{"id":101086,"date":"2026-09-06T05:40:56","date_gmt":"2026-09-05T21:40:56","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/101086.html"},"modified":"2026-09-06T05:40:56","modified_gmt":"2026-09-05T21:40:56","slug":"linux-%e6%9c%8d%e5%8a%a1%e5%99%a8%e8%bf%90%e7%bb%b4%e5%ae%9e%e6%88%98%ef%bc%882%ef%bc%89%ef%bc%9a%e7%94%a8%e6%88%b7%e6%9d%83%e9%99%90%e4%b8%8e-ssh-%e9%85%8d%e7%bd%ae","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/101086.html","title":{"rendered":"Linux \u670d\u52a1\u5668\u8fd0\u7ef4\u5b9e\u6218\uff082\uff09\uff1a\u7528\u6237\u6743\u9650\u4e0e SSH \u914d\u7f6e"},"content":{"rendered":"

\u4e0a\u4e00\u7bc7\u5b8c\u6210\u4e86\u7cfb\u7edf\u3001\u8865\u4e01\u3001\u65f6\u95f4\u548c\u5185\u6838\u57fa\u7ebf，\u672c\u7bc7\u628a\u201c\u8c01\u80fd\u767b\u5f55\u3001\u767b\u5f55\u540e\u80fd\u505a\u4ec0\u4e48\u201d\u7eb3\u5165\u63a7\u5236\u3002\u76ee\u6807\u4e0d\u662f\u7b80\u5355\u5173\u95ed root，\u800c\u662f\u5efa\u7acb\u53ef\u8ffd\u8d23\u7684\u4e2a\u4eba\u8d26\u53f7\u3001\u53d7\u9650\u7684 sudo \u6743\u9650\u4e0e\u53ef\u9a8c\u8bc1\u7684 SSH \u5bc6\u94a5\u94fe，\u5e76\u4fdd\u8bc1\u5207\u6362\u8fc7\u7a0b\u4e2d\u59cb\u7ec8\u4fdd\u7559\u6062\u590d\u901a\u9053\u3002<\/p>\n

\u4e00\u3001\u75db\u70b9：\u5171\u4eab root \u65e0\u6cd5\u5ba1\u8ba1<\/h3>\n

\u591a\u4eba\u5171\u7528 root \u5bc6\u7801\u65f6，\u65e5\u5fd7\u53ea\u80fd\u8bf4\u660e root \u505a\u4e86\u64cd\u4f5c，\u65e0\u6cd5\u5b9a\u4f4d\u4e2a\u4eba；\u5bc6\u7801\u6cc4\u6f0f\u540e\u4e5f\u5f88\u96be\u53ea\u64a4\u9500\u4e00\u4eba\u3002\u6b63\u786e\u6a21\u578b\u662f\u6bcf\u4f4d\u7ba1\u7406\u5458\u4f7f\u7528\u72ec\u7acb\u8d26\u53f7\u548c\u5bc6\u94a5，\u9700\u8981\u7279\u6743\u65f6\u7ecf sudo \u63d0\u5347\u3002\u670d\u52a1\u8fdb\u7a0b\u4f7f\u7528\u4e0d\u53ef\u4ea4\u4e92\u7684\u7cfb\u7edf\u8d26\u53f7，\u6587\u4ef6\u5f52\u5c5e\u4e0e\u8fdb\u7a0b\u8eab\u4efd\u5206\u79bb\u3002\u4eba\u5458\u79bb\u804c\u65f6\u9501\u5b9a\u4e2a\u4eba\u8d26\u53f7\u5373\u53ef，\u4e0d\u5fc5\u8f6e\u6362\u6240\u6709\u673a\u5668\u7684\u516c\u5171\u5bc6\u7801\u3002<\/p>\n

Linux \u6743\u9650\u7531\u7528\u6237\u3001\u7ec4\u548c\u5176\u4ed6\u4eba\u7684\u8bfb\u5199\u6267\u884c\u4f4d\u7ec4\u6210\u3002\u76ee\u5f55\u7684\u6267\u884c\u4f4d\u4ee3\u8868\u201c\u53ef\u7a7f\u8d8a\u201d，\u4e0d\u662f\u8fd0\u884c\u7a0b\u5e8f；\u7f3a\u5c11\u5b83，\u5373\u4f7f\u6587\u4ef6\u53ef\u8bfb\u4e5f\u65e0\u6cd5\u8bbf\u95ee\u3002umask 027 \u4f1a\u8ba9\u65b0\u6587\u4ef6\u9ed8\u8ba4\u53ea\u5bf9\u6240\u6709\u8005\u53ef\u8bfb\u5199\u3001\u540c\u7ec4\u53ef\u8bfb\u3001\u5176\u4ed6\u4eba\u65e0\u6743，\u4f46\u4e0d\u80fd\u4fee\u6b63\u5df2\u6709\u6587\u4ef6，\u4e5f\u4e0d\u80fd\u8986\u76d6\u5e94\u7528\u663e\u5f0f\u8bbe\u7f6e\u3002\u66f4\u590d\u6742\u7684\u5171\u4eab\u76ee\u5f55\u53ef\u4f7f\u7528 setgid \u7ee7\u627f\u7ec4，ACL \u5219\u9002\u5408\u5c11\u91cf\u4f8b\u5916；\u89c4\u5219\u8fc7\u591a\u4f1a\u8ba9 ls -l \u96be\u4ee5\u89e3\u91ca，\u5e94\u8c28\u614e\u4f7f\u7528\u3002<\/p>\n

\u4e8c\u3001\u539f\u7406：\u8ba4\u8bc1\u3001\u6388\u6743\u4e0e\u4e3b\u673a\u8eab\u4efd<\/h3>\n

SSH \u6709\u4e24\u4e2a\u5bb9\u6613\u6df7\u6dc6\u7684\u65b9\u5411\u3002\u670d\u52a1\u5668\u7528 authorized_keys \u9a8c\u8bc1\u201c\u5ba2\u6237\u7aef\u662f\u8c01\u201d；\u5ba2\u6237\u7aef\u7528 known_hosts \u9a8c\u8bc1\u201c\u670d\u52a1\u5668\u662f\u8c01\u201d\u3002\u53ea\u4e0a\u4f20\u516c\u94a5\u5374\u5ffd\u7565\u4e3b\u673a\u6307\u7eb9，\u4ecd\u53ef\u80fd\u628a\u51ed\u636e\u4ea4\u7ed9\u4e2d\u95f4\u4eba\u3002\u9996\u6b21\u8fde\u63a5\u5e94\u901a\u8fc7\u4e91\u63a7\u5236\u53f0\u3001\u8d44\u4ea7\u5e73\u53f0\u6216\u53e6\u4e00\u53ef\u4fe1\u901a\u9053\u6838\u5bf9\u6307\u7eb9，\u800c\u4e0d\u662f\u770b\u5230\u63d0\u793a\u5c31\u8f93\u5165 yes\u3002<\/p>\n

\u79c1\u94a5\u6c38\u8fdc\u7559\u5728\u7ba1\u7406\u7aef\u3002Ed25519 \u5bc6\u94a5\u77ed\u3001\u6027\u80fd\u597d，\u662f\u73b0\u4ee3 OpenSSH \u7684\u5e38\u7528\u9009\u62e9；\u82e5\u53d7\u65e7\u5408\u89c4\u73af\u5883\u9650\u5236\u518d\u9009\u62e9 RSA\u3002\u79c1\u94a5\u5e94\u6709\u53e3\u4ee4，\u5e76\u4ea4\u7ed9 ssh-agent \u4e34\u65f6\u89e3\u9501\u3002Agent forwarding \u4f1a\u628a\u7b7e\u540d\u80fd\u529b\u66b4\u9732\u7ed9\u8fdc\u7aef root，\u8df3\u677f\u573a\u666f\u4f18\u5148 ProxyJump，\u4e0d\u8f7b\u6613\u5f00\u542f\u8f6c\u53d1\u3002<\/p>\n

sudo \u7684\u4ef7\u503c\u5728\u4e8e\u6700\u5c0f\u6388\u6743\u548c\u8bb0\u5f55\u547d\u4ee4，\u4f46\u89c4\u5219\u82e5\u653e\u884c\u7f16\u8f91\u5668\u3001Shell\u3001\u5305\u7ba1\u7406\u5668\u6216\u80fd\u6307\u5b9a\u4efb\u610f\u8f93\u51fa\u8def\u5f84\u7684\u5de5\u5177，\u5f80\u5f80\u7b49\u540c\u5b8c\u6574 root\u3002\u7528 \/etc\/sudoers.d\/ \u62c6\u5206\u89c4\u5219\u5e76\u901a\u8fc7 visudo -cf \u6821\u9a8c，\u907f\u514d\u8bed\u6cd5\u9519\u8bef\u5bfc\u81f4\u6240\u6709\u7ba1\u7406\u5458\u5931\u53bb\u63d0\u6743\u80fd\u529b\u3002<\/p>\n

\u4e09\u3001\u5b9e\u73b0：\u5b89\u5168\u521b\u5efa\u7ba1\u7406\u5458\u5e76\u5207\u6362 SSH<\/h3>\n

\u5148\u521b\u5efa\u8d26\u53f7\u3001\u5b89\u88c5\u516c\u94a5\u5e76\u6821\u9a8c\u683c\u5f0f\u3002\u628a\u5b9e\u9645\u516c\u94a5\u4f5c\u4e3a\u7b2c\u4e00\u4e2a\u53c2\u6570\u4f20\u5165，\u907f\u514d\u5199\u6b7b\u8eab\u4efd\u3002\u811a\u672c\u4e0d\u4f1a\u7acb\u523b\u7981\u7528\u73b0\u6709\u767b\u5f55；\u6267\u884c\u540e\u52a1\u5fc5\u4ece\u53e6\u4e00\u4e2a\u7ec8\u7aef\u9a8c\u8bc1\u65b0\u8d26\u53f7\u80fd\u767b\u5f55\u548c sudo，\u518d\u8fdb\u5165\u7b2c\u4e8c\u9636\u6bb5\u3002<\/p>\n

#!\/usr\/bin\/env bash<\/span>
\nset<\/span> -euo<\/span> pipefail
\n[<\/span>[<\/span> "$EUID<\/span>"<\/span> -eq<\/span> 0<\/span> ]<\/span>]<\/span> ||<\/span> {<\/span> echo<\/span> '\u8bf7\u4f7f\u7528 root \u8fd0\u884c'<\/span> ><\/span>&2<\/span>;<\/span> exit<\/span> 1<\/span>;<\/span> }<\/span>
\n[<\/span>[<\/span> $#<\/span> -eq<\/span> 2<\/span> ]<\/span>]<\/span> ||<\/span> {<\/span> echo<\/span> "\u7528\u6cd5: $0<\/span> USER 'PUBLIC_KEY'"<\/span> ><\/span>&2<\/span>;<\/span> exit<\/span> 2<\/span>;<\/span> }<\/span>
\nuser<\/span>=<\/span>"$1<\/span>"<\/span>
\npublic_key<\/span>=<\/span>"$2<\/span>"<\/span>
\n[<\/span>[<\/span> "$user<\/span>"<\/span> =~<\/span> ^[<\/span>a-z_]<\/span>[<\/span>a-z0-9_-]<\/span>{<\/span>0,31<\/span>}<\/span>$ ]<\/span>]<\/span> ||<\/span> {<\/span> echo<\/span> '\u7528\u6237\u540d\u4e0d\u5408\u6cd5'<\/span> ><\/span>&2<\/span>;<\/span> exit<\/span> 2<\/span>;<\/span> }<\/span>
\n[<\/span>[<\/span> "$public_key<\/span>"<\/span> ==<\/span> ssh-ed25519\\\\<\/span> * ||<\/span> "$public_key<\/span>"<\/span> ==<\/span> ssh-rsa\\\\<\/span> * ]<\/span>]<\/span> ||<\/span> {<\/span>
\n echo<\/span> '\u4ec5\u63a5\u53d7 OpenSSH \u516c\u94a5\u884c'<\/span> ><\/span>&2<\/span>;<\/span> exit<\/span> 2<\/span>;<\/span>
\n}<\/span>
\nif<\/span> !<\/span> id<\/span> "$user<\/span>"<\/span> ><\/span>\/dev\/null 2<\/span>><\/span>&1<\/span>;<\/span> then<\/span>
\n useradd<\/span> –create-home –shell<\/span> \/bin\/bash "$user<\/span>"<\/span>
\nfi<\/span>
\nusermod<\/span> -aG<\/span> sudo<\/span> "$user<\/span>"<\/span>
\nhome<\/span>=<\/span>"$(<\/span>getent passwd<\/span> "$user<\/span>"<\/span> |<\/span> cut<\/span> -d: -f6<\/span>)<\/span><\/span>"<\/span>
\ninstall<\/span> -d<\/span> -m<\/span> 0700 -o<\/span> "$user<\/span>"<\/span> -g<\/span> "$user<\/span>"<\/span> "$home<\/span>\/.ssh"<\/span>
\nprintf<\/span> '%s\\\\n'<\/span> "$public_key<\/span>"<\/span> ><\/span> "$home<\/span>\/.ssh\/authorized_keys"<\/span>
\nchown<\/span> "$user<\/span>:$user<\/span>"<\/span> "$home<\/span>\/.ssh\/authorized_keys"<\/span>
\nchmod<\/span> 0600 "$home<\/span>\/.ssh\/authorized_keys"<\/span>
\nprintf<\/span> '%s ALL=(ALL:ALL) ALL\\\\n'<\/span> "$user<\/span>"<\/span> ><\/span> "\/etc\/sudoers.d\/90-$user<\/span>"<\/span>
\nchmod<\/span> 0440 "\/etc\/sudoers.d\/90-$user<\/span>"<\/span>
\nvisudo -cf<\/span> "\/etc\/sudoers.d\/90-$user<\/span>"<\/span>
\npasswd<\/span> -l<\/span> "$user<\/span>"<\/span> ><\/span>\/dev\/null
\necho<\/span> "created=$user<\/span> home=$home<\/span> sudo=enabled"<\/span><\/p>\n

\u8fd0\u884c\u8f93\u51fa：<\/p>\n

\/etc\/sudoers.d\/90-alice：\u89e3\u6790\u6b63\u786e
\ncreated=alice home=\/home\/alice sudo=enabled<\/p>\n

\u786e\u8ba4\u65b0\u4f1a\u8bdd\u6210\u529f\u540e，\u518d\u5199 SSH \u914d\u7f6e\u7247\u6bb5\u3002sshd -t \u5148\u505a\u9759\u6001\u6821\u9a8c，reload \u8ba9\u5df2\u6709\u8fde\u63a5\u4e0d\u88ab\u5f3a\u5236\u4e2d\u65ad\u3002\u4e0d\u540c\u53d1\u884c\u7248\u662f\u5426\u9ed8\u8ba4\u5305\u542b sshd_config.d \u8981\u5148\u7528 sshd -T \u548c\u4e3b\u914d\u7f6e\u786e\u8ba4\u3002\u4e91\u955c\u50cf\u8fd8\u53ef\u80fd\u7528 cloud-init \u5199\u89c4\u5219，\u5fc5\u987b\u68c0\u67e5\u6700\u7ec8\u751f\u6548\u503c\u3002<\/p>\n

#!\/usr\/bin\/env bash<\/span>
\nset<\/span> -euo<\/span> pipefail
\n[<\/span>[<\/span> "$EUID<\/span>"<\/span> -eq<\/span> 0<\/span> ]<\/span>]<\/span> ||<\/span> {<\/span> echo<\/span> '\u8bf7\u4f7f\u7528 root \u8fd0\u884c'<\/span> ><\/span>&2<\/span>;<\/span> exit<\/span> 1<\/span>;<\/span> }<\/span>
\nconfig<\/span>=<\/span>\/etc\/ssh\/sshd_config.d\/60-hardening.conf
\ninstall<\/span> -d<\/span> -m<\/span> 0755 \/etc\/ssh\/sshd_config.d
\ncp<\/span> -a<\/span> "$config<\/span>"<\/span> "$config<\/span>.bak"<\/span> 2<\/span>><\/span>\/dev\/null ||<\/span> true<\/span>
\ncat<\/span> ><\/span> "$config<\/span>"<\/span> <<<\/span>'EOF'
\nPermitRootLogin no
\nPasswordAuthentication no
\nKbdInteractiveAuthentication no
\nPubkeyAuthentication yes
\nPermitEmptyPasswords no
\nMaxAuthTries 4
\nLoginGraceTime 30
\nX11Forwarding no
\nAllowAgentForwarding no
\nEOF<\/span>
\nif<\/span> !<\/span> sshd -t;<\/span> then<\/span>
\n test<\/span> -f<\/span> "$config<\/span>.bak"<\/span> &&<\/span> mv<\/span> "$config<\/span>.bak"<\/span> "$config<\/span>"<\/span>
\n echo<\/span> '\u914d\u7f6e\u6821\u9a8c\u5931\u8d25，\u5df2\u56de\u6eda'<\/span> ><\/span>&2<\/span>
\n exit<\/span> 1<\/span>
\nfi<\/span>
\nsystemctl reload ssh<\/span> ||<\/span> systemctl reload sshd
\nsshd -T<\/span> |<\/span> awk<\/span> '\/^(permitrootlogin|passwordauthentication|pubkeyauthentication) \/'<\/span><\/p>\n

\u8fd0\u884c\u8f93\u51fa：<\/p>\n

permitrootlogin no
\npubkeyauthentication yes
\npasswordauthentication no<\/p>\n

\u56db\u3001\u8e29\u5751：\u9501\u5bc6\u7801\u4e0d\u7b49\u4e8e\u7981\u6b62 SSH<\/h3>\n

passwd -l \u9501\u5b9a\u7684\u662f\u5bc6\u7801\u54c8\u5e0c，\u516c\u94a5\u8ba4\u8bc1\u4ecd\u53ef\u4f7f\u7528，\u8fd9\u6b63\u9002\u5408\u5bc6\u94a5\u7ba1\u7406\u5458\u8d26\u53f7\u3002\u670d\u52a1\u8d26\u53f7\u5219\u5e94\u914d \/usr\/sbin\/nologin\u3001\u65e0\u6388\u6743\u5bc6\u94a5，\u5e76\u9650\u5236\u6587\u4ef6\u6240\u6709\u6743\u3002\u5220\u9664\u8d26\u53f7\u524d\u5148\u68c0\u67e5\u5b83\u62e5\u6709\u7684\u8fdb\u7a0b\u3001\u5b9a\u65f6\u4efb\u52a1\u3001\u6587\u4ef6\u548c systemd \u5355\u5143；\u76f4\u63a5 userdel -r \u53ef\u80fd\u5220\u9664\u4ecd\u9700\u4fdd\u7559\u7684\u6570\u636e\u3002<\/p>\n

\u4e0d\u8981\u7ed9\u6574\u4e2a\u8fd0\u7ef4\u7ec4\u914d\u7f6e\u65e0\u6761\u4ef6 NOPASSWD: ALL\u3002\u5bc6\u7801\u63d0\u793a\u80fd\u51cf\u5c11\u8bef\u64cd\u4f5c\u548c\u88ab\u76d7\u4f1a\u8bdd\u76f4\u63a5\u63d0\u6743，\u867d\u7136\u5b83\u4e0d\u662f\u7b2c\u4e8c\u56e0\u7d20\u3002\u81ea\u52a8\u5316\u786e\u9700\u514d\u5bc6\u65f6，\u53ea\u6388\u6743\u56fa\u5b9a\u7edd\u5bf9\u8def\u5f84\u3001\u56fa\u5b9a\u53c2\u6570\u548c\u4e13\u7528\u811a\u672c；\u811a\u672c\u672c\u8eab\u5fc5\u987b\u7531 root \u62e5\u6709\u4e14\u4e0d\u53ef\u88ab\u6388\u6743\u7528\u6237\u4fee\u6539\u3002<\/p>\n

\u4e94\u3001\u9a8c\u8bc1：\u4ece\u5ba2\u6237\u7aef\u5230\u670d\u52a1\u7aef\u95ed\u73af<\/h3>\n

\u5ba2\u6237\u7aef\u5148\u8fd0\u884c ssh-keygen -t ed25519 -a 64，\u518d\u6838\u5bf9 ssh-keygen -lf \/etc\/ssh\/ssh_host_ed25519_key.pub \u7684\u670d\u52a1\u7aef\u6307\u7eb9\u3002\u670d\u52a1\u7aef\u7528 sshd -T \u67e5\u770b\u5408\u5e76\u540e\u7684\u6700\u7ec8\u914d\u7f6e，\u56e0\u4e3a\u540c\u540d\u6307\u4ee4\u3001Match \u5757\u548c\u53d1\u884c\u7248\u7247\u6bb5\u53ef\u80fd\u8986\u76d6\u76f4\u89c9\u3002\u6d4b\u8bd5\u65b0\u8d26\u53f7\u767b\u5f55\u3001\u9519\u8bef\u5bc6\u94a5\u62d2\u7edd\u3001\u5bc6\u7801\u62d2\u7edd\u3001root \u62d2\u7edd\u4ee5\u53ca sudo \u6210\u529f，\u5e76\u4fdd\u5b58\u4e00\u4e2a\u63a7\u5236\u53f0\u6062\u590d\u5165\u53e3\u3002<\/p>\n

\u8eab\u4efd\u8fb9\u754c\u5efa\u7acb\u540e，\u5e94\u7528\u4e0d\u5e94\u9760 nohup \u6216\u7ba1\u7406\u5458\u7684\u7ec8\u7aef\u7ef4\u6301\u3002\u4e0b\u4e00\u7bc7\u4f1a\u521b\u5efa\u72ec\u7acb\u670d\u52a1\u7528\u6237，\u7528 systemd \u63cf\u8ff0\u4f9d\u8d56\u3001\u91cd\u542f\u3001\u8d44\u6e90\u9650\u5236\u3001\u65e5\u5fd7\u548c\u5b9a\u65f6\u5668\u3002<\/p>\n

\u53c2\u8003\u6765\u6e90<\/h3>\n