# 跳板机架构
# 用户 -> 跳板机 -> 内网服务器
#
# 优点：
# 1. 集中管理访问入口
# 2. 记录所有操作日志
# 3. 实现访问控制
# 4. 提高安全性

# 跳板机配置要点：
# 1. 禁止root直接登录
# 2. 使用密钥认证
# 3. 限制可访问的服务器
# 4. 记录操作日志
# 5. 配置防火墙规则

# 创建跳板机用户组
$ sudo groupadd jumpusers

# 创建跳板机用户
$ sudo useradd -m -g jumpusers jumpuser

# 配置SSH服务
$ sudo tee /etc/ssh/sshd_config.d/jump-server.conf << EOF # 跳板机配置 # 修改SSH端口 Port 2222 # 禁止root登录 PermitRootLogin no # 启用密钥认证 PubkeyAuthentication yes # 禁用密码认证 PasswordAuthentication no # 限制登录用户 AllowGroups jumpusers # 启用SSH代理转发 AllowAgentForwarding yes # 启用TCP转发 AllowTcpForwarding yes # 禁用X11转发 X11Forwarding no # 配置登录超时 ClientAliveInterval 300 ClientAliveCountMax 2 # 配置最大会话数 MaxSessions 10 # 配置最大认证尝试 MaxAuthTries 3 # 配置登录超时 LoginGraceTime 60 EOF # 重启SSH服务 $ sudo systemctl restart sshd # 配置防火墙 $ sudo firewall-cmd --permanent --add-port=2222/tcp success $ sudo firewall-cmd --reload success # 创建用户密钥 $ sudo -u jumpuser ssh-keygen -t ed25519 -N "" -f /home/jumpuser/.ssh/id_ed25519 Generating public/private ed25519 key pair. Your identification has been saved in /home/jumpuser/.ssh/id_ed25519. Your public key has been saved in /home/jumpuser/.ssh/id_ed25519.学习交流加群风哥微信: itpux-compub. # 配置authorized_keys $ sudo -u jumpuser cat /home/jumpuser/.ssh/id_ed25519.pub >> /home/jumpuser/.ssh/authorized_keys
$ sudo chmod 600 /home/jumpuser/.ssh/authorized_keys

# 在内网服务器上创建用户
$ sudo useradd -m serveruser

# 配置SSH服务
$ sudo tee /etc/ssh/sshd_config.d/internal-server.conf << EOF # 内网服务器配置 # 只监听内网地址 ListenAddress 192.168.2.100 # 禁止root登录 PermitRootLogin no # 启用密钥认证 PubkeyAuthentication yes # 禁用密码认证 PasswordAuthentication no # 限制登录用户 AllowUsers serveruser # 禁用端口转发 AllowTcpForwarding no # 禁用X11转发 X11Forwarding no EOF # 重启SSH服务 $ sudo systemctl restart sshd # 从跳板机复制公钥到内网服务器 $ ssh jumpuser@jump-server "cat ~/.ssh/id_ed25519.pub" | sudo -u serveruser tee /home/serveruser/.ssh/authorized_keys $ sudo chmod 600 /home/serveruser/.ssh/authorized_keys

# 配置SSH客户端
$ tee ~/.ssh/config << EOF # 跳板机配置 Host jump-server HostName jump-server.fgedu.net.cn Port 2222 User jumpuser IdentityFile ~/.ssh/jump_key ForwardAgent yes # 内网服务器1 Host internal-server1 HostName 192.168.更多视频教程www.fgedu.net.cn2.100 User serveruser IdentityFile ~/.ssh/internal_key ProxyJump jum更多学习教程公众号风哥教程itpux_comp-server # 内网服务器2 Host internal-server2 HostName 192.168.2.101 User serveruser IdentityFile ~/.ssh/internal_key ProxyJump jump-server EOF $ chmod 600 ~/.ssh/config # 连接内网服务器 $ ssh internal-server1 Last login: Thu Apr 3 20:40:00 2026 from jump-server [serveruser@internal-server1 ~]$ # 使用SCP传输文件 $ scp file.txt internal-server1:/tmp/ file.txt 100% 1024 1.0KB/s 00:00 # 使用rsync同步文件 $ rsync -avz /data/ internal-server1:/backup/ sending incremental file list ./ file1.txt file2.txt sent 1.00K bytes received 100 bytes 400.00 bytes/sec total size is 2.00K speedup is 1.82

# 安装audit审计系统
$ sudo dnf install -y audit

# 配置审计规则
$ sudo tee -a /etc/audit/rules.d/audit.rules << EOF # 记录SSH相关操作 -w /usr/sbin/sshd -p x -k sshd -w /etc/ssh/sshd_config -p wa -k ssh_config -w /etc/ssh/sshd_config.d/ -p wa -k ssh_config # 记录用户登录 -w /var/log/secure -p wa -k logins -w /var/log/wtmp -p wa -k logins -w /var/run/utmp -p wa -k logins # 记录用户切换 -w /usr/bin/su -p x -k priv_esc -w /usr/bin/sudo -p x -k priv_esc EOF # 重启audit服务 $ sudo systemctl restart auditd # 查看审计日志 $ sudo ausearch -k sshd | tail -20 ---- time->Thu Apr 3 20:45:00 2026
type=PROCTITLE msg=audit(1712150700.123:12345): proctitle=2F7573722F7362696E2F73736864002D44006C697374656E696E67206F6E20706F72742032323232
type=SYSCALL msg=audit(1712150700.123:12345): arch=c000003e syscall=1 success=yes exit=0 a0=3 a1=7ffd12345678 a2=100 a3=7ffd12345679 items=0 ppid=1 pid=12345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=”sshd” exe=”/usr/sbin/sshd” key=”sshd”

# 配置会话记录
$ sudo tee /etc/profile.d/session_log.sh << EOF # 记录用户会话 if [ "\$USER" != "root" ]; then script -f /var/log/session/\${USER}.\$(date +%Y%m%d_%H%M%S).\$\$.log fi EOF $ sudo mkdir -p /var/log/session $ sudo chmod 777 /var/log/session # 配置sudo日志 $ sudo tee /etc/sudoers.d/logging << EOF Defaults logfile=/var/log/sudo.log Defaults log_year, log_host, syslog EOF $ sudo touch /var/log/sudo.log $ sudo chmod 600 /var/log/sudo.log # 查看sudo日志 $ sudo tail -f /var/log/sudo.log Apr 3 20:45:30 2026 : jumpuser : TTY=pts/0 ; PWD=/home/jumpuser ; USER=root ; COMMAND=/bin/systemctl status sshd