Ubuntu Server SSH详解：从入门到企业级部署（2025实战版）

# 监听地址和端口
Port 22
ListenAddress 0.0.0.0

# 协议版本
Protocol 2

# 最大并发连接数
MaxSessions 10

# 登录相关设置
LoginGraceTime 60
PermitRootLogin no
StrictModes yes
MaxAuthTries 3

# 用户访问控制
AllowUsers admin deployer backup
AllowGroups ssh-users

# 会话保持
ClientAliveInterval 300
ClientAliveCountMax 2

sudo systemctl reload ssh

Port 22222

# 禁用 SSHv1
Protocol 2

# 配置密钥交换算法
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384

# 配置加密算法
Ciphers aes256-ctr,aes192-ctr,aes128-ctr

# 配置 MAC 算法
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# 禁止 root 登录
PermitRootLogin no

# 限制可登录用户
AllowUsers admin deployer

# 限制可登录用户组
AllowGroups ssh-users

# 设置最大认证尝试次数
MaxAuthTries 3

# 允许 SSH 连接（假设使用端口 22222）
sudo ufw allow 22222/tcp

# 启用防火墙
sudo ufw enable

# 查看规则状态
sudo ufw status

# 只允许特定 IP 段访问 SSH
sudo ufw allow from 192.168.1.0/24 to any port 22222

# 或针对单个 IP
sudo ufw allow from 203.0.113.5 to any port 22222

# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

# 生成 Ed25519 密钥对（客户端）
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519 -C "2025-workstation"

# 生成 4096 位 RSA 密钥（兼容性考虑）
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -C "legacy-support"

# 监听多个端口（包括标准端口用于内部网络）
Port 22
Port 22222
Port 22223

# 不同端口绑定不同地址
ListenAddress 192.168.1.10:22
ListenAddress 0.0.0.0:22222

# 服务器端密钥权限
sudo chmod 600 /etc/ssh/ssh_host_*
sudo chown root:root /etc/ssh/ssh_host_*

# 用户目录权限
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown $USER:$USER ~/.ssh/authorized_keys

# 查看认证失败
sudo grep "Failed password" /var/log/auth.log

# 查看认证成功
sudo grep "Accepted" /var/log/auth.log

# 实时监控登录尝试
sudo tail -f /var/log/auth.log | grep --line-buffered "ssh"

# 实验性配置，添加量子抵抗算法
KexAlgorithms sntrup761x25519-sha512@openssh.com

# 短期证书，需频繁更新
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub

# /etc/ssh/sshd_config
# 优先使用 AES-NI 硬件加速的算法
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-ctr

# 优化密钥交换算法
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

# 优化 MAC 算法
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com

# 客户端配置 ~/.ssh/config
Host *
    ControlMaster auto
    ControlPath ~/.ssh/control-%r@%h:%p
    ControlPersist 4h
    ServerAliveInterval 60
    ServerAliveCountMax 10

# /etc/ssh/sshd_config
ClientAliveInterval 60
ClientAliveCountMax 10
MaxSessions 20

# 客户端配置 ~/.ssh/config
Host slow-connection
    Compression yes
    CompressionLevel 6
    IPQoS 0x00

# /etc/ssh/sshd_config
# 限制每个用户的最大连接数
MaxStartups 10:30:100
MaxSessions 10

# 限制内存使用
# 在 /etc/systemd/system/ssh.service.d/limits.conf
[Service]
MemoryMax=500M

# /etc/sysctl.d/10-ssh-optimization.conf
# 增大 TCP 缓冲区大小
net.ipv4.tcp_rmem = 4096 65536 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# 启用 TCP 窗口缩放
net.ipv4.tcp_window_scaling = 1

# 优化拥塞控制
net.ipv4.tcp_congestion_control = cubic

# 加快重复连接
net.ipv4.tcp_slow_start_after_idle = 0

sudo sysctl -p /etc/sysctl.d/10-ssh-optimization.conf

# 查看当前 SSH 连接
sudo ss -tnp | grep :22
sudo netstat -tnp | grep :22

# 查看 SSH 进程资源使用
ps aux | grep sshd
top -p $(pgrep -d',' sshd)

# 查看系统负载
cat /proc/loadavg

# 临时提高日志级别
sudo systemctl stop ssh
sudo /usr/sbin/sshd -d -p 22222

# 配置文件中永久设置
# /etc/ssh/sshd_config
LogLevel VERBOSE

# 检查认证各阶段耗时
grep "debug1" /var/log/auth.log | grep -E "(key exchange|user authentication)"

# 测试加密吞吐量
dd if=/dev/zero bs=1M count=100 | ssh user@host "cat > /dev/null"

# 测试 SCP 传输速度
scp largefile.dat user@host:/tmp/

# 对比不同加密算法性能
ssh -Q cipher | while read cipher; do
    echo "Testing $cipher"
    ssh -c $cipher user@host "dd if=/dev/zero bs=1M count=100 2>/dev/null" | \
    dd of=/dev/null bs=1M count=100 2>&1 | grep bytes
done

# 使用 SSH 证书颁发机构 (CA)
# 1. 创建主机 CA 和用户 CA
ssh-keygen -t ed25519 -f ~/.ssh/host_ca -C "SSH Host CA 2025"
ssh-keygen -t ed25519 -f ~/.ssh/user_ca -C "SSH User CA 2025"

# 2. 配置服务器信任主机 CA
# /etc/ssh/sshd_config
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
TrustedUserCAKeys /etc/ssh/user_ca.pub

# 3. 为用户签发证书
ssh-keygen -s ~/.ssh/user_ca -I "user@company" -n user1,user2 -V +52w user_id_ed25519.pub

# 跳板机 SSH 配置
# /etc/ssh/sshd_config
AllowTcpForwarding yes
X11Forwarding no
PermitTunnel no
GatewayPorts no
AllowUsers bastion-user
PermitOpen 192.168.1.0/24:22

# 客户端通过跳板机访问内网服务器
# ~/.ssh/config
Host internal-*
    ProxyJump bastion-user@bastion.company.com
    User internal-user

Host internal-web01
    HostName 192.168.1.10

Host internal-db01
    HostName 192.168.1.20

# Ansible playbook 示例 - ssh-hardening.yml
- name: Harden SSH configuration
  hosts: all
  become: yes
  vars:
    ssh_port: 22222
    ssh_admin_users: ["admin", "deployer"]
  tasks:
    - name: Update sshd_config
      template:
        src: sshd_config.j2
        dest: /etc/ssh/sshd_config
        owner: root
        group: root
        mode: 0644
      notify: restart ssh

    - name: Ensure SSH service is running
      service:
        name: ssh
        state: started
        enabled: yes

  handlers:
    - name: restart ssh
      service:
        name: ssh
        state: restarted

# 使用 SSH 代理转发安全地管理凭据
# 1. 启动代理并添加密钥
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# 2. 在 Jenkins/GitLab Runner 等 CI 环境中安全使用
#!/bin/bash
ssh-add -l > /dev/null
if [ $? -ne 0 ]; then
    echo "No SSH key available"
    exit 1
fi

# 3. 部署脚本示例
ssh -o StrictHostKeyChecking=accept-new deploy@server "cd /app && git pull && docker-compose up -d"

# Dockerfile 最佳实践
FROM ubuntu:24.04

# 安装 SSH 用于调试（生产环境不推荐）
RUN apt-get update && apt-get install -y openssh-server && \
    mkdir /var/run/sshd && \
    echo 'root:temp' | chpasswd && \
    # 重要：删除敏感文件
    rm -rf /etc/ssh/ssh_host_*_key*

# 使用非特权用户
RUN useradd -m -s /bin/bash debug-user
USER debug-user

# 在 Kubernetes 中通过 Sidecar 提供 SSH 访问

# Kubernetes Pod 配置
apiVersion: v1
kind: Pod
metadata:
  name: app-with-ssh
spec:
  containers:
  - name: app
    image: myapp:latest
  - name: ssh-sidecar
    image: linuxserver/openssh-server:latest
    volumeMounts:
    - name: ssh-config
      mountPath: /config
    env:
    - name: PUID
      value: "1000"
    - name: PGID
      value: "1000"
    - name: TZ
      value: "Europe/London"
    - name: PUBLIC_KEY
      value: "ssh-ed25519 AAAAC3Nz..."
  volumes:
  - name: ssh-config
    emptyDir: {}

# 使用 script 命令记录完整会话
# /etc/bash.bashrc 或 /etc/profile.d/audit.sh
if [ "$PS1" ]; then
    # 创建审计目录
    AUDIT_DIR=/var/log/ssh-audit
    mkdir -p $AUDIT_DIR
    # 启动会话记录
    script -q -a $AUDIT_DIR/$(date +%Y%m%d_%H%M%S_$$).log
fi

# 使用 rsyslog 转发 SSH 日志
# /etc/rsyslog.d/20-ssh.conf
module(load="imfile")
input(type="imfile" File="/var/log/auth.log" Tag="ssh")
action(type="omfwd" Protocol="tcp" Target="siem.company.com" Port="514")

#!/bin/bash
# ssh-compliance-check.sh

# CIS Benchmark 检查项
check_password_authentication() {
    if grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
        echo "PASS: Password authentication disabled"
        return 0
    else
        echo "FAIL: Password authentication enabled"
        return 1
    fi
}

check_root_login() {
    if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
        echo "PASS: Root login disabled"
        return 0
    else
        echo "FAIL: Root login enabled"
        return 1
    fi
}

# 执行所有检查
check_password_authentication
check_root_login
# ... 更多检查项

# 未来的 SSH 配置可能包含
KexAlgorithms sntrup761x25519-sha512@openssh.com,kyber768x25519-sha512@openssh.com
Ciphers aes256-gcm@openssh.com-aes256-gcm@openssh.com-pqc-sntrup761x25519-sha512@openssh.com

# 未来的生物识别 SSH 配置可能支持
AuthenticationMethods publickey:biometric
HostKeyAlgorithms ssh-ed25519-sk,ssh-rsa-sk