Useful Commands/Security: Difference between revisions

From Fundamental Ramen
Jump to navigation Jump to search
No edit summary
No edit summary
Line 18: Line 18:
</source>
</source>
|-
|-
| 從外面間接進來 ||
| Indirect incoming ||
效果會因為 sshd_config 的 GatewayPorts 而有差異
<source lang="text">
<source lang="text">
[GatewayPorts no]: bind 127.0.0.1 (預設)
# Listen server:13306 -> server:22
home-nas -> home-nas:60080 -> home-nas:22 -> office-pc:## -> 192.168.1.100:80
                      -> localhost:3396
[GatewayPorts yes]: bind 0.0.0.0
ssh -NCfR 13306:localhost:3306 server
    Any -> home-nas:60080 -> home-nas:22 -> office-pc:## -> 192.168.1.100:80
</source>
在 office-pc 執行這指令
<source lang="bash">
ssh -NCfR 60080:192.168.1.100:80 home-nas
</source>
如果 GatewayPorts no 可以在回家時加上正向穿隧進行兩段穿隧
<source lang="bash">
ssh -NCfL 61180:localhost:60080 home-nas
</source>
如果搭配 autossh 會更好用
<source lang="bash">
autossh -M 11119 -NCfR 60080:192.168.1.100:80 home-nas
</source>
</source>
|-
|-

Revision as of 05:32, 21 February 2019

情境 指令
Indirect Outgoing
# [Private]
# localhost -> localhost:8888
#           -> server:22
#           -> somewhere.com:80
ssh -NCfL 127.0.0.1:8888:somewhere.com:80 server

# [Shared]
# any -> *:8888
#     -> server:22
#     -> somewhere.com:80
ssh -NCfL *:8888:somewhere.com:80 server
Indirect incoming
# Listen server:13306 -> server:22
                      -> localhost:3396
ssh -NCfR 13306:localhost:3306 server
SOCKS Relay Proxy
# [Private]
# localhost -> localhost:3128
#     -> server:22
#     -> *:*
ssh -NCfD localhost:3128 server

# [Shared]
# any -> *:3128
#     -> server:22
#     -> *:*
ssh -NCfD *:3128 server
List tunnels
# List full commands.
ps ax | awk '/ssh \-NCf/ { print $0 }'

# List settings.
ps ax | awk '/ssh \-NCf/ { print $7 }'

# List pids.
ps ax | awk '/ssh \-NCf/ { print $1 }'

# Kill all tunnels.
kill $(ps ax | awk '/ssh \-NCf/ { print $1 }')
Generate key pair
# Save as default name id_rsa, id_rsa.pub
ssh-keygen
# Save as thefuck, thefuck.pub without password
ssh-keygen -f abc -N ''
# Save as thefuck, thefuck.pub with password 
ssh-keygen -f abc -N '12345'
Generate public key from private key
# Dump
ssh-keygen -yf thefuck.pem
# Save as file
ssh-keygen -yf thefuck.pem > thefuck.pub
# Save as authorized_keys (while ~/.ssh/authorized_keys didn't exist)
ssh-keygen -yf thefuck.pem > authorized_keys
# Append into authorized_keys
ssh-keygen -yf thefuck.pem >> authorized_keys