# نصب بسته (معمولاً در Stage3 نصب است)
emerge --ask net-misc/openssh
# خروجی:
# [ebuild   R   ] net-misc/openssh-9.7_p1-r1  USE="..."
 
# بررسی فایل‌های نصب‌شده
equery files net-misc/openssh | grep -E 'sshd$|sshd_config'
# /usr/sbin/sshd
# /etc/ssh/sshd_config

# افزودن به runlevel پیش‌فرض
rc-update add sshd default
# خروجی:
#  * service sshd added to runlevel default
 
# شروع سرویس
rc-service sshd start
# خروجی:
#  * Starting sshd ...
 
# بررسی وضعیت
rc-service sshd status
#  * status: started

systemctl enable sshd
systemctl start sshd
systemctl status sshd
# Active: active (running)

nano /etc/ssh/sshd_config
rc-service sshd restart   # یا systemctl restart sshd

sshd -t
# بدون خروجی یعنی نحوی درست است

# /etc/ssh/sshd_config
Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers ali
AllowGroups wheel
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
Protocol 2

# ساخت کلید ed25519 (پیشنهادی، کوتاه و امن)
ssh-keygen -t ed25519 -C "ali@gentoo-laptop"
# خروجی:
# Generating public/private ed25519 key pair.
# Enter file in which to save the key (~/.ssh/id_ed25519):
# Enter passphrase (empty for no passphrase):
# Enter same passphrase again:
# Your identification has been saved in ~/.ssh/id_ed25519
# Your public key has been saved in ~/.ssh/id_ed25519.pub
 
# یا کلید RSA با طول 4096 (اگر ed25519 پشتیبانی نمی‌شود)
ssh-keygen -t rsa -b 4096 -C "ali@gentoo-laptop"

ssh-copy-id ali@gentoo-server
# خروجی:
# /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s)
# /usr/bin/ssh-copy-id: INFO: 1 key(s) remained to be installed
# ali@gentoo-server's password:
# Number of key(s) added: 1
# Now try logging into the machine, with: "ssh 'ali@gentoo-server'"

# روی سرور
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5..." >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

ssh ali@gentoo-server
# خروجی:
# Enter passphrase for key '/home/ali/.ssh/id_ed25519':
# Last login: Mon Sep 12 10:23:45 2025 from 192.168.1.5

# ~/.ssh/config
Host myserver
    HostName gentoo-server.example.com
    User ali
    Port 22
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 300
 
Host git-server
    HostName git.example.com
    User git
    IdentityFile ~/.ssh/id_ed25519_git
 
Host *
    ServerAliveInterval 60
    TCPKeepAlive yes

ssh myserver   # معادل ssh -i ~/.ssh/id_ed25519 -p 22 ali@gentoo-server.example.com

# شروع agent
eval $(ssh-agent)
# Agent pid 12345
 
# افزودن کلید
ssh-add ~/.ssh/id_ed25519
# Enter passphrase for /home/ali/.ssh/id_ed25519:
# Identity added: /home/ali/.ssh/id_ed25519
 
# لیست کلیدهای بارگذاری‌شده
ssh-add -l
# 256 SHA256:abc123... ali@gentoo-laptop (ED25519)

if [ -z "$SSH_AUTH_SOCK" ]; then
    eval $(ssh-agent) > /dev/null
    ssh-add ~/.ssh/id_ed25519 2> /dev/null
fi

emerge --ask net-analyzer/fail2ban
rc-update add fail2ban default   # OpenRC
rc-service fail2ban start
 
# یا
systemctl enable --now fail2ban

[sshd]
enabled = true
port = 22
maxretry = 3
bantime = 3600
findtime = 600

ali@gentoo-server: Permission denied (publickey).

# روی سرور بررسی کنید
ls -la ~/.ssh/
# drwx------ 2 ali ali  .ssh           (700)
# -rw------- 1 ali ali  authorized_keys (600)
 
# محتوای authorized_keys
cat ~/.ssh/authorized_keys
# باید شامل کلید عمومی شما باشد
 
# بررسی لاگ sshd روی سرور
tail -f /var/log/auth.log    # یا journalctl -u sshd
# ممکن است این پیام را ببینید: Authentication refused: bad ownership

ssh: connect to host gentoo-server port 22: Connection refused

# روی سرور
rc-service sshd status
# یا
systemctl status sshd
 
# بررسی پورت
ss -tlnp | grep :22
# tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1234,fd=3))

# /etc/ssh/sshd_config
UseDNS no
GSSAPIAuthentication no

rc-service sshd restart