1,安装obfuscated-openssh server
obfuscated-openssh可以代替系统的OpenSSH服务,如果在安装过程中不指定–prefix选项,它将替换系统openssh-server的二进制程序和配置文件. 本文指定了安装目录,并不会与系统自带的openssh服务冲突.
yum install zlib openssl #适用Redhat/CentOS系统
sudo apt-get install zlib1g-dev libssl-dev #适用Ubuntu系统
wget -O ofcssh.tar.gz https://github.com/brl/obfuscated-openssh/tarball/master
tar zxvf ofcssh.tar.gz
cd brl-obfuscated-openssh-ca93a2c/
./configure --prefix=/usr/local/obfus
make
make install
sed -i "s/Port /#Port /g" /usr/local/obfus/etc/sshd_config #22端口被正常的SSH服务使用,这里不需要
sed -i "s/UsePAM /#UsePAM /g" /usr/local/obfus/etc/sshd_config #obfuscated-openssh不支持UsePAM选项
echo "ObfuscatedPort 32" >> /usr/local/obfus/etc/sshd_config #指定监听端口
echo "ObfuscateKeyword fuckthegfw" >> /usr/local/obfus/etc/sshd_config #指定混淆密钥
运行:
/usr/local/obfus/sbin/sshd -f /usr/local/obfus/etc/sshd_config &
设置开机自启(写入/etc/rc.local)
echo 'nohup /usr/local/obfus/sbin/sshd -f /usr/local/obfus/etc/sshd_config >> /var/log/obfus.log 2>&1 &' >> /etc/rc.local
2,obfuscated-openssh客户端选择
Windows下的客户端
Bitvise SSH Client (Tunnelier) (已经支持obfuscation,可以建立本地的socks5代理)
potty
Linux系统下的客户端
请把本文第一步再走一遍，然后运行
/usr/local/obfus/bin/ssh -N -v -Z ObfuscateKeyWord -p Port user@host -D 127.0.0.1:7070