Add macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md
Deploy / deploy (push) Successful in 1m10s
Deploy / deploy (push) Successful in 1m10s
This commit is contained in:
5 files changed
+218
-178
No files matched your search
@@ -1,175 +0,0 @@
|
||||
# 安装与配置 OPNsense 26.1
|
||||
|
||||
## 局域网设备安排
|
||||
|
||||
| IP | 设备 | MAC |
|
||||
| :----------: | :----------------------: | :---------------: |
|
||||
| 192.168.1.1 | CatTomServer0 - OPNsense | \ |
|
||||
| 192.168.1.2 | CatTomServer0 - Proxmox | \ |
|
||||
| 192.168.1.3 | \ | \ |
|
||||
| 192.168.1.4 | CatTomServer4 | \ |
|
||||
| 192.168.1.5 | CatTomServer1 | 54:f6:c5:f4:98:b0 |
|
||||
| 192.168.1.6 | CatTomPBS | \ |
|
||||
| 192.168.1.7 | CatTomServer2 | 24:5E:BE:69:90:C9 |
|
||||
| 192.168.1.8 | CatTomServer3 | (vmbr0) |
|
||||
| 192.168.1.9 | CatTomServer3-2 | \ |
|
||||
| 192.168.1.10 | CatTomServer3-1 | \ |
|
||||
|
||||
## 环境
|
||||
|
||||
- 幻网 N5000
|
||||
- Proxmox 9.1
|
||||
|
||||
## 镜像下载
|
||||
|
||||
[Download - OPNsense](https://opnsense.org/download/)
|
||||
|
||||
- System architecture: `amd64`
|
||||
- Select the image type: `dvd`
|
||||
- Mirror Location: `Peking University open source software mirror`
|
||||
- 哈希算法: `SHA256`
|
||||
- 解压缩算法: `BZIP2`
|
||||
|
||||
## 虚拟机创建
|
||||
|
||||
### 常规
|
||||
|
||||
- 名称: (随意)
|
||||
- 开机自启动: True
|
||||
- 启动/关机顺序: 0
|
||||
- 启动延时: 0
|
||||
|
||||
### 操作系统
|
||||
|
||||
- ISO 镜像: `OPNsense-26.1.2-dvd-amd64.iso`
|
||||
|
||||
### 系统
|
||||
|
||||
- 显卡: 默认
|
||||
- 机型: `q35`
|
||||
- BIOS: `OVMF (UEFI)`
|
||||
- 添加 EFI 磁盘: True
|
||||
- 格式: `QEMU 映像格式 (qcow2)`
|
||||
- 预注册密钥: True
|
||||
- Qemu 代理: True
|
||||
|
||||
### 磁盘
|
||||
|
||||
- 总线/设备: `SCSI` `0`
|
||||
- 缓存: 默认 (无缓存)
|
||||
- IO thread: True
|
||||
- 磁盘大小(GiB): 50
|
||||
- 格式: `QEMU 映像格式 (qcow2)`
|
||||
- SSD 仿真: True
|
||||
- 备份: True
|
||||
|
||||
### CPU
|
||||
|
||||
- 插槽: 1
|
||||
- 核心: 4
|
||||
- 类别: `host`
|
||||
- Extra CPU Flags:
|
||||
- `aes`: On
|
||||
|
||||
### 内存
|
||||
|
||||
- 内存(MiB): 4096
|
||||
- 最小内存(MiB): 2048
|
||||
- Ballooning 设备: True
|
||||
|
||||
### 网络(WAN)
|
||||
|
||||
- 桥接: `vmbr0`
|
||||
- 模型: `VirtIO (半虚拟化)`
|
||||
- **防火墙: False**
|
||||
- Multiqueue: (与 CPU 核心数相同)
|
||||
|
||||
### 网络(LAN)
|
||||
|
||||
- 桥接: `vmbr1`
|
||||
- 模型: `VirtIO (半虚拟化)`
|
||||
- **防火墙: False**
|
||||
- Multiqueue: (与 CPU 核心数相同)
|
||||
|
||||
## 安装 OPNsense
|
||||
|
||||
### 分配网络接口
|
||||
|
||||
> Press any key to start the manual interface assignment
|
||||
|
||||
此时，系统正在等待用户决定是否手动分配网口，需要在倒计时结束之前，按下键盘任意按键进入网口分配流程。
|
||||
|
||||
> Do you want to configure LAGGs now?
|
||||
|
||||
系统提示是否配置 LAGGs ，输入 n 并回车
|
||||
|
||||
> Do you want to configure VLANs now?
|
||||
|
||||
系统提示是否配置 VLANs ，输入 n 并回车
|
||||
|
||||
> Enter the WAN interface name or 'a' for auto-detection:
|
||||
|
||||
系统等待输入 WAN 对应的网口名称，或输入 a 进行自动探测。
|
||||
|
||||
此时，需要根据 Valid interface 列表中的信息，选择 WAN 对应的网口。
|
||||
|
||||
WAN 口分配完成后，系统会提示如下信息：
|
||||
|
||||
> Enter the LAN interface name or 'a' for auto-detection
|
||||
> NOTE: this enables full Firewalling/NAT mode.
|
||||
> (or nothing if finished):
|
||||
|
||||
表示系统等待输入 LAN 对应的网口名称，或输入 a 进行自动探测。
|
||||
|
||||
而且一旦分配了 LAN ，OPNsense 将默认激活 防火墙 和 NAT 相关功能。
|
||||
|
||||
如果不想指定任何 LAN ，留空即可。
|
||||
|
||||
LAN 口分配完成后，系统会提示如下信息：
|
||||
|
||||
> Enter the Optional interface 1 name or 'a' for auto-detection
|
||||
> (or nothing if finished):
|
||||
|
||||
表示系统等待用户输入 OPT1 （可选网口）对应的网口名称，或输入 a 进行自动探测。
|
||||
|
||||
如果用户不想指定任何 OPT1 ，留空即可。
|
||||
|
||||
本文后续将会创建内部网桥，因此不对其分配网口，直接按 回车键 结束网口分配流程。
|
||||
|
||||
> Do you want to proceed?
|
||||
|
||||
系统将展示当前网口分配结果，并询问是否执行，输入 y 并回车。
|
||||
|
||||
### 登录安装账户
|
||||
|
||||
使用账户 installer 和默认密码 opnsense 进行登录，进入系统安装流程。
|
||||
|
||||
与 Linux 系统一样，输入密码时不会有任何提示符出现。
|
||||
|
||||
### 配置文件系统
|
||||
|
||||
OPNsense 从版本 24.7 开始，默认使用 ZFS 作为文件系统，保持默认选择的 Install (ZFS) ，按 回车键 继续。
|
||||
|
||||
由于只有一块硬盘，因此 ZFS 冗余模式选择 `stripe` 。
|
||||
|
||||
### 安装完成
|
||||
|
||||
选择 Complete Install ，按 回车键 继续。
|
||||
|
||||
## qemu-guest-agent 插件
|
||||
|
||||
## Mihomo
|
||||
|
||||
https://wiki.metacubex.one/startup/service/
|
||||
|
||||
https://github.com/MetaCubeX/mihomo/releases/download/v1.19.21/mihomo-linux-amd64-v3-v1.19.21.gz
|
||||
|
||||
gzip -d mihomo-linux-amd64-v3-v1.19.21.gz
|
||||
|
||||
mv mihomo-linux-amd64-v3-v1.19.21 mihomo
|
||||
|
||||
sudo mv mihomo /usr/local/bin/
|
||||
|
||||
## 参考
|
||||
|
||||
[CallMeR/opnsense_configuration_notes: OPNsense 防火墙的安装以及折腾手记](https://github.com/CallMeR/opnsense_configuration_notes)
|
||||
@@ -1,8 +1,8 @@
|
||||
# 安装与配置 Proxmox 9
|
||||
|
||||
## 环境
|
||||
!!! warning "注意"
|
||||
|
||||
- 幻网 N5000
|
||||
以下内容未经物理机操作检验，仅在虚拟机环境内测试通过，仅供参考。
|
||||
|
||||
## 下载 ISO 镜像
|
||||
|
||||
|
||||
@@ -131,7 +131,7 @@ services:
|
||||
|
||||
镜像链接: [Index of /groups/virt/virtio-win/direct-downloads/archive-virtio](https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/?C=M;O=D)
|
||||
|
||||
!!! warning "注意!"
|
||||
!!! warning "注意"
|
||||
|
||||
部分版本出现了[兼容性问题](https://pve.proxmox.com/wiki/Windows_VirtIO_Drivers#Troubleshooting)。
|
||||
|
||||
|
||||
+214
@@ -0,0 +1,214 @@
|
||||
# macOS 26 配置 SSH 密钥登录和修改 SSH 监听端口
|
||||
|
||||
- 设备: Mac mini M4
|
||||
- 系统: macOS 26.7.2
|
||||
|
||||
## 配置 SSH 密钥登录
|
||||
|
||||
1. **在 Mac 上开启“远程登录”**
|
||||
|
||||
系统设置 → 通用 → 共享 → 远程登录旁边的 ⓘ
|
||||
|
||||
开启“远程登录”，在“允许访问”中选择“仅这些用户”，添加你准备使用的账户。
|
||||
|
||||
“允许远程用户对磁盘进行完全访问”按实际文件访问需求决定。
|
||||
|
||||
2. **在客户端生成 SSH 密钥**: 参照[创建和管理 Linux 服务器用于身份验证的 SSH 密钥](https://blog.cattom.site/tech/Creating-and-Managing-SSH-Keys-for-Authentication-on-Linux-Servers/)
|
||||
|
||||
3. **把公钥安装到 Mac**
|
||||
|
||||
```bash
|
||||
cat your-public-key.pub > ~/.ssh/authorized_keys
|
||||
|
||||
chmod 700 ~/.ssh
|
||||
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
```
|
||||
|
||||
4. **验证“只用密钥”可以登录**
|
||||
|
||||
```bash
|
||||
ssh -v \
|
||||
-i ~/.ssh/your-private-key \
|
||||
-o IdentitiesOnly=yes \
|
||||
-o PreferredAuthentications=publickey \
|
||||
-o PasswordAuthentication=no \
|
||||
-o KbdInteractiveAuthentication=no \
|
||||
-o ControlPath=none \
|
||||
username@192.168.1.123
|
||||
```
|
||||
|
||||
成功时，调试信息中应出现类似信息:
|
||||
|
||||
```
|
||||
Authenticated to ... using "publickey".
|
||||
```
|
||||
|
||||
5. **在 Mac 上设置仅允许密钥登录**
|
||||
|
||||
```bash
|
||||
sudo tee /etc/ssh/sshd_config.d/00-user.conf >/dev/null <<'EOF'
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
AuthenticationMethods publickey
|
||||
EOF
|
||||
|
||||
sudo chown root:wheel /etc/ssh/sshd_config.d/00-user.conf
|
||||
sudo chmod 644 /etc/ssh/sshd_config.d/00-user.conf
|
||||
```
|
||||
|
||||
上述四项设置分别表示:
|
||||
|
||||
| 配置 | 作用 |
|
||||
| --------------------------------- | ---------------------------- |
|
||||
| `PubkeyAuthentication yes` | 启用公钥认证 |
|
||||
| `PasswordAuthentication no` | 禁用密码认证 |
|
||||
| `KbdInteractiveAuthentication no` | 禁用键盘交互认证 |
|
||||
| `AuthenticationMethods publickey` | 明确要求通过公钥认证才能登录 |
|
||||
|
||||
|
||||
6. **检查语法和配置是否正确生效**
|
||||
|
||||
检查配置语法:
|
||||
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -t
|
||||
```
|
||||
|
||||
正常情况下没有输出。有报错时，按提示修正。
|
||||
|
||||
查看配置是否正确生效:
|
||||
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -T | grep -E '^(PubkeyAuthentication|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)'
|
||||
```
|
||||
|
||||
预期结果如下:
|
||||
|
||||
```
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication no
|
||||
KbdInteractiveAuthentication no
|
||||
AuthenticationMethods publickey
|
||||
```
|
||||
|
||||
7. 验证密码无法登录 SSH
|
||||
|
||||
执行下面的反向测试：关闭客户端公钥认证，只尝试两种密码相关认证，并禁止连接复用。
|
||||
|
||||
```bash
|
||||
ssh \
|
||||
-o PubkeyAuthentication=no \
|
||||
-o PreferredAuthentications=password,keyboard-interactive \
|
||||
-o PasswordAuthentication=yes \
|
||||
-o KbdInteractiveAuthentication=yes \
|
||||
-o ControlPath=none \
|
||||
username@192.168.1.123
|
||||
```
|
||||
|
||||
预期应被拒绝，例如:
|
||||
|
||||
```
|
||||
username@192.168.1.123: Permission denied (publickey).
|
||||
```
|
||||
|
||||
## 修改 SSH 监听端口
|
||||
|
||||
1. **修改 `/etc/ssh/sshd_config.d/00-user.conf`**
|
||||
|
||||
在 `/etc/ssh/sshd_config.d/00-user.conf` 中，加入 `Port 2233`
|
||||
|
||||
2. **检查配置是否正确生效**
|
||||
|
||||
```bash
|
||||
sudo /usr/sbin/sshd -T | grep -E "Port"
|
||||
Port 2233
|
||||
GatewayPorts no
|
||||
```
|
||||
|
||||
3. **创建服务配置**
|
||||
|
||||
```bash
|
||||
sudo tee /Library/LaunchDaemons/local.sshd-2233.plist >/dev/null <<'EOF'
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>Label</key>
|
||||
<string>local.sshd-2233</string>
|
||||
|
||||
<key>ProgramArguments</key>
|
||||
<array>
|
||||
<string>/usr/libexec/sshd-keygen-wrapper</string>
|
||||
</array>
|
||||
|
||||
<key>Sockets</key>
|
||||
<dict>
|
||||
<key>Listeners</key>
|
||||
<dict>
|
||||
<key>SockServiceName</key>
|
||||
<string>2233</string>
|
||||
</dict>
|
||||
</dict>
|
||||
|
||||
<key>inetdCompatibility</key>
|
||||
<dict>
|
||||
<key>Wait</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
EOF
|
||||
```
|
||||
|
||||
4. **检查并加载服务**
|
||||
|
||||
```bash
|
||||
sudo chown root:wheel /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
sudo chmod 644 /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
|
||||
plutil -lint /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
sudo /usr/sbin/sshd -t
|
||||
```
|
||||
|
||||
`plutil` 应显示 OK，`sshd -t` 正常时没有输出。
|
||||
|
||||
``` bash
|
||||
sudo launchctl enable system/local.sshd-2233
|
||||
sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
```
|
||||
|
||||
然后检查服务状态和端口监听情况:
|
||||
|
||||
```bash
|
||||
sudo launchctl print system/local.sshd-2233
|
||||
sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
|
||||
```
|
||||
|
||||
如果以后需要修改上述 plist，修改完成后记得重新加载服务:
|
||||
|
||||
```bash
|
||||
sudo launchctl bootout system/local.sshd-2233
|
||||
sudo launchctl bootstrap system /Library/LaunchDaemons/local.sshd-2233.plist
|
||||
```
|
||||
|
||||
5. **停用默认 SSH 服务**
|
||||
|
||||
```bash
|
||||
sudo launchctl disable system/com.openssh.sshd
|
||||
sudo launchctl bootout system/com.openssh.sshd
|
||||
```
|
||||
|
||||
再次检查端口监听情况:
|
||||
|
||||
```bash
|
||||
sudo lsof -nP -iTCP:22 -sTCP:LISTEN
|
||||
sudo lsof -nP -iTCP:2233 -sTCP:LISTEN
|
||||
```
|
||||
|
||||
!!! warning "注意"
|
||||
|
||||
管理修改了 SSH 监听端口的自定义服务时，使用 `launchctl` 和上述自定义 plist。
|
||||
|
||||
系统设置中的“远程登录”开关管理的是默认 SSH 服务，无法控制修改了 SSH 监听端口的自定义服务。
|
||||
Reference in new issue
Block a user