项目背景：
有些时候，我们不想用户直接连接我们的服务器，所以我们会在中间设置一个堡垒！！！这也是堡垒机最本质的用途！，今天，我们自己写一个，用python！
实验环境：
vmware workstation 11
服务器A：ip：192.168.0.19 关闭iptables setenforce0
服务器B：ip：192.168.0.25 关闭iptables setenforce0
服务器C：ip：192.168.0.13 关闭 iptables setenforce0
paramiko模块
SecureCRT （ssh远程连接软件）
实验过程：
一、首相在服务器A上安装paramiko模块
#easy_install paramiko
直接就能安装上去，然后我们就可以使用了。
二、堡垒机程序创建：
[root@Python ~]# cat Fortress_machine.py
#!/usr/bin/env python
import paramiko
import os,sys,time
print "This is fuchao1 Fortress_machine!!!"
blip =raw_input("please input baolei ip:")
bluser =raw_input("please input baolei username:")
blpasswd=raw_input("please input baolei password:")
hostname = raw_input("please input fuwuqi ip:")
username = raw_input("please input fuwuqi username:")
password = raw_input("please input fuwuqi password:")
port =raw_input("please input connect port:")
passinfo = ‘\‘s password: ‘
paramiko.util.log_to_file(‘syslogin.log‘)
ssh=paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(hostname=blip,username=bluser,password=blpasswd)
channel=ssh.invoke_shell()
channel.settimeout(10)
buff =‘‘
resp =‘‘
channel.send(‘ssh ‘+username+‘@‘+hostname+‘\n‘)
while not buff.endswith(passinfo):
try:
resp = channel.recv(9999)
except Exception,e:
print ‘Error info:%s connection time.‘% (str(e))
channel.close()
ssh.close()
sys.exit()
buff +=resp
if not buff.find(‘yes/no‘)==-1:
channel.send(‘yes\n‘)
buff=‘‘
channel.send(password+‘\n‘)
buff=‘‘
while not buff.endswith(‘# ‘):
resp =channel.recv(9999)
if not resp.find(passinfo)==-1:
print ‘Error info: Authentication failed.‘
channel.close()
ssh.close()
sys.exit()
buff+=resp
channel.send(‘ifconfig\n‘)
buff=‘‘
try:
while buff.find(‘# ‘)==-1:
resp =channel.recv(9999)
buff +=resp
except Exception,e:
print "error info:"+str(e)
print buff
channel.close()
ssh.close()
三、堡垒机测试：
[root@Python ~]# python Fortress_machine.py
This is fuchao1 Fortress_machine!!!
please input baolei ip:192.168.0.25
please input baolei username:root
please input baolei password:123456
please input fuwuqi ip:192.168.0.13
please input fuwuqi username:root
please input fuwuqi password:123456
please input connect port:22
ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:86:D2:12
inet addr:192.168.0.13 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe86:d212/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:268557 errors:0 dropped:0 overruns:0 frame:0
TX packets:48707 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:44749401 (42.6 MiB) TX bytes:3234483 (3.0 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:688 (688.0 b) TX bytes:688 (688.0 b)
可以看到 我通过堡垒机192.168.0.25，连接到受保护的服务器192.168.0.13上面了，当然你可以自定义堡垒机ip和用户，受保护服务器ip和用户，还有连接的端口。简直太棒了！而且你可以自定义想要执行的命令！！！
谢谢大家，希望大家能得到学习，知识在于分享！！！
本文出自 “积少成多” 博客，请务必保留此出处http://9399369.blog.51cto.com/9389369/1751931
原文地址：http://9399369.blog.51cto.com/9389369/1751931
