如何从 Windows 上用 SSH 连接到 Linux
PuTTY SSH

> 
> 使用开源的 PuTTY 工具，从 Windows 建立到 Linux 的 SSH 连接。
> 
> 
> 


![](/data/attachment/album/202207/23/110039pjbd9jbbc84gbz2f.jpg "clouds in windows")


在 Linux 世界中，<ruby> 安全外壳 <rt>  secure shell </rt></ruby>（SSH）协议是最为常用的、通过命令行控制远程计算机的方式。SSH 是真正的 Linux 原创，但是它在 Windows 世界中也越来越流行。甚至有了一份官方的 [Windows 的 SSH 文档](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview)，那篇文档阐述了使用 [OpenSSH](https://www.openssh.com/) 控制 Windows 的方法。


这篇文章展示了如何使用了流行的开源工具 [PuTTY](https://www.putty.org/)，建立一个从 Windows 到 Fedora 33 Linux 系统的 SSH 连接。


### 使用 SSH 的方法


SSH 使用客户端-服务器模式，即 SSH 客户端会创建到 SSH 服务端的连接。SSH 服务器通常会作为<ruby> 守护进程 <rt>  Daemon </rt></ruby>运行，所以它常被称为 SSHD。你很难找到一个不自带 SSH 守护进程的 Linux 发行版。在 Fedora 33 中，已安装了 SSH 守护进程，但是并未激活。


你可以使用 SSH 控制几乎所有的 Linux 机器，无论它是作为虚拟机还是作为网络上的物理设备运行。一个常见的用例是<ruby> 无头 <rt>  headless </rt></ruby>配置的嵌入式设备，如树莓派。SSH 也可以用做一个其它网络服务的隧道。因为 SSH 连接是加密的，所以你可以使用 SSH 作为一个任何默认不提供加密的协议的传输层。


在这篇文章中，我将解释使用 SSH 的四个方式：1、如何在 Linux 端配置 SSH 守护进程；2、如何设置远程控制台连接；3、如何通过网络复制文件，4. 如何将 SSH 作为某些协议的隧道。


### 1、配置 SSHD


将 Linux 系统（文中是 Fedora 33）作为 SSH 服务器，允许 PuTTY SSH 客户端进行连接。首先，检查守护进程的 SSH 配置。配置文件放在 `/etc/ssh/sshd_config`，它包含了许多选项，通过取消掉相关行的注释就可以激活：



```
#       $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

```

没有取消任何注释的默认配置在这个示例中应该是可以工作的。要检查 SSH 守护进程是否已经运行，输入 `systemctl status sshd`：



```
$ systemctl status sshd
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2018-06-22 11:12:05 UTC; 2 years 11 months ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 577 (sshd)
    Tasks: 1 (limit: 26213)
   CGroup: /system.slice/sshd.service
           └─577 /usr/sbin/sshd -D -oCiphers=[aes256-gcm@openssh.com][5],chacha20-[...]

```

如果它处于<ruby> 未激活 <rt>  inactive </rt></ruby>状态，使用 `systemctl start sshd` 命令启动它。


### 2、设置远程控制台


在 Windows 下 [下载 PuTTY 安装程序](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)，然后安装并打开它。你应看到一个像这样的窗口：


![PuTTY configuration screen](/data/attachment/album/202207/23/110048szd6dh4pfhdd7zmm.png "PuTTY configuration screen")


在“<ruby> 主机名（或 IP 地址） <rt>  Host Name (or IP address) </rt></ruby>”输入框，键入你的 Linux 系统的连接信息。本文设置了一个 Fedora 33 虚拟机，它使用桥接网络适配器，使我可以由 IP 地址 `192.168.1.60` 连接这个系统。点击“<ruby> 打开 <rt>  Open </rt></ruby>”，应会如图示的打开一个窗口：


![PutTTY security alert](/data/attachment/album/202207/23/110048gnyjeahjzynsspe5.png "PutTTY security alert")


这是 SSH 的安全措施之一，是为了防止<ruby> <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">  中间人攻击 </a> <rt>  man-in-the-middle attack </rt></ruby>。消息中的指纹应该匹配 Linux 系统中放在 `/etc/ssh/ssh_host_ed25519_key.pub` 的密钥。PuTTY 将这个密钥以 [MD5 哈希值](https://en.wikipedia.org/wiki/MD5) 的方式打印出来。要检查它的真实性，切换到 Linux 系统并打开一个控制台，然后输入：



```
ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_ed25519_key.pub

```

输出应该和 PuTTY 展示的指纹一致：



```
$ ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_ed25519_key.pub
256 MD5:E4:5F:01:05:D0:F7:DC:A6:32 no comment (ED25519)

```

点击“<ruby> 是 <rt>  Yes </rt></ruby>”以确认 PuTTY 的安全提示。主机系统的指纹现在存储在 PuTTY 的信任列表中，其位于 Windows 的注册表中的：



```
HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\SshHostKeys

```

输入正确的登录凭证，然后你应该进入控制台了，位置在你的用户主目录。


![Logged in to SSH](/data/attachment/album/202207/23/110049q1v4tgcov47dvoob.png "Logged in to SSH")


### 3、通过网络复制文件


除了远程控制台，你同样可以使用 PuTTY 通过 SSH 来传输文件。PuTTY 的安装目录在 `C:\Program Files (x86)\PuTTY`，在该目录下寻找 `ppscp.exe`。你既可以使用它从 Linux 系统复制文件，也可以复制文件到 Linux 系统。


使用 `Windows + R` 然后输入 `cmd` 来打开命令提示符，从你的 Linux 用户主目录复制 `MYFile.txt` 到你的 Windows 主目录，输入：



```
C:\"Program Files (x86)"\PuTTY\pscp.exe stephan@192.168.1.60:/home/stephan/MyFile.txt .

```

要从 Windows 主目录复制文件到 Linux 用户主目录，输入：



```
C:\"Program Files (x86)"\PuTTY\pscp.exe MyFile.txt stephan@192.168.1.60:/home/stephan/

```

就像你也许已经发现的那样，复制的命令通常构造为：



```
pscp.exe <source> <target>

```

### 4、隧道化一个协议


假设你拥有一个 Linux 机器，为某些特别的应用运行一个基于 HTTP 的服务。你想从你的 Windows 机器通过互联网访问这个 HTTP 服务。而且，你不能将相关的 TCP 端口暴露在公网，因为：


1. 这个服务通过 HTTP 而非 HTTPS 运行
2. 根本没有用户管理和登录系统


乍一看，建立这种架构不产生可怕的漏洞似乎是不可能的。但是 SSH 可简单的为这种情况建立一个安全的解决方案。


我将用我的软件项目 [Pythonic](https://github.com/hANSIc99/Pythonic) 来演示这个过程。在容器中运行。Pythonic 作为容器运行，开放两个 TCP 端口：TCP 端口 7000（主要编辑器）和 TCP 端口 8000（[code-server](https://github.com/cdr/code-server) 代码编辑器）。


要在一个 Linux 机器上安装 Pythonic ，运行：



```
podman pull pythonicautomation/pythonic
podman run -d -p 7000:7000 -p 8000:8000 pythonic

```

转向你的 Windows 机器，打开 PuTTy，转到 “<ruby> 连接 <rt>  Connection </rt></ruby> -> SSH -> <ruby> 隧道 <rt>  Tunnels </rt></ruby>”。加入你要转发的两个 TCP 端口：


* 源：`7000` / 目标：`localhost:7000`
* 源：`8000` / 目标：`localhost:8000`


![Port forwarding in PuTTY](/data/attachment/album/202207/23/110049jm4rapms266sc7z6.png "Port forwarding in PuTTY")


然后返回 “<ruby> 会话 <rt>  Session </rt></ruby>” 部分，并像之前那样建立一个 SSH 链接。打开网页浏览器，然后转到 `http://localhost:7000`；你应该看见像这样的窗口：


![Pythonic](/data/attachment/album/202207/23/110049jhw6cd6mbk67dgwk.png "Pythonic")


你成功的设置了端口转发！


**警告**: 如果你选择在公网上暴露 TCP 端口 22 ，不要使用易于猜测的登录凭证。你将接受来自全世界的登录请求，它们使用常见的、标准的登录凭证以尝试登录你的 Linux 机器。相反，只允许已知的用户登录。这种登录限制可以通过 [公钥加密](https://opensource.com/article/21/4/encryption-decryption-openssl) 来实现，它使用一个密钥对，其中公钥存储在 SSH 主机上，而私钥保留在客户端。


### 调试


如果你难以连接你的 Linux 机器，你可以跟踪你的 SSH 守护进程的处理过程：



```
journalctl -f -u sshd

```

这是一个普通的登录进程，但是其日志级别为 DEBUG，它看起来是这样的 :


![LogLevel DEBUG output](/data/attachment/album/202207/23/110050lizdhug1zr2ghaz1.png "LogLevel DEBUG output")


### 了解更多


这篇文章几乎没有涉及到使用 SSH 的方法。如果你正在寻找一个特定用例的信息，你也许可以在互联网中找到无数的教程。我在工作中使用 PuTTY ，因为它易于设置，在两个操作系统间又具有良好的可操作性，使得它成为连接解决方案里的瑞士军刀。


（文内图片来自：Stephan Avenwedde，[CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)）




---


via: <https://opensource.com/article/21/6/ssh-windows>


作者：[Stephan Avenwedde](https://opensource.com/users/hansic99) 选题：[lujun9972](https://github.com/lujun9972) 译者：[yjacks](https://github.com/yjacks) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
The secure shell protocol (SSH) is the most common method for controlling remote machines over the command line in the Linux world. SSH is a true Linux original, and it is also gaining popularity in the Windows world. There is even official [Windows documentation for SSH](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview), which covers controlling Windows machines using [OpenSSH](https://www.openssh.com/).

This article describes how to establish an SSH connection from a Windows machine to a Fedora 33 Linux system using the popular open source tool [PuTTY](https://www.putty.org/).

## Ways to use SSH


SSH uses a client-server architecture, where an SSH client establishes a connection to an SSH server. The SSH server is usually running as a system daemon, so it is often called SSHD. You can hardly find a Linux distribution that does not come with the SSH daemon. In Fedora 33, the SSH daemon is installed but not activated.

You can use SSH to control almost any Linux machine, whether it's running as a virtual machine or as a physical device on your network. A common use case is the headless configuration of embedded devices, including the Raspberry Pi. SSH can also be used to tunnel other network services. Because SSH traffic is encrypted, you can use SSH as a transport layer for any protocol that does not provide encryption by default.

In this article, I'll explain four ways to use SSH: 1. how to configure the SSH daemon on the Linux side, 2. how to set up a remote console connection, 3. how to copy files over the network, and 4. how to tunnel a certain protocol over SSH.

## 1. Configure SSHD

The Linux system (Fedora 33 in my case) acts as the SSH server that allows the PuTTY SSH client to connect. First, check the daemon's SSH configuration. The configuration file is located at `/etc/ssh/sshd_config`

and contains a lot of switches that can be activated by commenting out related lines:

```
# $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
Include /etc/ssh/sshd_config.d/*.conf
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
```


The default configuration, where no line is uncommented, should work for this example. Check whether the SSH daemon is already running by typing `systemctl status sshd`

:

```
$ systemctl status sshd
● sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2018-06-22 11:12:05 UTC; 2 years 11 months ago
Docs: man:sshd(8)
man:sshd_config(5)
Main PID: 577 (sshd)
Tasks: 1 (limit: 26213)
CGroup: /system.slice/sshd.service
└─577 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-[...]
```


If it's inactive, start it with the `systemctl start sshd`

command.

## 2. Set up a remote console

On Windows, [download the PuTTY installer](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html), then install and open it. You should see a window like this:

![PuTTY configuration screen PuTTY configuration screen](https://opensource.com/sites/default/files/uploads/putty_connection_settings.png)

(Stephan Avenwedde, CC BY-SA 4.0)

In the **Host Name (or IP address)** input field, enter the connection information for your Linux system. In this example, I set up a Fedora 33 virtual machine with a bridged network adapter that I can use to contact the system at the IP address `192.168.1.60`

. Click **Open**, and a window like this should open:

![PutTTY security alert PutTTY security alert](https://opensource.com/sites/default/files/uploads/putty_host_key.png)

(Stephan Avenwedde, CC BY-SA 4.0)

This is an SSH security mechanism to prevent a [man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). The fingerprint in the message should match the key on the Linux system at `/etc/ssh/ssh_host_ed25519_key.pub.`

. PuTTY prints the key as an [MD5 hash](https://en.wikipedia.org/wiki/MD5). To check its authenticity, switch to the Linux system, open a command shell, and enter:

`ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_ed25519_key.pub`


The output should match the fingerprint shown by PuTTY:

```
$ ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_ed25519_key.pub
256 MD5:E4:5F:01:05:D0:F7:DC:A6:32 no comment (ED25519)
```


Confirm the PuTTY Security Alert by clicking **Yes**. The host system's fingerprint is now in PuTTYs trust list, which is located in the Windows registry under:

`HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\SshHostKeys`


Enter your correct login credentials, and you should be on the console in your home directory:

![Logged in to SSH Logged in to SSH](https://opensource.com/sites/default/files/uploads/ssh_successfull_login.png)

(Stephan Avenwedde, CC BY-SA 4.0)

## 3. Copy files over the network

In addition to the remote console, you can use PuTTY to transfer files via SSH. Look in the installation folder under `C:\\Program Files (x86)\\PuTTY`

and find `pscp.exe`

. You can use this to copy files to and from a Linux system.

Open a command prompt with **Windows + R** and enter **cmd**. Copy the file `MyFile.txt`

from your Linux user home directory to your Windows home directory by entering:

`C:\"Program Files (x86)"\PuTTY\pscp.exe stephan@192.168.1.60:/home/stephan/MyFile.txt .`


To copy a file from the Windows home directory to the Linux user home directory, enter:

`C:\"Program Files (x86)"\PuTTY\pscp.exe MyFile.txt stephan@192.168.1.60:/home/stephan/`


As you may have already figured out, the copy command's general structure is:

`pscp.exe <source> <target>`


## 4. Tunnel a protocol

Imagine you have a Linux machine that is running an HTTP-based service for some arbitrary application. You want to access this HTTP service from your Windows machine over the internet. Of course, you cannot expose the related TCP port to the public because:

- The server is running HTTP, not HTTPS
- There is no user management nor login at all

At first glance, it looks like an impossible task to set up this architecture without producing a horrible security flaw. But SSH makes it relatively easy to set up a safe solution for this scenario.

I will demonstrate this procedure with my software project [Pythonic](https://github.com/hANSIc99/Pythonic). Running as a container, Pythonic exposes two TCP ports: TCP port 7000 (main editor) and TCP port 8000 (the [code-server](https://github.com/cdr/code-server) source-code editor).

To install Pythonic on a Linux machine, run:

```
podman pull pythonicautomation/pythonic
podman run -d -p 7000:7000 -p 8000:8000 pythonic
```


Switch to your Windows machine, open PuTTY, and navigate to **Connection -> SSH -> Tunnels**. Add the two TCP ports you want to forward:

- Source:
`7000`

/ Destination:`localhost:7000`

- Source:
`8000`

/ Destination:`localhost:8000`


![Port forwarding in PuTTY Port forwarding in PuTTY](https://opensource.com/sites/default/files/uploads/ssh_port_forwarding.png)

(Stephan Avenwedde, CC BY-SA 4.0)

Then go back to the **Session** section, and establish an SSH connection as you did before. Open a browser and navigate to `http://localhost:7000`

; you should see a screen like this:

![Pythonic Pythonic](https://opensource.com/sites/default/files/uploads/pythonic_screen.png)

(Stephan Avenwedde, CC BY-SA 4.0)

You have successfully configured port forwarding!

**Warning**: If you expose TCP Port 22 to the public, don't use easy-to-guess login credentials. You will receive login attempts from all over the world trying to access your Linux machine with common, standard credentials. Instead, permit only known clients to log in. This login restriction can be achieved using [public-key cryptography](https://opensource.com/article/21/4/encryption-decryption-openssl), which uses a key pair in which the public key is stored on the SSH host machine, and the private key remains at the client.

## Debugging

If you are struggling to connect to your Linux machine, you can follow the processes in your SSH daemon with:

`journalctl -f -u sshd`


This is how an ordinary log-in process looks like with LogLevel DEBUG :

![LogLevel DEBUG output LogLevel DEBUG output](https://opensource.com/sites/default/files/uploads/sshd_debug_log.png)

(Stephan Avenwedde, CC BY-SA 4.0)

## Learn more

This article barely scratched the surface about ways to use SSH. If you are looking for information about a specific use case, you can probably find it among the tons of SSH tutorials on the internet. I use PuTTY heavily at work because its easy configuration and good interoperability between operating systems make it a Swiss Army knife tool for connectivity solutions.

## Comments are closed.