Due to a lack of complete examples, here's a simple SSH2 class for connecting to a server, authenticating with public key authentication, verifying the server's fingerprint, issuing commands and reading their STDOUT and properly disconnecting. Note: You may need to make sure you commands produce output so the response can be pulled. Some people suggest that the command is not executed until you pull the response back.
<?php
class NiceSSH {
// SSH Host
private $ssh_host = 'myserver.example.com';
// SSH Port
private $ssh_port = 22;
// SSH Server Fingerprint
private $ssh_server_fp = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
// SSH Username
private $ssh_auth_user = 'username';
// SSH Public Key File
private $ssh_auth_pub = '/home/username/.ssh/id_rsa.pub';
// SSH Private Key File
private $ssh_auth_priv = '/home/username/.ssh/id_rsa';
// SSH Private Key Passphrase (null == no passphrase)
private $ssh_auth_pass;
// SSH Connection
private $connection;
public function connect() {
if (!($this->connection = ssh2_connect($this->ssh_host, $this->ssh_port))) {
throw new Exception('Cannot connect to server');
}
$fingerprint = ssh2_fingerprint($this->connection, SSH2_FINGERPRINT_MD5 | SSH2_FINGERPRINT_HEX);
if (strcmp($this->ssh_server_fp, $fingerprint) !== 0) {
throw new Exception('Unable to verify server identity!');
}
if (!ssh2_auth_pubkey_file($this->connection, $this->ssh_auth_user, $this->ssh_auth_pub, $this->ssh_auth_priv, $this->ssh_auth_pass)) {
throw new Exception('Autentication rejected by server');
}
}
public function exec($cmd) {
if (!($stream = ssh2_exec($this->connection, $cmd))) {
throw new Exception('SSH command failed');
}
stream_set_blocking($stream, true);
$data = "";
while ($buf = fread($stream, 4096)) {
$data .= $buf;
}
fclose($stream);
return $data;
}
public function disconnect() {
$this->exec('echo "EXITING" && exit;');
$this->connection = null;
}
public function __destruct() {
$this->disconnect();
}
}
?>
[EDIT BY danbrown AT php DOT net: Contains two bugfixes suggested by 'AlainC' in user note #109185 (removed) on 26-JUN-2012.]
PHP - Manual: ssh2_connect
2024-11-14
ssh2_connect
(PECL ssh2 >= 0.9.0)
ssh2_connect — Connect to an SSH server
说明
ssh2_connect(
string
int
array
array
): resource
string
$host,int
$port = 22,array
$methods = ?,array
$callbacks = ?): resource
Establish a connection to a remote SSH server.
Once connected, the client should verify the server's hostkey using ssh2_fingerprint(), then authenticate using either password or public key.
参数
-
host -
-
port -
-
methods -
methodsmay be an associative array with up to four parameters as described below.methodsmay be an associative array with any or all of the following parameters.Index Meaning Supported Values* kex List of key exchange methods to advertise, comma separated in order of preference. diffie-hellman-group1-sha1,diffie-hellman-group14-sha1, anddiffie-hellman-group-exchange-sha1hostkey List of hostkey methods to advertise, comma separated in order of preference. ssh-rsaandssh-dssclient_to_server Associative array containing crypt, compression, and message authentication code (MAC) method preferences for messages sent from client to server. server_to_client Associative array containing crypt, compression, and message authentication code (MAC) method preferences for messages sent from server to client. * - Supported Values are dependent on methods supported by underlying library. See » libssh2 documentation for additional information.
client_to_serverandserver_to_clientmay be an associative array with any or all of the following parameters.Index Meaning Supported Values* crypt List of crypto methods to advertise, comma separated in order of preference. rijndael-cbc@lysator.liu.se,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, andnone**comp List of compression methods to advertise, comma separated in order of preference. zlibandnonemac List of MAC methods to advertise, comma separated in order of preference. hmac-sha1,hmac-sha1-96,hmac-ripemd160,hmac-ripemd160@openssh.com, andnone**注意: Crypt and MAC method "
none"For security reasons,
noneis disabled by the underlying » libssh2 library unless explicitly enabled during build time by using the appropriate ./configure options. See documentation for the underlying library for more information. -
callbacks -
callbacksmay be an associative array with any or all of the following parameters.Callbacks parameters Index Meaning Prototype ignore Name of function to call when an SSH2_MSG_IGNOREpacket is receivedvoid ignore_cb($message) debug Name of function to call when an SSH2_MSG_DEBUGpacket is receivedvoid debug_cb($message, $language, $always_display) macerror Name of function to call when a packet is received but the message authentication code failed. If the callback returns true, the mismatch will be ignored, otherwise the connection will be terminated.bool macerror_cb($packet) disconnect Name of function to call when an SSH2_MSG_DISCONNECTpacket is receivedvoid disconnect_cb($reason, $message, $language)
返回值
Returns a resource on success, or false on error.
范例
示例 #1 ssh2_connect() example
Open a connection forcing 3des-cbc when sending packets, any strength aes cipher when receiving packets, no compression in either direction, and Group1 key exchange.
<?php
/* Notify the user if the server terminates the connection */
function my_ssh_disconnect($reason, $message, $language) {
printf("Server disconnected with reason code [%d] and message: %s\n",
$reason, $message);
}
$methods = array(
'kex' => 'diffie-hellman-group1-sha1',
'client_to_server' => array(
'crypt' => '3des-cbc',
'comp' => 'none'),
'server_to_client' => array(
'crypt' => 'aes256-cbc,aes192-cbc,aes128-cbc',
'comp' => 'none'));
$callbacks = array('disconnect' => 'my_ssh_disconnect');
$connection = ssh2_connect('shell.example.com', 22, $methods, $callbacks);
if (!$connection) die('Connection failed');
?>
参见
- ssh2_fingerprint() - Retrieve fingerprint of remote server
- ssh2_auth_none() - Authenticate as "none"
- ssh2_auth_password() - Authenticate over SSH using a plain password
- ssh2_auth_pubkey_file() - Authenticate using a public key
- ssh2_disconnect() - Close a connection to a remote SSH server
add a note
User Contributed Notes 7 notes
Steve Kamerman ¶
10 years ago
thessoro at gmail dot com ¶
7 years ago
Be careful when providing a specific hostkey order.
<?php
ssh2_connect('IP', 'port', array('hostkey'=>'ssh-rsa, ssh-dss'));
?>
Will only work when the public key of the server is RSA, and not DSA also as expected. This is caused by the empty space before the "ssh-dss".
So a similar code:
<?php
ssh2_connect('IP', 'port', array('hostkey'=>'ssh-rsa,ssh-dss'));
?>
Will work. The HOSTKEY method is overriden using exactly what you write, so no empty spaces are allowed.
This took me some time that you could save ;)
christophermjgray at gmail dot com ¶
4 years ago
This page is out of date. Any of the SHA-1 in the Key Exchange Methods in the kex section should be discarded, due to Logjam (https://weakdh.org/logjam.html). If you continue to use them, connects will result in the following warning:
"Warning: ssh2_connect(): Error starting up SSH connection(-5): Unable to exchange encryption keys in ..."
The following is an example of what works. Also by removing the 'hex' section all together, results in libssl (https://libssh2.org/) falling back to discovering which is the strongest cipher to authenticate with.
<?php
if (!function_exists("ssh2_connect")) die("function ssh2_connect doesn't exist");
function ssh2_debug($message, $language, $always_display) {
printf("%s %s %s\n",$message,$language,$always_display);
}
/* Notify the user if the server terminates the connection */
function my_ssh_disconnect($reason, $message, $language) {
printf("Server disconnected with reason code [%d] and message: %s\n", $reason, $message);
}
$methods = array(
'hostkey'=>'ssh-rsa,ssh-dss',
// 'kex' => 'diffie-hellman-group-exchange-sha256',
'client_to_server' => array(
'crypt' => 'aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc',
'comp' => 'none'),
'server_to_client' => array(
'crypt' => 'aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc',
'comp' => 'none'));
$callbacks = array('disconnect' => 'my_ssh_disconnect');
foreach (array('192.168.1.1') as $host) {
$connection = ssh2_connect($host, 22, $methods, $callbacks);
if (!$connection) die("Connection failed:");
ssh2_auth_password($connection, 'user', 'my_password') or die("Unable to authenticate");
$stream = ssh2_exec($connection, 'free -m');
stream_set_blocking($stream, true);
$stream_out = ssh2_fetch_stream($stream, SSH2_STREAM_STDIO);
echo stream_get_contents($stream_out);
}
?>
jrdbrndt at gmail dot com ¶
2 years ago
Trying to include "aes256-cbc" in the encryption methods list caused an error. The documentation here may be out of date, and you might find a more accurate list of what values are acceptable by checking the libssh2 documentation at libssh2.org.
Trev White ¶
8 years ago
Hi,
If you are having problems with running a ssh2 session and it waits forever during the execution of stream_get_contents, it might be because the remote system has run the command and is now sitting at a # prompt waiting for the next command. I had this issue on a HP MSA box, here is the code to get around the issue.
Assuming you are connected with your authentication method and $ssh contains the handle.
<?php
$command = "check disk";
// Open a nice large window to stop wrapping
$stream = ssh2_shell ($ssh, 'xterm', null, 200, 200, SSH2_TERM_UNIT_CHARS);
// Hook into the error stream
$errorStream = ssh2_fetch_stream($stream, SSH2_STREAM_STDERR);
// Block the streams so we wait until they complete
stream_set_blocking ($stream, true);
stream_set_blocking($errorStream, true);
// Send the commands to the terminal
fwrite ($stream, $command . PHP_EOL );
// Wait give the terminal a chance to accept and start processing the command, this is a slow storage device after all
sleep(2);
// IMPORTANT BIT!! Send exit to the terminal to close the connection BEFORE WE WAIT FOR THE STREAM
fwrite ($stream, "exit" . PHP_EOL );
sleep (2);
// Print the output
echo stream_get_contents($stream);
$errortext=stream_get_contents($errorStream);
if (strlen($errortext) > 0) {
// Error Data
echo "Error Data: $errortext";
exit (1);
}
// All Good
exit (0);
?>
You can't use ssh2_exec with this method (well at lease I couldn't) because on executing the first command the stream gets blocked and then you can't run the exit command, whereas a terminal seems to use one session.
I hope this helps someone.
suri dot suribala dot com ¶
17 years ago
With Sara's help, I have the following SS2 class that is quite flexible. If anyone improves it, please feel free to let me know.
<?php
// ssh protocols
// note: once openShell method is used, cmdExec does not work
class ssh2 {
private $host = 'host';
private $user = 'user';
private $port = '22';
private $password = 'password';
private $con = null;
private $shell_type = 'xterm';
private $shell = null;
private $log = '';
function __construct($host='', $port='' ) {
if( $host!='' ) $this->host = $host;
if( $port!='' ) $this->port = $port;
$this->con = ssh2_connect($this->host, $this->port);
if( !$this->con ) {
$this->log .= "Connection failed !";
}
}
function authPassword( $user = '', $password = '' ) {
if( $user!='' ) $this->user = $user;
if( $password!='' ) $this->password = $password;
if( !ssh2_auth_password( $this->con, $this->user, $this->password ) ) {
$this->log .= "Authorization failed !";
}
}
function openShell( $shell_type = '' ) {
if ( $shell_type != '' ) $this->shell_type = $shell_type;
$this->shell = ssh2_shell( $this->con, $this->shell_type );
if( !$this->shell ) $this->log .= " Shell connection failed !";
}
function writeShell( $command = '' ) {
fwrite($this->shell, $command."\n");
}
function cmdExec( ) {
$argc = func_num_args();
$argv = func_get_args();
$cmd = '';
for( $i=0; $i<$argc ; $i++) {
if( $i != ($argc-1) ) {
$cmd .= $argv[$i]." && ";
}else{
$cmd .= $argv[$i];
}
}
echo $cmd;
$stream = ssh2_exec( $this->con, $cmd );
stream_set_blocking( $stream, true );
return fread( $stream, 4096 );
}
function getLog() {
return $this->log;
}
}
?>
rainerkrauss at googlemail dot com ¶
8 years ago
Warning! If you open a ssh connection and execute an external program opening another ssh connection it may result in very strange behavior.
I used an sftp connection to get a file list and used "exec" to download the files afterwards with an external sftp. lftp downloaded zeros with no comment, psftp exits with error code 11 most of the time, but sometimes it works - probably depending on how quickly php collects garbage and closes the unused connection first.
As there is no function to close a connection, you need to be sure to destroy all references (unset) to close it.
官方地址：https://www.php.net/manual/en/function.ssh2-connect.php
IT
PHP
编程语言
Linux
开发编程
科技
Elasticsearch
HTML/CSS/XML
网络
JAVA
NoSQL
数据库
面试
C/C++
Golang
Git
算法
操作系统
正则表达式
Redis
互联网
MySql
JavaScript
运维
软件
国际
架构设计
Mac OS
TCP/IP
Excel
Vim
Windows
Socket
Oracle
VR
MongoDB
Python
运营
MemCache
商业
硬件
电子
娱乐
设计
nginx
摄影
游戏
WordPress
HTTP
团建
数码电器
广告
--
php7 安装fileinfo扩展
preg_split — 通过一个正则表达式分隔字符串
php位值,解决 PHP 中 usort 在值相同时改变原始位置的问题
[PHP] inet_pton/inet_ntop IP地址转换函数
array_multisort() 多字段排序
PHPMailer设置utf8 PHPMailer字符集CharSet
ADORecordSet对象
adodb手册
PHP 8.1
[鸟哥]PHP_INT_MIN 和 -9223372036854775808
opcache预加载
Composer的Packagist资源
mysql面试题
[鸟哥]PHP FFI详解 - 一种全新的PHP扩展方式
PHP7添加redis扩展
PHP mkdir()写出来的权限与mode值不符合
Packagist / Composer 中国全量镜像
php中几种注释规范
PHP获取指定函数定义在哪个文件中及行号
支持php7的性能采集扩展