A login method and system based on SSH
A centralized SSH login system with proxy modules and a dispatch center addresses security and connectivity issues by managing SSH connections through a dispatch center, enabling secure and managed logins for devices without public IP addresses or direct server exposure.
Patent Information
- Application Number
- CN202111295936.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-11-03
- Publication Date
- 2024-12-31
- Estimated Expiration
- 2041-11-03
AI Technical Summary
Existing SSH login methods require a direct network connection between client and server, expose server ports to public networks, necessitate a public IP address, and are vulnerable to security risks, especially for devices behind NAT.
Implement a dispatch center between client and target machine with proxy modules, enabling SSH logins through a centralized scheduling system that manages authentication and connections, allowing devices behind NAT to function as proxy clients without exposing server ports to public networks.
This approach secures SSH connections by avoiding direct server exposure, supports devices behind NAT, and simplifies authentication and management by centralizing it within the dispatch center.
Smart Images
Figure CN114244554B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data processing, and in particular to an SSH-based login method and system. Background Art
[0002] Secure Shell (ssh) is a network protocol used for encrypted login between computers. It is a secure network protocol based on the application layer developed by IETF (The Internet Engineering Task Force). ssh is a protocol designed to provide security for remote login sessions and other network services, which can effectively make up for loopholes in the network. Through ssh, all transmitted data can be encrypted, and DNS spoofing and IP spoofing can also be prevented. In addition, there is an additional benefit that the transmitted data is compressed, which can speed up the transmission speed.
[0003] SSH implements an encrypted remote connection function, which can send instructions to the remote device through the connection and simulate the local shell environment to achieve remote control function. The current SSH login method is C / S architecture, that is, the client connects to the server, which brings the following technical defects:
[0004] 1. The network between client and server needs to be connected;
[0005] 2. The server exposes the port, and the client connects to the server through the TCP connection port;
[0006] 3. If it is in a public network environment, it will bring security risks because the port needs to be exposed to the public network;
[0007] 4. The SSH server must have a public IP address to provide services. Most home broadbands do not have a public IP address, and a considerable proportion of corporate servers do not have a public IP address either. Instead, they can only connect to the public network through NAT. Summary of the invention
[0008] The present invention is to solve the technical problems existing in the prior art and provide a login method based on ssh, which is applied to a client and a target machine. The target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine. The login method comprises the following steps:
[0009] S1: The dispatch center responds to the client's login request;
[0010] S2: The dispatch center sends instructions to the proxy module of the corresponding target machine according to the client's login request;
[0011] S3: The proxy module of the corresponding target machine creates an ssh login according to the instruction, and connects to the ssh server of the corresponding target machine as a proxy client, and the proxy client creates a communication protocol request to connect to the dispatch center;
[0012] S4: The dispatch center establishes communication between the proxy client and the client's login request according to the proxy client's communication request.
[0013] Furthermore, the dispatch center responds to the client's login request by establishing communication via TCP.
[0014] Furthermore, the proxy client creates a communication protocol request to connect to the dispatch center to establish communication through TCP.
[0015] Furthermore, in step S1, the dispatch center also includes performing login authentication on the login request of the client.
[0016] Another login method based on ssh is applied on the client and the target machine. The target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine. The login method includes the following steps:
[0017] S1: The dispatch center responds to the client's login request;
[0018] S2: The dispatch center sends instructions to the proxy module of the corresponding target machine according to the client's login request;
[0019] S3: The proxy module of the corresponding target machine creates an ssh login according to the instruction, and as a proxy client, connects to the ssh server of the corresponding target machine, and the scheduling center sends the login instruction.
[0020] Furthermore, the dispatch center responds to the client's login request by establishing communication via TCP.
[0021] Furthermore, the proxy client creates a communication protocol request to connect to the dispatch center to establish communication through TCP.
[0022] Furthermore, in step S1, the dispatch center also includes performing login authentication on the login request of the client.
[0023] The present invention also provides an ssh-based login system, comprising a client and a target machine, wherein the target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine, wherein:
[0024] The dispatch center responds to the client's login request and establishes a communication connection between the proxy module and the target machine;
[0025] The proxy module of the target machine is used to create an ssh login, act as a proxy client, and connect with the login request of the client.
[0026] The present invention also provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform any of the login methods described above.
[0027] In actual applications, the modules described in the method and system disclosed in the present invention can be deployed in multiple modules on one target server, or each module can be independently deployed on different target servers. In particular, in order to provide more powerful computing processing capabilities, the modules can also be deployed on cluster target servers as needed.
[0028] It can be seen that the technical effects achieved by the technical solution adopted by the present invention are as follows:
[0029] 1. Avoid direct exposure of the ssh server and instead control it through the node in the dispatch center;
[0030] 2. Exposing the ssh server port on the public Internet will cause security risks. This application does not need to expose the port, so this security risk can be solved;
[0031] 3. Allow the internal devices behind NAT to provide SSH server functions;
[0032] 4. All connections must go through the dispatch center. The authentication and login steps can be unified in the dispatch center for easy management.
[0033] In order to have a clearer and more comprehensive understanding of the present invention, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can obtain other drawings based on these drawings without creative work.
[0035] Figure 1 The present invention is a flowchart of an SSH-based login method according to an embodiment of the present application.
[0036] Figure 2The present invention is a schematic diagram of a specific implementation process of an SSH-based login method according to an embodiment of the present application. DETAILED DESCRIPTION
[0037] See also Figure 1 , Figure 1 The flowchart of a login method based on ssh is shown, which is applied on a client and a target machine. The target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine. The login method includes the following steps:
[0038] S1: The dispatch center responds to the client's login request;
[0039] S2: The dispatch center sends instructions to the proxy module of the corresponding target machine according to the client's login request;
[0040] S3: The proxy module of the corresponding target machine creates an ssh login according to the instruction, and connects to the ssh server of the corresponding target machine as a proxy client, and the proxy client creates a communication protocol request to connect to the dispatch center;
[0041] S4: The dispatch center establishes communication between the proxy client and the client's login request according to the proxy client's communication request.
[0042] Embodiment 1
[0043] See also Figure 2 , Figure 2 This is a schematic diagram of a specific implementation process of an SSH-based login method according to an embodiment of the present application. In the figure, "actively connecting to the center" means actively connecting to the dispatching center, "center dispatching" means the dispatching center described in the present application, and "agent A" means a specific agent module A of the agent module concept described in the present application. After the technical solution of the present application is deployed, after all agent modules are started, they are connected to the node of the dispatching center, and registration is completed in the dispatching center to establish a registration table. The node of the dispatching center maintains the connection of all agent modules, as follows:
[0044] Step S1: The dispatch center responds to the client's login request.
[0045] The client requests to log in to the target machine A via ssh. As a preferred implementation, the request is sent to the dispatch center via tcp. After the dispatch center receives the request, it generates an identification ID (also called request ID) for the login request.
[0046] S2: The dispatch center sends instructions to the proxy module of the corresponding target machine according to the client's login request.
[0047] The dispatch center searches the registration list, finds the connection to the proxy module A, sends a login request to the proxy module A through the connection, and generates an identification ID (or request ID) for the login request.
[0048] S3: The proxy module of the corresponding target machine creates an ssh login according to the instruction, and connects to the ssh server of the corresponding target machine as a proxy client. The proxy client creates a communication protocol request to connect to the dispatch center.
[0049] After receiving the request, the proxy module A creates an ssh login and acts as a proxy client. In this embodiment, the proxy module A is connected to the ssh server of the machine specified by the proxy module A through a TCP connection.
[0050] Then proxy module A creates a TCP request to connect to the dispatch center and sends back the identification ID.
[0051] S4: The dispatch center establishes communication between the proxy client and the client's login request according to the proxy client's communication request.
[0052] After the dispatch center receives the connection from the proxy module A, it uses the identification ID to find out that it is the ssh login requested by the client in step S1, and then connects this TCP connection with the TCP connection requested by the client. At this point, the ssh request sent by the client through this connection is forwarded to the specified target machine, and the response of the ssh server on the specified target machine will also be transmitted back to the client, thereby realizing the ssh login.
[0053] In the embodiments of the present application, the proxy module communicates with the dispatch center in such a way that the proxy module actively connects to the dispatch center (i.e., the proxy module actively registers with the dispatch center and the proxy module connects to the dispatch center after logging into ssh), so there is no need to expose the proxy module directly to the public network. As long as the proxy module can connect to the network of the dispatch center, it can be done even if the proxy module is behind a NAT (Network Address Translation) device.
[0054] As a more preferred implementation, the dispatch center further includes performing login authentication on the login request of the client.
[0055] Unified login authentication or authorization can be implemented in the dispatch center. In the solution of this application, the proxy modules must first be connected to the dispatch center, where a login authentication or authorization step is performed before release. This authentication does not need to be configured on all target login machines, making it easier to maintain and manage.
[0056] It can be seen that the technical effects achieved by this application are as follows:
[0057] 1. Avoid direct exposure of the ssh server and instead control it through the node in the dispatch center;
[0058] 2. Exposing the ssh server port on the public Internet will cause security risks. This application does not need to expose the port, so this security risk can be solved;
[0059] 3. Allow the internal devices behind NAT to also provide SSH server functions;
[0060] 4. All connections must go through the dispatch center. The authentication and login steps can be unified in the dispatch center for easy management.
[0061] Embodiment 2
[0062] Based on the above-mentioned embodiment 1, steps S3 and S4 in embodiment 1, as a variant implementation mode, the proxy module of the corresponding target machine creates an ssh login according to the instruction, and as a proxy client, connects to the sshserver of the corresponding target machine, and the scheduling center sends the login instruction.
[0063] In the first embodiment, the proxy module realizes the connection connection to the dispatching center after the login. In the second embodiment, the connection can also be directly handed over to the dispatching center, and the dispatching center sends the login instruction. In this embodiment, one end of the connection is the ssh server of the target machine for login, and the other end is the dispatching center. The dispatching center sends the ssh login instruction through the connection and passes it to the target machine, thereby realizing the login.
[0064] In addition, as a preferred implementation, when creating an ssh connection, when the proxy module actively logs in, data is transmitted between the client and the ssh server of the target machine through the ssh protocol, and in other time periods, only one long connection needs to be maintained between the proxy module and the scheduling center, and between the scheduling center and the client. At this time, other protocols can also be used, such as quic or other protocols above tcp, such as websocket.
[0065] Embodiment 3
[0066] Based on the method of the above embodiment, the present application also provides an ssh-based login system, including a client and a target machine, wherein:
[0067] The target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine.
[0068] The dispatch center responds to the client's login request and establishes a communication connection between the proxy module and the target machine;
[0069] The proxy module of the target machine is used to create an ssh login, act as a proxy client, and connect with the login request of the client.
[0070] For specific implementation, please refer to the above method embodiment.
[0071] An embodiment of the present application also provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform any of the login methods described above.
[0072] It should be noted that, a person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the storage medium can include but is not limited to: read-only memory (ROM), random access memory (RAM), a disk or an optical disk, etc.
[0073] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A login method based on ssh, applied on the client and the target machine, characterized in that: The target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine. The login method includes the following steps: S1: The dispatch center responds to the client's login request; S2: The dispatch center sends instructions to the proxy module of the corresponding target machine according to the client's login request; S3: The proxy module of the corresponding target machine creates an ssh login according to the instruction, and connects to the ssh server of the corresponding target machine as a proxy client, and the proxy client creates a communication protocol request to connect to the dispatch center; S4: The dispatch center connects the connection of the communication protocol request created by the proxy client with the connection of the client login request according to the communication request of the proxy client to establish communication.
2. The login method according to claim 1, characterized in that: The dispatch center responds to the client's login request by establishing communication through TCP.
3. The login method according to claim 1, characterized in that: The proxy client creates a communication protocol request to connect to the dispatch center and establishes communication through TCP.
4. The login method according to claim 1, characterized in that: In step S1, the dispatch center further includes performing login authentication on the login request of the client.
5. A login method based on ssh, applied on the client and the target machine, characterized in that: The target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine. The login method includes the following steps: S1: The dispatch center responds to the client's login request; S2: The dispatch center sends instructions to the proxy module of the corresponding target machine according to the client's login request; S3: The proxy module of the corresponding target machine creates an ssh login according to the instruction, and connects to the ssh server of the corresponding target machine as a proxy client, and the scheduling center sends the login instruction through the connection.
6. The login method according to claim 5, characterized in that: The dispatch center responds to the client's login request by establishing communication through TCP.
7. The login method according to claim 5, characterized in that: The proxy client creates a communication protocol request to connect to the dispatch center and establishes communication through TCP.
8. The login method according to claim 5, characterized in that: In step S1, the dispatch center further includes performing login authentication on the login request of the client.
9. An SSH-based login system, applied to the SSH-based login method according to any one of claims 1 to 8, comprising a client and a target machine, characterized in that: The target machine is provided with an agent module, and a scheduling center is provided between the client and the target machine, wherein: The dispatch center responds to the client's login request and, based on the proxy client's communication request, connects the connection of the communication protocol request created by the proxy client with the connection of the client's login request to establish communication; The proxy module of the target machine is used to create an ssh login, and as a proxy client, is connected to the ssh server of the corresponding target machine, and the scheduling center sends a login instruction through the connection.
10. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the storage medium communicate via the bus, and the processor executes the machine-readable instructions to perform the login method as described in any one of claims 1-8.