praqma/alpine-sshd

最简/最小化SSH服务器

这是一个基于Alpine的极简SSH服务器，监听22端口，无复杂功能，仅在前台运行SSHD服务。它仅允许密钥认证，用户为root，适用于Kubernetes集群内作为跳板机，进一步连接防火墙后的其他安全服务，也可用于端口转发、ssh-agent转发等场景。

安全特性

• root用户密码未设置。
• SSH仅启用密钥认证，禁用密码认证。
• 容器需要名为"AUTHORIZED_KEYS"的环境变量，包含你的SSH公钥。若该变量为空，容器无法启动，防止成为开放SSH中继。

只需在运行时将SSH公钥作为AUTHORIZED_KEYS环境变量传入容器即可使用。你可以将多个SSH公钥放入一个文件，再将整个文件内容作为字符串传入该变量，例如：

AUTHORIZED_KEYS="$(cat .ssh/my_many_ssh_public_keys_in_one_file.txt)"

带密钥的示例

（密钥为方便起见已截断）

[kamran@kworkhorse alpine-sshd]$ AUTHORIZED_KEYS="ssh-rsa AAAAB3NzaC1yc2JADfoDX5w== kaz@parqma.net"

[kamran@kworkhorse alpine-sshd]$ docker run -e AUTHORIZED_KEYS="${AUTHORIZED_KEYS}" -d praqma/alpine-sshd
a85de77b70a195531570ac45e63a94dd270ad1dd917f3f470daeb9f6a88e2daf

[kamran@kworkhorse alpine-sshd]$ docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
a85de77b70a1        praqma/alpine-sshd    "/docker-entrypoint.…"   2 seconds ago       Up 2 seconds                            relaxed_fermi
[kamran@kworkhorse alpine-sshd]$ 

[kamran@kworkhorse alpine-sshd]$ docker inspect relaxed_fermi | grep -w IPAddress
            "IPAddress": "172.17.0.2",
                    "IPAddress": "172.17.0.2",

现在通过SSH访问容器：

[kamran@kworkhorse alpine-sshd]$ ssh root@172.17.0.2
Welcome to Alpine!

The Alpine Wiki contains a large amount of how-to guides and general
information about administrating Alpine systems.
See <http://wiki.alpinelinux.org>.

You can setup the system with the command: setup-alpine

You may change this message by editing /etc/motd.

a85de77b70a1:~# 

未传入SSH密钥的示例

[kamran@kworkhorse alpine-sshd]$ docker run  -d praqma/alpine-sshd
32cf51a135275f76f2c1866dbf3c36ee1891b3644b0c2bfa24af510e506e4f24

[kamran@kworkhorse alpine-sshd]$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

[kamran@kworkhorse alpine-sshd]$ docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                            PORTS               NAMES
32cf51a13527        praqma/alpine-sshd    "/docker-entrypoint.…"   9 seconds ago       Exited (1) 8 seconds ago                              fervent_galileo

[kamran@kworkhorse alpine-sshd]$ docker logs fervent_galileo 
Need your ssh public key as AUTHORIZED_KEYS env variable. Abnormal exit ...
[kamran@kworkhorse alpine-sshd]$

传入错误/不匹配SSH密钥的示例

[kamran@kworkhorse alpine-sshd]$ docker run -e AUTHORIZED_KEYS="some random string" -d test/alpine-sshd
f240cea71d36fec8d0a556b97d488ceaf53bcd781d36111695a3225471e6b02f

[kamran@kworkhorse alpine-sshd]$ docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
f240cea71d36        test/alpine-sshd    "/docker-entrypoint.…"   4 seconds ago       Up 4 seconds        22/tcp              hungry_murdock

[kamran@kworkhorse alpine-sshd]$ ssh root@172.17.0.2
root@172.17.0.2: Permission denied (publickey,keyboard-interactive).
[kamran@kworkhorse alpine-sshd]$