fix: format of macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md
Deploy / deploy (push) Failing after 1m31s
Deploy / deploy (push) Failing after 1m31s
This commit is contained in:
1 file changed
+107
-102
+107
-102
@@ -7,28 +7,28 @@
|
||||
|
||||
1. **在 Mac 上开启“远程登录”**
|
||||
|
||||
系统设置 → 通用 → 共享 → 远程登录旁边的 ⓘ
|
||||
系统设置 → 通用 → 共享 → 远程登录旁边的 ⓘ
|
||||
|
||||
开启“远程登录”，在“允许访问”中选择“仅这些用户”，添加你准备使用的账户。
|
||||
开启“远程登录”，在“允许访问”中选择“仅这些用户”，添加你准备使用的账户。
|
||||
|
||||
“允许远程用户对磁盘进行完全访问”按实际文件访问需求决定。
|
||||
“允许远程用户对磁盘进行完全访问”按实际文件访问需求决定。
|
||||
|
||||
2. **在客户端生成 SSH 密钥**: 参照[创建和管理 Linux 服务器用于身份验证的 SSH 密钥](https://blog.cattom.site/tech/Creating-and-Managing-SSH-Keys-for-Authentication-on-Linux-Servers/)
|
||||
|
||||
3. **把公钥安装到 Mac**
|
||||
|
||||
```bash
|
||||
cat your-public-key.pub > ~/.ssh/authorized_keys
|
||||
```bash
|
||||
cat your-public-key.pub > ~/.ssh/authorized_keys
|
||||
|
||||
chmod 700 ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
```
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
```
|
||||
|
||||
4. **验证“只用密钥”可以登录**
|
||||
|
||||
```bash
|
||||
ssh -v \
|
||||
```bash
|
||||
ssh -v \
|
||||
-i ~/.ssh/your-private-key \
|
||||
-o IdentitiesOnly=yes \
|
||||
-o PreferredAuthentications=publickey \
|
||||
@@ -36,105 +36,110 @@ ssh -v \
|
||||
-o KbdInteractiveAuthentication=no \
|
||||
-o ControlPath=none \
|
||||
username@192.168.1.123
|
||||
```
|
||||
```
|
||||
|
||||
成功时，调试信息中应出现类似信息:
|
||||
成功时，调试信息中应出现类似信息:
|
||||
|
||||
```
|
||||
Authenticated to ... using "publickey".
|
||||
```
|
||||
```
|
||||
Authenticated to ... using "publickey".
|
||||
```
|
||||
|
||||
5. **在 Mac 上设置仅允许密钥登录**
|
||||
|
||||
```bash
|
||||
sudo tee /etc/ssh/sshd_config.d/00-user.conf >/dev/null <<'EOF'
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
AuthenticationMethods publickey
|
||||
EOF
|
||||
```bash
|
||||
sudo tee /etc/ssh/sshd_config.d/00-user.conf >/dev/null <<'EOF'
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
AuthenticationMethods publickey
|
||||
EOF
|
||||
|
||||
sudo chown root:wheel /etc/ssh/sshd_config.d/00-user.conf
|
||||
sudo chmod 644 /etc/ssh/sshd_config.d/00-user.conf
|
||||
```
|
||||
sudo chown root:wheel /etc/ssh/sshd_config.d/00-user.conf
|
||||
sudo chmod 644 /etc/ssh/sshd_config.d/00-user.conf
|
||||
```
|
||||
|
||||
上述四项设置分别表示:
|
||||
上述四项设置分别表示:
|
||||
|
||||
| 配置 | 作用 |
|
||||
| --------------------------------- | ---------------------------- |
|
||||
| `PubkeyAuthentication yes` | 启用公钥认证 |
|
||||
| `PasswordAuthentication no` | 禁用密码认证 |
|
||||
| `KbdInteractiveAuthentication no` | 禁用键盘交互认证 |
|
||||
| `AuthenticationMethods publickey` | 明确要求通过公钥认证才能登录 |
|
||||
| 配置 | 作用 |
|
||||
| --------------------------------- | ---------------------------- |
|
||||
| `PubkeyAuthentication yes` | 启用公钥认证 |
|
||||
| `PasswordAuthentication no` | 禁用密码认证 |
|
||||
| `KbdInteractiveAuthentication no` | 禁用键盘交互认证 |
|
||||
| `AuthenticationMethods publickey` | 明确要求通过公钥认证才能登录 |
|
||||
|
||||
|
||||
6. **检查语法和配置是否正确生效**
|
||||
|
||||
检查配置语法:
|
||||
检查配置语法:
|
||||
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -t
|
||||
```
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -t
|
||||
```
|
||||
|
||||
正常情况下没有输出。有报错时，按提示修正。
|
||||
正常情况下没有输出。有报错时，按提示修正。
|
||||
|
||||
查看配置是否正确生效:
|
||||
查看配置是否正确生效:
|
||||
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -T | grep -E '^(PubkeyAuthentication|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)'
|
||||
```
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -T | grep -E '^(PubkeyAuthentication|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)'
|
||||
```
|
||||
|
||||
预期结果如下:
|
||||
预期结果如下:
|
||||
|
||||
```
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
AuthenticationMethods publickey
|
||||
```
|
||||
```
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
AuthenticationMethods publickey
|
||||
```
|
||||
|
||||
7. 验证密码无法登录 SSH
|
||||
|
||||
执行下面的反向测试：关闭客户端公钥认证，只尝试两种密码相关认证，并禁止连接复用。
|
||||
执行下面的反向测试：关闭客户端公钥认证，只尝试两种密码相关认证，并禁止连接复用。
|
||||
|
||||
```bash
|
||||
ssh \
|
||||
```bash
|
||||
ssh \
|
||||
-o PubkeyAuthentication=no \
|
||||
-o PreferredAuthentications=password,keyboard-interactive \
|
||||
-o PasswordAuthentication=yes \
|
||||
-o KbdInteractiveAuthentication=yes \
|
||||
-o ControlPath=none \
|
||||
username@192.168.1.123
|
||||
```
|
||||
```
|
||||
|
||||
预期应被拒绝，例如:
|
||||
预期应被拒绝，例如:
|
||||
|
||||
```
|
||||
username@192.168.1.123: Permission denied (publickey).
|
||||
```
|
||||
```
|
||||
username@192.168.1.123: Permission denied (publickey).
|
||||
```
|
||||
|
||||
## 修改 SSH 监听端口
|
||||
|
||||
1. **修改 `/etc/ssh/sshd_config.d/00-user.conf`**
|
||||
|
||||
在 `/etc/ssh/sshd_config.d/00-user.conf` 中，加入 `Port 2233`
|
||||
在 `/etc/ssh/sshd_config.d/00-user.conf` 中，加入 `Port 2233`
|
||||
|
||||
2. **检查配置是否正确生效**
|
||||
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -T | grep -E "Port"
|
||||
Port 2233
|
||||
GatewayPorts no
|
||||
```
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -T | grep -E "Port"
|
||||
```
|
||||
|
||||
预期输出:
|
||||
|
||||
```
|
||||
Port 2233
|
||||
GatewayPorts no
|
||||
```
|
||||
|
||||
3. **创建服务配置**
|
||||
|
||||
```bash
|
||||
sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF'
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
```bash
|
||||
sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF'
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>Label</key>
|
||||
<string>local.sshd-2233</string>
|
||||
|
||||
@@ -157,55 +162,55 @@ sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF'
|
||||
<key>Wait</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
EOF
|
||||
```
|
||||
</dict>
|
||||
</plist>
|
||||
EOF
|
||||
```
|
||||
|
||||
4. **检查并加载服务**
|
||||
|
||||
```bash
|
||||
sudo chown root:wheel /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
sudo chmod 644 /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
```bash
|
||||
sudo chown root:wheel /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
sudo chmod 644 /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
|
||||
plutil -lint /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
sudo /usr/sbin/sshd -t
|
||||
```
|
||||
plutil -lint /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
sudo /usr/sbin/sshd -t
|
||||
```
|
||||
|
||||
`plutil` 应显示 OK，`sshd -t` 正常时没有输出。
|
||||
`plutil` 应显示 OK，`sshd -t` 正常时没有输出。
|
||||
|
||||
``` bash
|
||||
sudo launchctl enable system/local.sshd-2233
|
||||
sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
```
|
||||
``` bash
|
||||
sudo launchctl enable system/local.sshd-2233
|
||||
sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
```
|
||||
|
||||
然后检查服务状态和端口监听情况:
|
||||
然后检查服务状态和端口监听情况:
|
||||
|
||||
```bash
|
||||
sudo launchctl print system/local.sshd-2233
|
||||
sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
|
||||
```
|
||||
```bash
|
||||
sudo launchctl print system/local.sshd-2233
|
||||
sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
|
||||
```
|
||||
|
||||
如果以后需要修改上述 plist，修改完成后记得重新加载服务:
|
||||
如果以后需要修改上述 plist，修改完成后记得重新加载服务:
|
||||
|
||||
```bash
|
||||
sudo launchctl bootout system/local.sshd-2233
|
||||
sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
```
|
||||
```bash
|
||||
sudo launchctl bootout system/local.sshd-2233
|
||||
sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
```
|
||||
|
||||
5. **停用默认 SSH 服务**
|
||||
|
||||
```bash
|
||||
sudo launchctl disable system/com.openssh.sshd
|
||||
sudo launchctl bootout system/com.openssh.sshd
|
||||
```
|
||||
```bash
|
||||
sudo launchctl disable system/com.openssh.sshd
|
||||
sudo launchctl bootout system/com.openssh.sshd
|
||||
```
|
||||
|
||||
再次检查端口监听情况:
|
||||
再次检查端口监听情况:
|
||||
|
||||
```bash
|
||||
sudo lsof -nP -iTCP:22 -sTCP:LISTEN
|
||||
sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
|
||||
```
|
||||
```bash
|
||||
sudo lsof -nP -iTCP:22 -sTCP:LISTEN
|
||||
sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
|
||||
```
|
||||
|
||||
!!! warning "注意"
|
||||
|
||||
|
||||
Reference in new issue
Block a user