Question

我有一台服务器（例如，内置服务器），只能从另一台服务器（例如，outerserver）到达，而不是运行节点服务器的服务器。但是，节点服务器可以到达外部。从命令行使用ssh时，我可以使用ProxyCommand配置文件语句来简化连接。我的配置文件如下所示：

Host innerserver
ProxyCommand ssh outerserver nc innerserver 22

这允许我只需键入ssh innerserver，ssh就可以通过outerserver进行隧道传输。现在我想用Node的ssh2模块实现同样的功能。在文档中，它说连接的socks - 选项可用于“连接跳跃”，但它从不说明具体含义或使用方式。我尝试了以下方法：

var ssh2 = require('ssh2');
function runCommand(command, callback) {
  var connection = new ssh2();
  require('fs').readFile('/path/to/key/file', function(err, privateKey) {
    connection
      .on('ready', function() {
        connection.exec('nc innerserver 22', function(err, stream) {
          var innerConnection = new ssh2();
          innerConnection
            .on('ready', function() {
              innerConnection.exec(command, function(err, innerstream) {
                var data = '';
                innerstream.on('data', function(chunk) {
                  data += chunk;
                });
                innerstream.on('end', function() {
                  callback(data);
                });
              });
              console.log('ready');
            })
            .on('error', function(msg) {
              console.log('inner error:', msg);
              callback('error');
            })
            .connect({username:'user', privateKey: privateKey, sock:stream, debug: function(msg) {
              console.log('inner', msg);
            }});
        });
      })
      .on('error', function(msg) {
        console.log('outer error', msg);
        callback('error');
      })
      .connect({host:'outerserver', username:'user', privateKey:privateKey, debug: function(msg) {
        console.log('outer:', msg);
      }});    
  });
}

我得到以下输出：

outer: DEBUG: Parser: STATE_INIT
outer: DEBUG: Parser: STATE_GREETING
outer: DEBUG: Parser: STATE_HEADER
outer: DEBUG: Connection: Server ident: 'SSH-2.0-OpenSSH_6.4'
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 8)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: pktLen:1532,padLen:7,remainLen:1528
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: KEXINIT
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 8)
outer: DEBUG: Connection: Sent KEXINIT
outer: DEBUG: Connection: Comparing KEXInits...
outer: DEBUG: (local) Server->Client ciphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,arcfour256,arcfour128,cast128-cbc,arcfour
outer: DEBUG: (remote) Server->Client ciphers: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
outer: DEBUG: Connection: Server->Client Cipher: aes256-ctr
outer: DEBUG: (local) Client->Server ciphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc,arcfour256,arcfour128,cast128-cbc,arcfour
outer: DEBUG: (remote) Client->Server ciphers: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
outer: DEBUG: Connection: Client->Server Cipher: aes256-ctr
outer: DEBUG: (local) KEX algorithms: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
outer: DEBUG: (remote) KEX algorithms: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
outer: DEBUG: Connection: KEX: diffie-hellman-group14-sha1
outer: DEBUG: (local) Client->Server HMAC algorithms: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-sha1-96,hmac-md5-96
outer: DEBUG: (remote) Client->Server HMAC algorithms: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
outer: DEBUG: Connection: Client->Server HMAC: hmac-md5
outer: DEBUG: (local) Server->Client HMAC algorithms: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-sha1-96,hmac-md5-96
outer: DEBUG: (remote) Server->Client HMAC algorithms: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
outer: DEBUG: Connection: Server->Client HMAC: hmac-md5
outer: DEBUG: (local) Client->Server compression algorithms: none
outer: DEBUG: (remote) Client->Server compression algorithms: none,zlib@openssh.com
outer: DEBUG: Connection: Client->Server Compression: none
outer: DEBUG: (local) Server->Client compression algorithms: none
outer: DEBUG: (remote) Server->Client compression algorithms: none,zlib@openssh.com
outer: DEBUG: Connection: Server->Client Compression: none
outer: DEBUG: (local) Host key formats: ssh-rsa,ssh-dss
outer: DEBUG: (remote) Host key formats: ssh-rsa,ecdsa-sha2-nistp256
outer: DEBUG: Connection: Host key format: ssh-rsa
outer: DEBUG: Connection: Sent KEXDH_INIT
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: pktLen:828,padLen:7,remainLen:824
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: KEXDH_REPLY
outer: DEBUG: Connection: Checking host key format
outer: DEBUG: Connection: Checking signature format
outer: DEBUG: Connection: Verifying signature
outer: DEBUG: Connection: Sent NEWKEYS
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 8)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: pktLen:12,padLen:10,remainLen:8
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: NEWKEYS
outer: DEBUG: Connection: Sent SERVICE_REQUEST
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: pktLen:28,padLen:10,remainLen:16
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: hmacSize:16
outer: DEBUG: Parser: STATE_PACKETDATAVERIFY
outer: DEBUG: Parser: Verifying MAC
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: SERVICE_ACCEPT
outer: DEBUG: Connection: Sent USERAUTH_REQUEST (publickey -- check)
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: pktLen:300,padLen:4,remainLen:288
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: hmacSize:16
outer: DEBUG: Parser: STATE_PACKETDATAVERIFY
outer: DEBUG: Parser: Verifying MAC
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: USERAUTH_PK_OK
outer: DEBUG: Connection: Sent USERAUTH_REQUEST (publickey)
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: pktLen:12,padLen:10,remainLen:0
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: hmacSize:16
outer: DEBUG: Parser: STATE_PACKETDATAVERIFY
outer: DEBUG: Parser: Verifying MAC
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: USERAUTH_SUCCESS
outer: DEBUG: Connection: Sent CHANNEL_OPEN
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: pktLen:28,padLen:10,remainLen:16
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: hmacSize:16
outer: DEBUG: Parser: STATE_PACKETDATAVERIFY
outer: DEBUG: Parser: Verifying MAC
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: CHANNEL_OPEN_CONFIRMATION
outer: DEBUG: Channel: Sent CHANNEL_REQUEST (exec)
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: pktLen:28,padLen:18,remainLen:16
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: hmacSize:16
outer: DEBUG: Parser: STATE_PACKETDATAVERIFY
outer: DEBUG: Parser: Verifying MAC
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: CHANNEL_WINDOW_ADJUST
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: pktLen:12,padLen:6,remainLen:0
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: hmacSize:16
outer: DEBUG: Parser: STATE_PACKETDATAVERIFY
outer: DEBUG: Parser: Verifying MAC
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: CHANNEL_SUCCESS
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
outer: DEBUG: Parser: STATE_PACKET
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: pktLen:44,padLen:13,remainLen:32
outer: DEBUG: Parser: STATE_PACKETDATA
outer: DEBUG: Parser: Decrypting
outer: DEBUG: Parser: hmacSize:16
outer: DEBUG: Parser: STATE_PACKETDATAVERIFY
outer: DEBUG: Parser: Verifying MAC
outer: DEBUG: Parser: STATE_PACKETDATAAFTER, packet: CHANNEL_DATA
inner DEBUG: Parser: STATE_INIT
inner DEBUG: Parser: STATE_GREETING
inner DEBUG: Parser: STATE_HEADER
inner DEBUG: Connection: Server ident: 'SSH-2.0-OpenSSH_6.4'
inner DEBUG: Parser: STATE_PACKETBEFORE (expecting 8)
outer: DEBUG: Parser: STATE_PACKETBEFORE (expecting 16)
inner DEBUG: Connection: Sent KEXINIT

似乎内部联系从未真正建立起来。我做错了什么？

Answer 1

更新：您可能最好使用connection.forwardOut()（只要服务器允许），而不是依赖netcat或类似工具来进行下一跳。

从ssh2 v0.2.19开始，你可以为连接跳跃做这样的事情：

var Connection = require('ssh2');

var conn1 = new Connection(),
    conn2 = new Connection();

conn1.on('ready', function() {
  console.log('FIRST :: connection ready');
  conn1.exec('nc 192.168.1.2 22', function(err, stream) {
    if (err) return console.log('FIRST :: exec error: ' + err);
    conn2.connect({
      sock: stream,
      username: 'user2',
      password: 'password2'
    });
  });
});
conn1.connect({
  host: '192.168.1.1',
  username: 'user1',
  password: 'password1'
});

conn2.on('ready', function() {
  console.log('SECOND :: connection ready');
  conn2.exec('uptime', function(err, stream) {
    if (err) return console.log('SECOND :: exec error: ' + err);
    stream.on('data', function(data) {
      console.log(data.toString());
    });
    stream.on('end', function() {
      conn1.end(); // close parent (and this) connection
    });
  });
});

使用Node.js ssh2模块模拟ssh的ProxyCommand

1 个答案: