Linux SSH 远程连接——密钥免密登录与 scp/rsync 传文件

奥黛丽·逐爱者
2026-07-15 / 0 评论 / 6 阅读 / 正在检测是否收录...

大家好,我是冯哥的缓存。

前几篇我们把Shell配置好了、脚本会写了、函数库建好了、dotfiles 也能一键同步了。

接下来聊一个使用频率极高的技能:SSH 远程连接

不管是:

·在家远程连公司或云服务器

·在办公室操控实验室的 Linux 机器

·把文件从 A 机器传到 B 机器

·通过跳板机登录内网服务器

…… 都离不开 SSH。而且,如果每次连服务器还在手动输密码,看完这篇之后也许会觉得"那真的是在浪费时间"

一、SSH 是什么,工作原理简介

1.1 用一句话解释 SSH

SSHSecure Shell)是一种加密的远程登录协议,可以在本机的终端里操控另一台机器,就像坐在那台机器面前一样,几乎所有远程操作都离不开它。

和远程桌面(VNCRDP)的区别:

·SSH是纯命令行界面,速度快、带宽占用极小

·远程桌面是图形界面,方便但需要更多资源

1.2 两种登录方式

<p style="text-align:center;mso-pagination:
widow-orphan;">方式

<p style="text-align:center;mso-pagination:
widow-orphan;">原理

<p style="text-align:center;mso-pagination:
widow-orphan;">安全性

<p style="text-align:center;mso-pagination:
widow-orphan;">使用便利性

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;mso-bidi-font-weight:bold;">密码登录

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">每次输入密码

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">有被暴力破解的风险

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">方便但烦人

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;mso-bidi-font-weight:bold;">密钥登录

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">本机有私钥,服务器有公钥,验证成对关系

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">极高(私钥不出本机)

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">一次配好,以后免密

💡<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">提示:
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">密钥登录不仅更安全,也更方便——配好以后 ssh服务器名<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">一秒连上,不用每次输密码。

二、生成 SSH密钥对

2.1 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">生成密钥

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">ssh-keygen -t ed25519 -C 
"<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">我的工作机 2026"

<p style="text-align:center;mso-pagination:
widow-orphan;">参数

<p style="text-align:center;mso-pagination:
widow-orphan;">说明

-t ed25519

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">使用 Ed25519 算法(现代、安全、生成快,推荐)

-C "<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">注释"

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">给密钥加一个注释,帮助识别是哪台机器生成的

执行后会有两次提示:

Enter file in which to save the key (/home/用户名/.ssh/id_ed25519):

直接回车<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">,使用默认路径。

Enter passphrase (empty for no passphrase):

这里有两个选择:

<span style="font-size:10.0pt;mso-bidi-font-size:12.0pt;font-family:Symbol;mso-fareast-font-family:Symbol;mso-bidi-font-family:Symbol;mso-font-kerning:
0pt;">·<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">直接回车
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">(不设密码短语):最方便,以后连接完全免密,但私钥文件被盗后无任何保护

<span style="font-size:10.0pt;mso-bidi-font-size:12.0pt;font-family:Symbol;mso-fareast-font-family:Symbol;mso-bidi-font-family:Symbol;mso-font-kerning:
0pt;">·<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">设一个密码短语
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">(推荐):私钥被盗也需要知道密码短语才能用,安全性更高;结合 ssh-agent<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">可以只输一次密码

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">注意:
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">这个"密码短语"不是远程服务器的密码,是用来保护本地私钥文件的。作为新手,可以先不设密码短语,等熟悉了再重新生成带密码短语的密钥。

完成后会生成两个文件:

~/.ssh/

├── id_ed25519私钥(绝不能泄露!)

└── id_ed25519.pub<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">公钥(可以随意分发)

2.2 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">查看公钥

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">cat
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> ~/.ssh/id_ed25519.pub

输出类似这样:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... <span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:#3B3B3B;mso-font-kerning:
0pt;">我的工作机 2026

这串内容就是公钥,后面需要把它放到服务器上。

2.3 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">旧算法说明

如果看到有人用<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">ssh-keygen -t rsa -b 4096<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">,这是 RSA 4096 位密钥,也安全,但生成慢、文件大。新系统建议直接用 ed25519,速度快、安全性更高。

三、把公钥上传到服务器

有两种方法:

3.1 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">方法一:
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">ssh-copy-id
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">(推荐,最简单)

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">ssh-copy-id 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">用户名@服务器IP

输入一次服务器密码,公钥就自动写入服务器的~/.ssh/authorized_keys<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">了。

以后再连就不需要密码了:

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">ssh 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">用户名@服务器IP<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">直接连上,不需要密码

3.2 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">方法二:手动复制(没有 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">ssh-copy-id
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">时)

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">公钥内容打印出来

cat<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> ~/.ssh/id_ed25519.pub

然后 SSH 登录到服务器(用密码),执行:

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">#
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">在服务器上执行

mkdir<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> -p ~/.ssh

chmod<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> 700 ~/.ssh

nano ~/.ssh/authorized_keys

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">把公钥内容粘贴进去,保存

chmod<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> 600 ~/.ssh/authorized_keys

3.3 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">权限要求(重要)

SSH <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">对权限非常敏感,权限不对会拒绝认证:

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">路径

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">正确权限

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">含义

~/.ssh/

700

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">只有自己能读写执行

~/.ssh/authorized_keys

600

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">只有自己能读写

~/.ssh/id_ed25519<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">(私钥)

600

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">只有自己能读写

~/.ssh/id_ed25519.pub<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">(公钥)

644

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">自己可读写,其他人只读

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">注意:
 ~/.ssh/config <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">文件建议设为 600,否则 SSH 可能忽略该配置。如果配置完密钥想测试 GitHub 连接,用 ssh -T git@github.com,看到 Hi username! 就说明成功了。

修复权限命令:

chmod<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> 700 ~/.ssh

chmod<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> 600 ~/.ssh/authorized_keys

chmod<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> 600 ~/.ssh/id_ed25519

四、<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">~/.ssh/config
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">配置文件——最被忽视的利器

很多人学会密钥登录之后就停在ssh用户名@192.168.1.100<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">这一步了。其实只要配置好 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">~/.ssh/config<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">,可以做到 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">ssh 
服务器别名<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">一条命令直接连
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">

4.1 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">基本格式

在本机创建(或编辑)<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">~/.ssh/config<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">nano ~/.ssh/config

基本格式:

Host <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">别名

HostName <span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:#3B3B3B;mso-font-kerning:0pt;">服务器IP或域名

User 用户名

Port 22

IdentityFile ~/.ssh/id_ed25519

实际例子:

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">家里的树莓派

Host pi

HostName 192.168.1.200

User pi

Port 22

IdentityFile ~/.ssh/id_ed25519

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">阿里云服务器

Host aliyun

HostName 47.100.xxx.xxx

User ubuntu

Port 22

IdentityFile ~/.ssh/id_aliyun

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">公司服务器(非标准端口)

Host office

HostName 10.0.0.50

User fengge

Port 2222

IdentityFile ~/.ssh/id_ed25519

配置好之后,连接只需要:

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">ssh pi
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">连家里树莓派

ssh aliyun<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">连阿里云

ssh office<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">连公司服务器

4.2 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">常用配置选项说明

<p style="text-align:center;mso-pagination:
widow-orphan;">配置项

<p style="text-align:center;mso-pagination:
widow-orphan;">说明

<p style="text-align:center;mso-pagination:
widow-orphan;">例子

Host

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">别名(自己取的名字)

Host myserver

HostName

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">真实 IP 或域名

HostName 192.168.1.100

User

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">登录用的用户名

User ubuntu

Port

SSH <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">端口(默认22

Port 2222

IdentityFile

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">使用哪个私钥

IdentityFile ~/.ssh/id_work

ServerAliveInterval

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">多少秒发一次心跳(防止断连)

ServerAliveInterval 60

ServerAliveCountMax

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">心跳失败多少次后断开

ServerAliveCountMax 3

ForwardAgent

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">是否转发本地 ssh-agent(跳板机用)

ForwardAgent yes

防断连配置(推荐加):

Host

ServerAliveInterval 60

ServerAliveCountMax 3

Host <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">表示对所有连接都生效。加上这两行,服务器空闲时会每 60 秒发一次心跳包,不会因为长时间不操作就断连。

五、scp——最简单的文件传输

5.1 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">基本用法

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">本机文件传到服务器

scp <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">本地文件路径 用户名@服务器IP:远程路径

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">把服务器文件下载到本机

scp <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">用户名@服务器IP:远程文件路径 本地路径

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">传整个目录(加 -r

scp -r <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">本地目录 用户名@服务器IP:远程路径

5.2 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">实际例子

以下命令中的aliyunpi 都是前面在 ~/.ssh/config 里配置的别名。

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">传单个文件

scp ~/documents/report.pdf ubuntu@47.100.xxx.xxx:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">上传整个目录

scp -r ~/projects/myapp ubuntu@47.100.xxx.xxx:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">下载服务器上的日志文件

scp ubuntu@47.100.xxx.xxx:/var/log/nginx/access.log ~/Downloads/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">使用 config 里的别名(更简洁)

scp report.pdf aliyun:~/<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">上传

scp aliyun:~/access.log ~/Downloads/<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">下载

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">在两台服务器之间传文件

scp aliyun:/data/db.sql pi:~/backups/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">注意:
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">新版 OpenSSH 已将 scp 标记为废弃,推荐逐步迁移到 rsync  sftp。但如果只是简单传一两个文件,scp 仍然够用。

5.3 scp <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">的限制

scp<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">简单好用,但有一个明显的缺点——每次都全量传输,不管文件有没有变化。传大文件或经常同步目录时,效率很低。这时候用 rsync<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">更好。

六、rsync——更聪明的同步工具

6.1 rsync <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">是什么

rsync <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">是一个增量同步工具:

<span style="font-size:10.0pt;mso-bidi-font-size:12.0pt;font-family:Symbol;mso-fareast-font-family:Symbol;mso-bidi-font-family:Symbol;mso-font-kerning:
0pt;">·<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">只传有变化的部分
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">,不重传没变的文件

<span style="font-size:10.0pt;mso-bidi-font-size:12.0pt;font-family:Symbol;mso-fareast-font-family:Symbol;mso-bidi-font-family:Symbol;mso-font-kerning:
0pt;">·支持断点续传

<span style="font-size:10.0pt;mso-bidi-font-size:12.0pt;font-family:Symbol;mso-fareast-font-family:Symbol;mso-bidi-font-family:Symbol;mso-font-kerning:
0pt;">·可以删除目标目录里源目录没有的文件(<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">--delete选项)

<span style="font-size:10.0pt;mso-bidi-font-size:12.0pt;font-family:Symbol;mso-fareast-font-family:Symbol;mso-bidi-font-family:Symbol;mso-font-kerning:
0pt;">·本地目录之间、本机和远程之间都可以用

6.2 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">基础语法

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">rsync 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">选项 源路径 目标路径

最常用的选项组合:

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">rsync -avz 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">源路径 目标路径

<table style="mso-cellspacing:
1.5pt;mso-table-layout-alt:fixed;border:solid #EBEBEB 1.0pt;mso-border-alt:
solid #EBEBEB .75pt;mso-yfti-tbllook:1184;"><p style="text-align:center;mso-pagination:
widow-orphan;">选项

<p style="text-align:center;mso-pagination:
widow-orphan;">说明

-a

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">归档模式(保留权限、时间戳、软链接等,等价于 -rlptgoD

-v

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">显示传输进度

-z

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">传输时压缩(网络慢时有效,本地同步不需要)

-P

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">显示进度条 + 断点续传(--progress --partial 的合并)

--delete

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">删除目标目录中源目录没有的文件(镜像同步)

--exclude

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">排除某些文件

-n <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;"> --dry-run

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">模拟运行,不真正传输(预览用)

6.3 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">实际例子

把本<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">地目录同步到服务器

rsync -avz ~/projects/myapp ubuntu@47.100.xxx.xxx:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">使用 config 别名(更简洁)

rsync -avz ~/projects/myapp aliyun:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">从服务器下载到本地

rsync -avz aliyun:~/data/backup/ ~/backups/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">镜像同步(删除目标中多余的文件)

rsync -avz --delete ~/projects/myapp aliyun:~/myapp/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">排除某些目录

rsync -avz --exclude '.git/'<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> --exclude <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">'node_modules/'<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> ~/myapp aliyun:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">先模拟看看会传哪些文件

rsync -avz --dry-run ~/myapp aliyun:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">本地目录之间同步(不涉及远程,不用加 -z

rsync -av ~/documents/ /mnt/backup/documents/

6.4 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">路径末尾斜杠的陷阱

rsync <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">对路径末尾有没有 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">/的处理完全不同,这是新手最容易踩的坑:

<p style="text-align:center;mso-pagination:
widow-orphan;">命令

<p style="text-align:center;mso-pagination:
widow-orphan;">效果

rsync -av ~/myapp aliyun:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;"> myapp 目录本身传过去,结果是 ~/myapp/

rsync -av ~/myapp/   aliyun:~/myapp/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;"> myapp 里面的内容传过去,不会创建多余一层目录

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">注意:
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">简单记法——源路径加 /<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">表示传内容,不加 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">/
表示传目录本身<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">。如果不确定,先用 rsync -avn 预览一下,看到结果符合预期再执行。

七、跳板机配置(ProxyJump

7.1 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">什么是跳板机

在很多公司或家庭内网环境里,内网服务器不能直接从外网访问,需要先 SSH 到一台"跳板机"(也叫堡垒机),再从跳板机跳到内网机器。

传统做法(很麻烦):

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">连跳板机

ssh <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">用户名@跳板机IP

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">在跳板机上再连内网机器

ssh <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">用户名@内网机器IP

7.2 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;"> ProxyJump 一步到位

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">~/.ssh/config<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">里配置:

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">跳板机

Host jumpserver

HostName <span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:#3B3B3B;mso-font-kerning:0pt;">跳板机公网IP

User 用户名

IdentityFile ~/.ssh/id_ed25519

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">内网目标机器

Host internal

HostName 192.168.0.100

User admin

IdentityFile ~/.ssh/id_ed25519

ProxyJump jumpserver通过 jumpserver 跳转

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">注意:
 ProxyJump <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">需要 OpenSSH 7.3 以上版本(2016 年发布),绝大多数现代系统都支持。如果版本较老,需改用ProxyCommand

配置好之后,直接:

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">ssh internal
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">自动先连跳板机,再跳到内网机器,一步到位

scp file.txt internal:~/<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;"># scp 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">也走代理,直接传到内网机器

7.3 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">临时跳转(不改 config

# -J <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">数指定跳板机

ssh -J <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">用户名@跳板机IP 用户名@内网机器IP

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">多级跳转(先跳A,再跳B,最终连C

ssh -J <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;">用户名@A,用户名@B 用户名@C

八、ssh-agent——只输一次密码短语

如果私钥设了密码短语(推荐设置),每次 SSH 连接都要输一次会很烦。<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;mso-font-kerning:
0pt;">ssh-agent<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">可以缓存私钥,只需在每次开机/开终端后输一次密码短语,之后的连接全部免密。

# <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;"> ssh-agent(大多数桌面环境自动启动,手动启动用这个)

eval<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">"<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#24292E;mso-font-kerning:0pt;">$(ssh-agent -s)<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">"

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">把私钥加入 agent(需要输一次密码短语)

ssh-add ~/.ssh/id_ed25519

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">查看 agent 里已加载的密钥

ssh-add -l

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;"> agent 在会话结束时自动清除缓存

ssh-add -t 8h ~/.ssh/id_ed25519<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;"># 8
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">小时后自动过期

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">~/.bashrc
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">里自动加载(可选):

<span style="font-size:12.0pt;font-family:
"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:0pt;">#
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">如果 ssh-agent 没运行,自动启动

if<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> ! pgrep -u <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">"<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#001080;mso-font-kerning:0pt;">$USER<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">"<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> ssh-agent > /dev/null; <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#D73A49;mso-font-kerning:0pt;">then

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#E36209;mso-font-kerning:0pt;">eval<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">"<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#24292E;mso-font-kerning:0pt;">$(ssh-agent -s)<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#032F62;mso-font-kerning:0pt;">"

fi

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">如果 agent 里没有密钥,自动加载(会提示输密码短语)

if<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#3B3B3B;mso-font-kerning:0pt;"> ssh-add -l &>/dev/null; <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:#D73A49;mso-font-kerning:0pt;">then

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;color:green;mso-font-kerning:0pt;">
<span style="font-size:
12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:宋体;color:green;mso-font-kerning:0pt;">已有密钥,不做任何事

else

ssh-add ~/.ssh/id_ed25519 2>/dev/null

fi

九、常见问题排查

<p style="text-align:center;mso-pagination:
widow-orphan;">问题

<p style="text-align:center;mso-pagination:
widow-orphan;">可能原因

<p style="text-align:center;mso-pagination:
widow-orphan;">排查方法

Permission denied (publickey)

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">公钥没上传 / 服务器权限不对

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">检查 ~/.ssh/authorized_keys 权限是否为 600

Connection refused

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">服务器 SSH 没开   / 端口不对

ssh -p <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">端口 用户名@IP 或检查服务器 systemctl status sshd

Connection timeout

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">网络不通 / 防火墙拦截

ping IP <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">测试网络;检查服务器防火墙是否开了 22 端口

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">连上后频繁掉线

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">没有心跳包

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;"> ~/.ssh/config  ServerAliveInterval 60

WARNING: REMOTE HOST   IDENTIFICATION HAS CHANGED!

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">服务器重装过 / IP 被重用

ssh-keygen -R <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">服务器IP 删除旧的指纹,重新连接,系统会提示接受新指纹

十、实用操作速查表

密钥相关

<p style="text-align:center;mso-pagination:
widow-orphan;">操作

<p style="text-align:center;mso-pagination:
widow-orphan;">命令

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">生成密钥

ssh-keygen -t ed25519 -C "<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">注释"

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">上传公钥

ssh-copy-id <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">用户名@服务器IP

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">查看公钥

cat ~/.ssh/id_ed25519.pub

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">添加到 agent

ssh-add ~/.ssh/id_ed25519

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">查看 agent 密钥

ssh-add -l

连接相关

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;"><p style="text-align:center;mso-pagination:
widow-orphan;">命令

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

ssh <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">用户名@IP

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

ssh -p 2222 <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">用户名@IP

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

ssh <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">别名(需配置 ~/.ssh/config

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

ssh -J <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">跳板机 目标机

<td style="border:none;border-right:solid #EBEBEB 1.0pt;mso-border-right-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">删除旧指纹

<p style="text-align:center;mso-pagination:
widow-orphan;">操作

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">基本连接

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">指定端口

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">使用别名

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">跳板机

ssh-keygen -R <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">服务器IP

scp <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">传文件

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;"><p style="text-align:center;mso-pagination:
widow-orphan;">命令

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

scp <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">本地文件 别名:远程路径

<td style="border:none;border-bottom:solid #EBEBEB 1.0pt;mso-border-bottom-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

scp <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">别名:远程文件 本地路径

<td style="border:none;border-right:solid #EBEBEB 1.0pt;mso-border-right-alt:
solid #EBEBEB .75pt;padding:6.0pt 12.0pt 6.0pt 12.0pt;">

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">上传目录

<p style="text-align:center;mso-pagination:
widow-orphan;">操作

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">上传文件

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">下载文件

scp -r <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">本地目录 别名:远程路径

rsync <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">同步

<p style="text-align:center;mso-pagination:
widow-orphan;">操作

<p style="text-align:center;mso-pagination:
widow-orphan;">命令

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">同步目录到服务器

rsync -avz ~/myapp <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">别名:~/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">从服务器下载

rsync -avz <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">别名:~/data/ ~/local/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">镜像同步(删多余)

rsync -avz --delete ~/myapp/ <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">别名:~/myapp/

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">排除目录

rsync -avz --exclude '.git/' <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">源 目标

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">模拟运行预览

rsync -avz --dry-run <span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
宋体;mso-font-kerning:0pt;">源 目标

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;">注意:
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">新手记住这些命令:ssh-keygenssh-copy-idssh -Jrsync -avz 可以实现大部份的功能。

<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:
"Segoe UI";mso-font-kerning:0pt;">下篇预告: 
<span style="font-size:12.0pt;font-family:"微软雅黑","sans-serif";mso-bidi-font-family:"Segoe UI";mso-font-kerning:
0pt;"> Linux SSH 端口转发(上)——本地转发 -L 与远程转发 -R 

0

评论 (0)

取消