伺服器如何啟動jar包，部署介面
假設現在有兩臺伺服器client1，client2，他們直接不能直接相互通訊，但是他們均能連線上第三臺伺服器balance，我們可以在client1，client2和balance三臺機器之間建立ssh隧道來讓client1和client2實現通訊。
ssh埠轉發有三種實現方式：本地轉發，遠端轉發，和動態轉發。
定義簡稱：發起請求的伺服器(簡稱"startServer")，最終目標伺服器(簡稱“targetServer”)，連線startServer和targetServer的伺服器(簡稱“bridgeServer”)
一. 準備工作
實現目標: startServer能訪問bridgeServer但不能直接訪問targetServer，bridgeServer可以訪問targetServer；startServer通過bridgeServer做埠轉發可以間接訪問targetServer。
1.1 伺服器IP：
startServer：伺服器guangzhou-IP 106.55.241.99
targetServer：伺服器new2-IP 106.55.171.53
bridgeServer：伺服器balance-IP 124.156.143.168
1.2 伺服器間通訊狀態
伺服器guangzhou：
#可訪問new2
[root@guangzhou ~]# telnet 106.55.171.53 22
Trying 106.55.171.53...
Connected to 106.55.171.53.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4
#可訪問balance
[root@guangzhou ~]# telnet 124.156.143.168 22
Trying 124.156.143.168...
Connected to 124.156.143.168.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4
伺服器balance：
#可訪問new2
[root@Balance ~]# telnet 106.55.241.99 22 Trying 106.55.241.99... Connected to 106.55.241.99. Escape character is '^]'. SSH-2.0-OpenSSH_7.4
現在上new2防火牆新增禁止guangzhou訪問並重啟firewalld服務：
[root@new2 ~]# firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address="106.55.241.99" drop'
success
[root@new2 ~]# firewall-cmd --reload
success
登陸guangzhou伺服器執行命令: telnet 106.55.171.53 22，結果無響應，說明防火牆禁止訪問設定成功。
目前guangzhou無法直連new2，可連線balance，balance可連線new2.
二. 配置埠轉發
2.1 本地轉發
命令：-L localport:remotehost:remotehostport sshserver
說明：localport 本機開啟的埠號
remotehost 最終連線機器的IP地址
remotehostport 轉發機器的埠號
sshserver 轉發機器的IP地址
# -L startServerIp:targetServerIp:targetServerPort bridgeServerUser@bridgeServerIp
[root@guangzhou ~]# ssh -L 9001:106.55.171.53:22 [email protected] [email protected]'s password: Last failed login: Thu Oct 8 19:29:00 CST 2020 from 61.135.223.109 on ssh:notty There were 8 failed login attempts since the last successful login. Last login: Thu Oct 8 19:26:38 2020 from 106.55.241.99 [root@Balance ~]#
新開視窗開啟guangzhou伺服器：
[root@guangzhou ~]# ssh -p 9001 [email protected]
The authenticity of host '[127.0.0.1]:9001 ([127.0.0.1]:9001)' can't be established.
ECDSA key fingerprint is SHA256:huOuuKbfM9TN6+rpCMjB2Hk0HI4GSF1WCj7gIVyu48I.
ECDSA key fingerprint is MD5:0f:55:88:04:62:82:fc:8b:6a:f5:9e:5c:56:e1:0b:cc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[127.0.0.1]:9001' (ECDSA) to the list of known hosts.
[email protected]'s password:
Last failed login: Thu Oct 8 19:29:28 CST 2020 from 213.154.70.102 on ssh:notty
There were 832 failed login attempts since the last successful login.
Last login: Thu Oct 8 18:41:46 2020 from 106.55.241.99
[root@new2 ~]#
上面可見後面新開視窗通過訪問9001埠可以連線上new2伺服器。
2.2 遠端轉發
命令：-R sshserverport:remotehost:remotehostport sshserver
說明：sshserverport 被轉發機器開啟的埠號
remotehost 最終連線機器的IP地址
remotehostport 被轉發機器的埠號
sshserver 被轉發機器的IP地址
#balance伺服器上開啟埠轉發服務
# -R startServerPort:targetServerIp:targetServerPort -fN startServerIp
[root@Balance ~]# ssh -R 9100:106.55.171.53:22 -fN 106.55.241.99 [email protected]'s password: [root@Balance ~]#
#guangzhou伺服器上檢視balance埠轉發開啟的9100埠
[root@guangzhou ~]# ss -ntl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:27017 *:* LISTEN 0 511 *:6379 *:* LISTEN 0 128 *:9100 *:* LISTEN 0 128 *:111 *:* LISTEN 0 128 *:4369 *:* LISTEN 0 128 *:22 *:* LISTEN 0 80 :::3306 :::* LISTEN 0 511 :::6379 :::* LISTEN 0 128 :::111 :::* LISTEN 0 128 :::4369 :::* #連線9100埠，確認可以連線上new2伺服器
[root@guangzhou ~]# ssh -p 9100 [email protected] The authenticity of host '[127.0.0.1]:9100 ([127.0.0.1]:9100)' can't be established. ECDSA key fingerprint is SHA256:huOuuKbfM9TN6+rpCMjB2Hk0HI4GSF1WCj7gIVyu48I. ECDSA key fingerprint is MD5:0f:55:88:04:62:82:fc:8b:6a:f5:9e:5c:56:e1:0b:cc. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[127.0.0.1]:9100' (ECDSA) to the list of known hosts. [email protected]'s password: Last failed login: Fri Oct 9 11:28:02 CST 2020 from 61.7.235.211 on ssh:notty There were 3 failed login attempts since the last successful login. Last login: Fri Oct 9 11:26:16 2020 from 117.136.79.20 [root@new2 ~]#
遠端轉發就是做了一層請求代理服務，將指定客戶端IP和客戶端埠的請求轉發到指定第三方伺服器IP和埠。
2.3動態轉發
命令：-D localhost:localport -fN sshserver
# -D startServerPort -fN bridgeServerIp
#guangzhou伺服器上關掉所有ssh連線
[root@guangzhou ~]# killall ssh
[root@guangzhou ~]# ssh -D 9200 -fN 124.156.143.168
[email protected]'s password:
[root@guangzhou ~]# curl --socks5 127.0.0.1:9200 http://106.55.171.53
hello~
以上通過設定guangzhou伺服器9200埠轉發已經可以正常請求new2伺服器上的web服務。
三.使用實踐
假設guangzhou伺服器訪問new2伺服器的mysql服務，mysql埠為3306，同之前一樣new2防火牆增加IP禁止guangzhou訪問。
以下是php實現的例子。
#guangzhou伺服器使用9001埠通過balance連線new2的3306埠，這裡以本地轉發為例
[root@guangzhou ~]# ssh -L 9001:106.55.171.53:3306 [email protected]
[email protected]'s password:
Last failed login: Fri Oct 9 16:10:57 CST 2020 from 124.65.143.22 on ssh:notty
There were 476 failed login attempts since the last successful login.
Last login: Fri Oct 9 15:49:20 2020 from 117.136.79.20
#guangzhou伺服器新開視窗mysql命令列連結測試下
[root@guangzhou ~]# mysql -h127.0.0.1 -P9001 -utest1 -p123456
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 19
Server version: 10.2.31-MariaDB-log MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>
[root@guangzhou ~]# cat pdo.php
<?php
$host = "127.0.0.1";
$port = "9001";
$username = "root";
$password = "123456";
$dbname = "test";
$charset = "utf8mb4";
$dsn = "mysql:dbname=$dbname;host=$host";
try{
$pdo = new Pdo($dsn, $username, $password);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // 設定sql語句查詢如果出現問題 就會丟擲異常
set_exception_handler("cus_exception_handler");
} catch(PDOException $e){
die("連線失敗: ".$e->getMessage());
}
function cus_exception_handler($e)
{
die("sql 異常: ".$e->getMessage());
}
//查詢資料
$state = $pdo->query("select * from home limit 1");
// query執行一條SQL語句，如果通過，則返回一個PDOStatement物件,可以直接遍歷這個返回的記錄集 (query用於select)
$res = $state->fetch(PDO::FETCH_ASSOC); // 獲取結果集中的一行資料
print_r($res);
[root@guangzhou ~]# php pdo.php
Array
(
[home_id] => 34
[profile] => test
[scope] => no
[product] => no
[cooperate] => no
[extension] => n
)
| 優點 | 缺點 | |
| 本地轉發 | 不用佔用bridgeServer機器上新開埠(預設使用22埠) | 佔用startServer埠，bridgeServer的IP+埠，更換startServer後需要再次執行ssh命令 |
| 遠端轉發 | 不限制startServer的IP，bridgeServer執行一次可一直使用轉發服務 | 需要bridgeServer持續提供服務的話要啟用常住程序，佔用bridgeServer機I/O資源 |
| 動態轉發 | 不需要bridgeServer提供常住程序服務，無需bridgeServer和targetServer指定埠 | 需要startServer佔用埠，更換startServer後需要再次執行ssh命令 |
總的來說，三種轉發各有優缺點，本地轉發和遠端轉發需要時刻保證ssh隧道可用，動態轉發則不需要，可以按照自己需求設定即可。
至此，三種ssh埠轉發方式實踐完畢。