Android到SSH服务器连接密码
我有一个 Android 应用程序，供大约 10 人使用，即它不会发布并且是“内部”的。该应用程序使用 jsch 将用户连接到 SSH 服务器。我在决定用户如何登录时遇到了问题。尽管该应用程序严重限制了用户登录服务器时的功能（基本上只允许上传某些文件），但他们仍然必须使用用户密码登录（每个人都使用相同的用户帐户）。我认为像这样泄露密码不是一个好主意，因此我正在考虑如何允许用户在不知道登录密码的情况下使用该应用程序。到目前为止我的想法。
(1) 生成一个ssh密钥并将其放在每个android设备上。 （我不确定如何做到这一点，或者是否可能）。
（2）将密码加密并存储在手机上，然后创建“应用密码”，供用户登录应用程序。
我想了解什么是最好的行动方案。
I have an Android app, which is intended for use by about 10 people, i.e. it will not be published and is "in house". The app connects the user to an SSH server, using jsch. I hit a problem when deciding how the user logs on. Even though the app severely limits the user's functionality when logged onto the server (basically only allowing the upload of certain files), they still have to log on, with the user password (everyone uses the same user account). I don't think it is a good idea to give away the password like this, so I am thinking of ways to allow the user to use the app without knowing the login password. My ideas so far.
(1) generate a ssh key and put it on each android device. (I'm not sure how to do this yet, or if it is possible).
(2) encrypt the password and store it on the phone and then create an "app password" for the user to login to the app.
I would like advice about what is the best course of action.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
首先，您可以在服务器端限制用户帐户可以执行的操作 - 执行此操作。 （请参阅下面的一些提示。）
其次，我将使用公钥身份验证方法。为每个用户生成（不同的）私钥并将其存储在他们的手机上（Android 手机有某种文件系统，不是吗？），可能通过密码加密（因此邪恶的手机窃贼无法使用该密钥）。
（可能有一些内置的加密密钥保存设备 - 如果是这样，您当然可以使用它。但我对 Android 的了解不够，无法在这里提供帮助。）
假设服务器使用 OpenSSH sshd，可以在该用户的主目录下放置一个
~/.ssh/authorized_keys文件，其中包含每个的公钥手机的私钥。这些关键行可以包含选项，可用于强制命令（仅允许 sftp/scp）或禁用所有类型的转发。 sshd 的 sshd_config 中提供了更多选项 - 您可能希望在用于这些上传的监狱环境，而不是使用您的主要环境。在 JSch 中，您可以使用 JSch 对象。 （免责声明：JSch 文档是我编写的。）
您还应该随应用程序一起提供服务器的公钥（而不是禁用连接检查）以防止中间人攻击。您可以使用
setKnownHosts方法向 JSch 提供已知主机密钥的列表。First, you can restrict on the server side what a user account can do - do this. (See below for some hints.)
Second, I would use the public-key authentication method. Generate (different) private keys for each of the users and store it on their phones (Android phones have some kind of file system, don't they?), maybe encrypted by a password (so evil phone thieves can't use the key).
(There might be some build-in crypto key holding device - if so, you can certainly use this. But I don't know enough about Android to help here.)
Assuming the server uses OpenSSH sshd, you can put an
~/.ssh/authorized_keysfile in the home directory of this user, which contains the public keys of each phone's private keys. These key lines can contain options, which might be used to force a command (to allow only sftp/scp) or disable all kinds of forwarding. More options are available in the sshd's sshd_config - you might want to start a separate sshd in a jailed environment for those uploads instead of using your main one.From JSch, you can enable public-key authentication by using one of the
addIdentitymethods of the JSch object. (Disclaimer: JSch documentation was written by me.)You also should deliver your server's public key with the application (and not disable checking on connection) to prevent man-in-the-middle attacks. You can use the
setKnownHostsmethod to provide the list of known host keys to JSch.既然它是一个只有 10 个用户的内部应用程序，为什么不在登录过程中发送手机的 IMEI 值呢？然后，您可以在服务器上拥有一个包含允许的 IMEI 号码的小表/文件。这有点像无线路由器的 MAC 地址过滤。
Since it's an in house app with only 10 users, why don't you send the phone's IMEI value in the login process. You could then have a small table/file on the server with permitted IMEI numbers. This would make it a bit like MAC address filtering for wireless routers.