
-        <false/>
-    </dict>
-</dict>
-</plist>
-EOF
-```
 
 4. **检查并加载服务**
 
-```bash
+    ```bash
-sudo chown root:wheel /Library/LaunchDaemons/local.sshd-2233.plist
+    sudo chown root:wheel /Library/LaunchDaemons/local.sshd-2233.plist
-sudo chmod 644 /Library/LaunchDaemons/local.sshd-2233.plist
+    sudo chmod 644 /Library/LaunchDaemons/local.sshd-2233.plist
 
-plutil -lint /Library/LaunchDaemons/local.sshd-2233.plist
+    plutil -lint /Library/LaunchDaemons/local.sshd-2233.plist
-sudo /usr/sbin/sshd -t
+    sudo /usr/sbin/sshd -t
-```
+    ```
 
-`plutil` 应显示 OK，`sshd -t` 正常时没有输出。
+    `plutil` 应显示 OK，`sshd -t` 正常时没有输出。
 
-``` bash
+    ``` bash
-sudo launchctl enable system/local.sshd-2233
+    sudo launchctl enable system/local.sshd-2233
-sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
+    sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
-```
+    ```
 
-然后检查服务状态和端口监听情况: 
+    然后检查服务状态和端口监听情况: 
 
-```bash
+    ```bash
-sudo launchctl print system/local.sshd-2233
+    sudo launchctl print system/local.sshd-2233
-sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
+    sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
-```
+    ```
 
-如果以后需要修改上述 plist，修改完成后记得重新加载服务:
+    如果以后需要修改上述 plist，修改完成后记得重新加载服务:
 
-```bash
+    ```bash
-sudo launchctl bootout system/local.sshd-2233
+    sudo launchctl bootout system/local.sshd-2233
-sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
+    sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
-```
+    ```
 
 5. **停用默认 SSH 服务**
 
-```bash
+    ```bash
-sudo launchctl disable system/com.openssh.sshd
+    sudo launchctl disable system/com.openssh.sshd
-sudo launchctl bootout system/com.openssh.sshd
+    sudo launchctl bootout system/com.openssh.sshd
-```
+    ```
 
-再次检查端口监听情况:
+    再次检查端口监听情况:
 
-```bash
+    ```bash
-sudo lsof -nP -iTCP:22 -sTCP:LISTEN
+    sudo lsof -nP -iTCP:22 -sTCP:LISTEN
-sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
+    sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
-```
+    ```
 
 !!! warning "注意"