海运的博客

php ssh/expect登录服务器执行命令

发布时间:April 21, 2018 // 分类:PHP // No Comments

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php
$conn = ssh2_connect('1.1.1.1', 22);
if (!$conn) {
  die("conn fail\n");
}
if (ssh2_auth_password($conn, 'root', 'password')) {
  echo "auth sus\n";
} else {
  die("auth fail\n");
}
$stream = ssh2_exec($conn, "df  --output=avail /|tail -n 1"); 
stream_set_blocking($stream, true); 
$res = trim(stream_get_contents($stream));
var_dump($res);

php使用ssh交互式执行命令:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
<?php
$host = '192.168.1.1';
$port = 2222;
$pass = 'xxxx';
if (!($conn = ssh2_connect($host, $port, array('hostkey'=>'ssh-rsa')))) {
  die("conn fail\n");
}
//注意路径不要使用~/.ssh/id_rsa.pub,会遇到段错误和其它莫名其妙的问题
if (ssh2_auth_pubkey_file($conn, 'root', '/root/.ssh/id_rsa.pub', '/root/.ssh/id_rsa')) {
  echo "auth sus\n";
} else {
  die("auth fail\n");
}
function expect($stream, $match) {
  $time = time();
  $res = '';
  while(!feof($stream)){
    //if (($buffer = fgets($stream, 4096)) !== false) {
    if (($buffer = fread($stream, 4096)) !== false) {
      $res .= $buffer;
    }
    if (stristr($res, $match)) {
      return 'sus';
    }
    $now = time();
    if (($now - $time) >= 10) {
      return 'timeout';
    }
    usleep(100);
  }
  return 'disconnect';
}
 
$shell=ssh2_shell($conn, 'xterm');
fwrite($shell, "/usr/bin/cryptroot-unlock\n");
$res = expect($shell, 'Please unlock disk');
if ($res == 'sus') {
  fwrite($shell, "{$pass}\n");
  $res = expect($shell, 'set up successfully');
  if ($res == 'sus') {
  }
  var_dump($res);
}

php也可安装expect扩展调用ssh命令交互式执行命令:

1
2
3
4
5
6
7
8
9
apt install php-dev tcl-dev tcl-expect-dev
wget https://pecl.php.net/get/expect-0.4.0.tgz
tar zxvf expect-0.4.0.tgz
cd expect-0.4.0/
 phpize
./configure
make && make install
echo 'extension=expect.so' > /etc/php/7.4/cli/conf.d/20-expect.ini
php -m|grep expect

make时如果出现错误php_expect.h:34:10: fatal error: expect_tcl.h: 没有那个文件或目录:

1
sed -i 's/^INCLUDES =/INCLUDES = -I\/usr\/include\/tcl8.6/' Makefile

php使用expect连接ssh执行命令:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
<?php
ini_set("expect.timeout", 2);
ini_set("expect.loguser", "off");
 
$stream = expect_popen("ssh -o StrictHostKeyChecking=no -p 22 root@www.haiyun.me");
$cases = array(
  array("password:", "password"),
  array("Last login", "shell"),
  array("yes/no)?""yes/no")
);
 
while (true) {
  switch (expect_expectl($stream, $cases)) {
  case "password":
    fwrite($stream, "password\n");
    break;
  case "yes/no":
    fwrite($stream, "yes\n");
    break;
  case "shell":
    fwrite($stream, "uptime\n");
    break;
  case EXP_TIMEOUT:
  case EXP_EOF:
    break 2;
  default:
    die("Error has occurred!");
  }
}
fclose ($stream);

Openwrt下转守护进程runit使用

发布时间:February 11, 2015 // 分类:OpenWrt // No Comments

类似于s6,不过runit在openwrt busybox中自带,需编译openwrt固件时选择。
runsvdir用以扫描指定目录子目录下run脚本并使用runsv启动为守护进程:

1
runsvdir -P /etc/config/service/

一个openconnect启动脚本示例,注意启动的程序一定要以非守护进程启动且以exec命令执行:

1
2
3
cat /etc/config/service/openconnect/run
exec 2>&1
exec openconnect -c user-cert.pem -k user-key.pem -s /etc/config/vpnc --no-cert-check www.haiyun.me

如果run目录存在finish脚本,run执行的程序退出后runsv会执行finish并传递程序退出code给finish参数1,然后再重新执行run启动程序,我们可以使用finish判断当网络不通时程序退出状态,避免程序持续启动退出导致死循环:

1
2
3
4
5
6
7
#!/bin/sh
if [ $1 -eq 255 ]
then
  sleep 5
else
  exit
fi

控制启动的程序,更多见http://smarden.org/runit/sv.8.html

1
2
3
4
sv status /etc/config/service/openconnect/
sv stop /etc/config/service/openconnect/
sv start /etc/config/service/openconnect/
sv restart /etc/config/service/openconnect/

也可以用runit管理ssh动态隧道转发实现类似于autossh的功能,ssh连接时使用超时控制,超时后ssh关闭runsv会自动重启ssh。
更多示例:
http://smarden.org/runit/runscripts.html

自编译ngrok服务器

发布时间:August 18, 2014 // 分类:网络工具 // 15 Comments

首先安装GO环境,https://www.haiyun.me/archives/1009.html

1
2
3
4
cd /usr/local/src/
git clone https://github.com/inconshreveable/ngrok.git
export GOPATH=/usr/local/src/ngrok/
export NGROK_DOMAIN="haiyun.me"

生成自签名SSL证书,ngrok为ssl加密连接:

1
2
3
4
5
6
7
8
9
10
11
12
cd ngrok
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -subj "/CN=$NGROK_DOMAIN" -days 5000 -out rootCA.pem
openssl genrsa -out device.key 2048
openssl req -new -key device.key -subj "/CN=$NGROK_DOMAIN" -out device.csr
openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 5000
cp rootCA.pem assets/client/tls/ngrokroot.crt
cp device.crt assets/server/tls/snakeoil.crt
cp device.key assets/server/tls/snakeoil.key
GOOS=linux GOARCH=386
make clean
make release-server release-client

如果一直停留在go get gopkg.in/yaml.v1参考:https://www.haiyun.me/archives/1011.html
启动SERVER:

1
bin/ngrokd -domain="$NGROK_DOMAIN" -httpAddr=":8000"

交叉编译windows客户端,最好安装最新版本Golang,使用yum安装的一直编译不通过。

1
2
3
4
cd /usr/local/go/src/
GOOS=windows GOARCH=386 CGO_ENABLED=0 ./make.bash
cd -
GOOS=windows GOARCH=386 make release-server release-client

客户端配置:

1
2
3
4
5
6
7
8
9
10
11
12
13
server_addr: "haiyun.me:4443"
trust_host_root_certs: false
tunnels:
  http:
    subdomain: "example"
    auth: "user:12345"
    proto:
      http: "80"
 
  ssh:
    remote_port: 2222
    proto:
      tcp: "22"

启动客户端:

1
bin/ngrok -config ngrok.conf start http ssh

注意所有domain要一致,不然会出现证书错误:

1
Failed to read message: remote error: bad certificate

SSH转发远程端口指定监听地址

发布时间:August 18, 2014 // 分类:网络工具 // No Comments

SSH默认转发远程服务器端口时监听loop,只能通过本地访问端口,如:

1
ssh -R 0.0.0.0:9022:localhost:22 root@haiyun.me

修改配置文件允许自定义监听地址:

1
2
echo 'GatewayPorts yes' >> /etc/ssh/sshd_config
/etc/init.d/sshd restart

穿透内网利器ngrok

发布时间:August 18, 2014 // 分类:网络工具 // No Comments

通过ngrok服务器转发端口到本地80:

1
ngrok 80

自定义二级域名,需在ngrok官网注册账号获取auth token:

1
ngrok -authtoken Co1KiaaAdpapgD -subdomain=example 80

转发TCP协议其它端口,

1
ngrok -authtoken Co1KiaaAdpapgD -proto=tcp 22

指定远程服务器端口:

1
2
3
4
5
6
auth_token: Co1KiaaAdpapgD
tunnels:
  ssh:
    proto:
      tcp: "22"
    remote_port: 52222

启动:

1
ngrok -config ngrok.conf start ssh
分类
最新文章
最近回复
  • opnfense: 谢谢博主!!!解决问题了!!!我之前一直以为内置的odhcp6就是唯一管理ipv6的方式
  • liyk: 这个方法获取的IPv6大概20分钟之后就会失效,默认路由先消失,然后Global IPV6再消失
  • 海运: 不好意思,没有。
  • zongboa: 您好,請問一下有immortalwrt設定guest Wi-Fi的GUI教學嗎?感謝您。
  • 海运: 恩山有很多。
  • swsend: 大佬可以分享一下固件吗,谢谢。
  • Jimmy: 方法一 nghtp3步骤需要改成如下才能编译成功: git clone https://git...
  • 海运: 地址格式和udpxy一样,udpxy和msd_lite能用这个就能用。
  • 1: 怎么用 编译后的程序在家里路由器内任意一台设备上运行就可以吗?比如笔记本电脑 m参数是笔记本的...
  • 孤狼: ups_status_set: seems that UPS [BK650M2-CH] is ...
StatCounter - Free Web Tracker and Counter