Ssh

// /Users/python/go/pkg/mod/golang.org/x/crypto@v0.22.0/ssh/client_auth.go

// "none" authentication, RFC 4252 section 5.2.
type noneAuth int

type passwordCallback func() (password string, err error)

type publicKeyCallback func() ([]Signer, error)

// 定义多种keyboard-challenge来提示用户输入认证的input.
type KeyboardInteractiveChallenge func(name, instruction string, questions []string, echos []bool) (answers []string, err error)

type gssAPIWithMICCallback struct {
	gssAPIClient GSSAPIClient
	target       string
}

// https://www.rfc-editor.org/rfc/rfc4250#section-4.9.1
Channel type                  Reference
------------                  ---------
session                       [SSH-CONNECT, Section 6.1]
x11                           [SSH-CONNECT, Section 6.3.2]
forwarded-tcpip               [SSH-CONNECT, Section 7.2]
direct-tcpip                  [SSH-CONNECT, Section 7.2]

     -L [bind_address:]port:host:hostport
     -L [bind_address:]port:remote_socket
     -L local_socket:host:hostport
     -L local_socket:remote_socket
             Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side.  This works by allocating
             a socket to listen to either a TCP port on the local side, optionally bound to the specified bind_address, or to a Unix socket.  Whenever a connection is made to the local port or socket, the
             connection is forwarded over the secure channel, and a connection is made to either host port hostport, or the Unix socket remote_socket, from the remote machine.

             Port forwardings can also be specified in the configuration file.  Only the superuser can forward privileged ports.  IPv6 addresses can be specified by enclosing the address in square brackets.

             By default, the local port is bound in accordance with the GatewayPorts setting.  However, an explicit bind_address may be used to bind the connection to a specific address.  The bind_address of
             “localhost” indicates that the listening port be bound for local use only, while an empty address or ‘*’ indicates that the port should be available from all interfaces.

# 创建一个本地端口，将发往该端口的所有通信都通过 SSH 服务器，转发到指定的远程服务器的端口。
ssh -L  -N -f localPort : remoteHost : remotePort  sshServer

ssh -L 9000:host2:80 host3

     -R [bind_address:]port:host:hostport
     -R [bind_address:]port:local_socket
     -R remote_socket:host:hostport
     -R remote_socket:local_socket
     -R [bind_address:]port
             Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side.

             This works by allocating a socket to listen to either a TCP port or to a Unix socket on the remote side.  Whenever a connection is made to this port or Unix socket, the connection is forwarded over
             the secure channel, and a connection is made from the local machine to either an explicit destination specified by host port hostport, or local_socket, or, if no explicit destination was specified,
             ssh will act as a SOCKS 4/5 proxy and forward connections to the destinations requested by the remote SOCKS client.

             Port forwardings can also be specified in the configuration file.  Privileged ports can be forwarded only when logging in as root on the remote machine.  IPv6 addresses can be specified by enclosing
             the address in square brackets.

             By default, TCP listening sockets on the server will be bound to the loopback interface only.  This may be overridden by specifying a bind_address.  An empty bind_address, or the address ‘*’,
             indicates that the remote socket should listen on all interfaces.  Specifying a remote bind_address will only succeed if the server's GatewayPorts option is enabled (see sshd_config(5)).

             If the port argument is ‘0’, the listen port will be dynamically allocated on the server and reported to the client at run time.  When used together with -O forward, the allocated port will be printed
             to the standard output.

# ssh -R  sshServerPort : remoteHost : remotePort  sshServer
# 命令是在内网localhost服务器上执行，建立从localhost到my.public.server的 SSH 隧道。
ssh -R 8080:localhost:80 -N my.public.server

# 命令是在 SSH 跳板机上执行的，建立跳板机到local的隧道
ssh -R 2121:my.private.server:80 -N local

     -D [bind_address:]port
             Specifies a local “dynamic” application-level port forwarding.  This works by allocating a socket to listen to port on the local side, optionally
             bound to the specified bind_address.  Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the
             application protocol is then used to determine where to connect to from the remote machine.  Currently the SOCKS4 and SOCKS5 protocols are
             supported, and ssh will act as a SOCKS server.  Only root can forward privileged ports.  Dynamic port forwardings can also be specified in the
             configuration file.

             IPv6 addresses can be specified by enclosing the address in square brackets.  Only the superuser can forward privileged ports.  By default, the
             local port is bound in accordance with the GatewayPorts setting.  However, an explicit bind_address may be used to bind the connection to a
             specific address.  The bind_address of “localhost” indicates that the listening port be bound for local use only, while an empty address or ‘*’
             indicates that the port should be available from all interfaces.

# 创建了一个SOCKS代理，去监听本地的50000端口,所以通过该SOCKS代理发出的数据包将经过host1转发出去。
ssh -D 50000 user@host1

# 使用，curl 的-x参数指定代理服务器
curl -x socks5://localhost:50000 http://www.example.com

// https://github.com/gravitational/teleport/blob/bfbc0276d4a0341f7170399a0062a2dcc5f90148/api/observability/tracing/ssh/client.go
func (c *clientWrapper) NewSession() (*Session, error) {
	// create a client that will defer to us when
	// opening the "session" channel so that we
	// can add an Envelope to the request
	client := &ssh.Client{
		Conn: c,
	}

	session, err := client.NewSession()
	if err != nil {
		return nil, trace.Wrap(err)
	}

	// wrap the session so all session requests on the channel
	// can be traced
	return &Session{
		Session: session,
		wrapper: c,
	}, nil
}

// allocateTerminal creates (allocates) a server-side terminal for this session.
func (ns *NodeSession) allocateTerminal(ctx context.Context, termType string, s *tracessh.Session) (io.ReadWriteCloser, error) {
	var err error

	// read the size of the terminal window:
	width := teleport.DefaultTerminalWidth
	height := teleport.DefaultTerminalHeight
	if ns.terminal.IsAttached() {
		realWidth, realHeight, err := ns.terminal.Size()
		if err != nil {
			log.Error(err)
		} else {
			width = int(realWidth)
			height = int(realHeight)
		}
	}

	// ... and request a server-side terminal of the same size:
	err = s.RequestPty(
		ctx,
		termType,
		height,
		width,
		ssh.TerminalModes{},
	)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	// 获取到标准输入、标准输出、标准出错和远端进行交互
	writer, err := s.StdinPipe()
	if err != nil {
		return nil, trace.Wrap(err)
	}
	reader, err := s.StdoutPipe()
	if err != nil {
		return nil, trace.Wrap(err)
	}
	stderr, err := s.StderrPipe()
	if err != nil {
		return nil, trace.Wrap(err)
	}
	if ns.terminal.IsAttached() {
		go ns.updateTerminalSize(ctx, s)
	}
	go func() {
		if _, err := io.Copy(ns.nodeClient.TC.Stderr, stderr); err != nil {
			log.Debugf("Error reading remote STDERR: %v", err)
		}
	}()
	return utils.NewPipeNetConn(
		reader,
		writer,
		utils.MultiCloser(writer, s, ns.closer),
		&net.IPAddr{},
		&net.IPAddr{},
	), nil
}

func (s *Session) RequestPty(ctx context.Context, term string, h, w int, termmodes ssh.TerminalModes) error {
	const request = "pty-req"
	config := tracing.NewConfig(s.wrapper.opts)
	tracer := config.TracerProvider.Tracer(instrumentationName)
	ctx, span := tracer.Start(
		ctx,
		fmt.Sprintf("ssh.RequestPty/%s", term),
		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
		oteltrace.WithAttributes(
			semconv.RPCServiceKey.String("ssh.Session"),
			semconv.RPCMethodKey.String("SendRequest"),
			semconv.RPCSystemKey.String("ssh"),
			attribute.Int("width", w),
			attribute.Int("height", h),
		),
	)
	defer span.End()

	s.wrapper.addContext(ctx, request)
	return trace.Wrap(s.Session.RequestPty(term, h, w, termmodes))
}

// https://github.com/gravitational/teleport/blob/f814b2d510ed38266d340ea138bc38f0b8a132f0/api/observability/tracing/ssh/session.go
func (s *Session) Run(ctx context.Context, cmd string) error {
	const request = "exec"
	config := tracing.NewConfig(s.wrapper.opts)
	ctx, span := config.TracerProvider.Tracer(instrumentationName).Start(
		ctx,
		fmt.Sprintf("ssh.Run/%s", cmd),
		oteltrace.WithSpanKind(oteltrace.SpanKindClient),
		oteltrace.WithAttributes(
			semconv.RPCServiceKey.String("ssh.Session"),
			semconv.RPCMethodKey.String("SendRequest"),
			semconv.RPCSystemKey.String("ssh"),
		),
	)
	defer span.End()

	s.wrapper.addContext(ctx, request)
	return trace.Wrap(s.Session.Run(cmd)) // 等价于先 Start 再 Wait

// golang.org/x/crypto@v0.22.0/ssh/session.go
func (s *Session) Run(cmd string) error {
	err := s.Start(cmd) // 在远端启动一个命令
	if err != nil {
		return err
	}
	return s.Wait() // 等待远端执行完成
}

// https://github.com/gravitational/teleport/blob/9ef216584cc0829334cff1f7fd15ed0a3fb7aa52/lib/srv/forward/sshserver.go
func (s *Server) newRemoteClient(ctx context.Context, systemLogin string) (*tracessh.Client, error) {
	// the proxy will use the agentless signer as the auth method when
	// connecting to the remote host if it is available, otherwise the
	// forwarded agent is used
	var signers []ssh.Signer
	if s.agentlessSigner != nil {
		signers = []ssh.Signer{s.agentlessSigner}
	} else {
		var err error
		signers, err = s.userAgent.Signers()
		if err != nil {
			return nil, trace.Wrap(err)
		}
	}
	authMethod := ssh.PublicKeysCallback(signersWithSHA1Fallback(signers))

	clientConfig := &ssh.ClientConfig{
		User: systemLogin, // 用户名，对应 ssh 命令的 ssh 用户名@xxx 用户名部分
		Auth: []ssh.AuthMethod{
			authMethod,
		},
		// SSH Server Host Key 的校验，预防 SSH 中间人攻击
		HostKeyCallback: s.authHandlers.HostKeyAuth,
		Timeout:         apidefaults.DefaultIOTimeout,
	}

	// Ciphers, KEX, and MACs preferences are honored by both the in-memory
	// server as well as the client in the connection to the target node.
	clientConfig.Ciphers = s.ciphers
	clientConfig.KeyExchanges = s.kexAlgorithms
	clientConfig.MACs = s.macAlgorithms

	// Destination address is used to validate a connection was established to
	// the correct host. It must occur in the list of principals presented by
	// the remote server.
	dstAddr := net.JoinHostPort(s.address, "0")
	client, err := tracessh.NewClientConnWithDeadline(ctx, s.targetConn, dstAddr, clientConfig)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	return client, nil
}

ssh-keygen -t ed25519 -b 4096 -C "xxxx@gmail.com" # 推荐，比 rsa 短，安全性高

# 查看ssh-agent中的密钥
ssh-add -l

ssh-copy-id -i /root/.ssh/id_dsa.pub root@180.8.5.6