-D [bind_address:]port Specifies alocal ``dynamic application-level port forwarding. This works by allocating asocketto listen to port onthelocal side, optionally bound tothe specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, andthe application protocol is then used to determine where to connect tofromthe remote machine. Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act asa SOCKS server. Only root can forward privileged ports.
我们来简单画下它的工作流程：
1 2 3 4 5 6 7
|----client----||-----server----| |||| | local port<| <incoming || | ssh port<>| <--------------> |<> ssh port | | forwarding>| >outgoing connection
-L [bind_address:]port:host:hostport Specifies thatthegiven port onthelocal (client) host isto be forwarded tothegiven host and port onthe remote side. This works by allocating a socket to listen to port onthelocal side, optionally bound tothe specified bind_address. Whenever a con- nection is made to this port, the connection is forwarded over the secure channel, and a connection is made to host port hostport fromthe remote machine.
同样给出工作流程：
1 2 3 4 5 6 7
|----client----||-----server----||-----host-----| |||||| | local port<| <incoming |||| | ssh port<>| <--------------> |<> ssh port ||| | forwarding>| -------------> |>host port |
~/.ssh/config This is the per-user configuration file. The fileformatand configuration options are described in ssh_config(5). Because of the potential for abuse, this file must have strict permissions: read/writeforthe user, andnot accessible by others.
~/.ssh/authorized_keys Lists the public keys (DSA/ECDSA/RSA) that can be used forlog- ging inas this user. The formatof this file is described in the sshd(8) manual page. This file is not highly sensitive, but the recommended permissions are read/writeforthe user, andnot accessible by others.
~/.ssh/identity ~/.ssh/id_dsa ~/.ssh/id_ecdsa ~/.ssh/id_rsa Contains theprivate key for authentication. These files contain sensitive data and should be readable bythe user but not acces- sible by others (read/write/execute). ssh will simply ignore a private key fileifit is accessible by others. It is possible to specify a passphrase when generating the key which will be used toencryptthe sensitive part of this fileusing3DES.
~/.ssh/identity.pub ~/.ssh/id_dsa.pub ~/.ssh/id_ecdsa.pub ~/.ssh/id_rsa.pub Contains the public key for authentication. These files are not sensitive and can (but need not) be readable by anyone.
~/.ssh/known_hosts Contains a list of host keysfor all hosts the user has logged into that are not already inthe systemwide list of known host keys. See sshd(8) for further details oftheformatof this file.
~/.rhosts This fileis used for host-based authentication (see above). On some machines this file may need to be world-readable ifthe user's home directory ison an NFS partition, because sshd(8) reads itas root. Additionally, this file must be owned bythe user, and must not have write permissions for anyone else. The recommended permission for most machines isread/writeforthe user, andnot accessible by others.
~/.shosts This fileis used in exactly the same way as .rhosts, but allows host-based authentication without permitting login with rlogin/rsh.
~/.ssh/ This directory isthe default location for all user-specific con- figuration and authentication information. There is no general requirement to keep the entire contentsof this directory secret, butthe recommended permissions are read/write/execute forthe user, andnot accessible by others.
~/.ssh/environment Contains additional definitions for environment variables; see ENVIRONMENT, above.
~/.ssh/rc Commands in this file are executed by ssh when the user logs in, just beforethe user's shell (or command) is started. See the sshd(8) manual page for more information.
/etc/hosts.equiv This fileisfor host-based authentication (see above). It should only be writable by root.
/etc/shosts.equiv This fileis used in exactly the same way as hosts.equiv, but allows host-based authentication without permitting login with rlogin/rsh.
/etc/ssh/ssh_config Systemwide configuration file. The file format and configuration options are described in ssh_config(5).
/etc/ssh/ssh_host_key /etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_rsa_key These files containthe private parts ofthe host keys and are used for host-based authentication. If protocol version1is used, ssh must be setuid root, sincethe host key is readable only by root. For protocol version2, ssh uses ssh-keysign(8) to access the host keys, eliminating the requirement that ssh be setuid root when host-based authentication is used. By default ssh isnot setuid root.
/etc/ssh/ssh_known_hosts Systemwide listof known host keys. This file should be prepared bythe system administrator tocontainthe public host keys of all machines inthe organization. It should be world-readable. See sshd(8) for further details ofthe format of this file.
/etc/ssh/sshrc Commands in this file are executed by ssh when the user logs in, just beforethe user's shell (or command) is started. See the sshd(8) manual page for more information.