ssh -L <本地端口>:<目标服务器地址>:<目标服务器端口> <SSH用户名>@<SSH服务器地址>

ssh -L 9000:localhost:9000 user@10.0.0.2

$ vim /etc/netplan/00-installer-config.yaml

# This is the network config written by 'subiquity'
network:
  ethernets:
    ens33:
      dhcp4: false # close dhcp (set true is open)
      addresses:
        - 10.0.0.50/24 # set static ip
      routes:
        - to: default
          via: 10.0.0.1 # set gateway
      nameservers:
        addresses: [8.8.8.8] # dns
  version: 2

$ sudo netplan apply

#!/bin/bash
##
##  new-server-cert.sh - create the server cert
##  Copyright (c) 2000 Yeak Nai Siew, All Rights Reserved.
##

KEYBITS=4096
HASHALGO="sha256"

# Create the key. This should be done once per cert.
CN=$1
if [ $# -lt 1 ]; then
    echo "Usage: $0 <www.domain.com> [subjectAltName1 [san2 ...]]"
    exit 1
fi

# force the CN to become a SAN even if no other SANs; Chrome compatibility
subjectAltNames="$*"

# if private key exists, ask if we want to generate a new key
if [ -f $CN.key ]; then
    read -p "a key for this cn is already existing, generate a new one? " ANSWER
    if [ "$ANSWER" == "Y" ] || [ "$ANSWER" == "y" ]; then
        rm -f $CN.key
    fi
fi

if [ ! -f $CN.key ]; then
    echo "No $CN.key found. Generating one"
    openssl genrsa -out $CN.key $KEYBITS
    echo ""
fi

# Fill the necessary certificate data
CONFIG="server-cert.conf"
cat >$CONFIG <<EOT
[ req ]
default_bits                    = $KEYBITS
default_keyfile                 = server.key
default_md                      = $HASHALGO
distinguished_name              = req_distinguished_name
string_mask                     = nombstr
req_extensions                  = v3_req
[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = CN
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Shanghai
localityName                    = Locality Name (eg, city)
localityName_default            = Shanghai
0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = optional
organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = optional
commonName                      = Common Name (eg, www.domain.com)
commonName_default              = $CN
commonName_max                  = 64
emailAddress                    = Email Address
emailAddress_max                = 40
[ v3_req ]
nsCertType                      = server
basicConstraints                = critical,CA:false
keyUsage                = nonRepudiation, digitalSignature, keyEncipherment
EOT

# Handle optional Subject Alternate Names
if [ "$subjectAltNames" != "" ]; then
    echo "subjectAltName = @alt_names" >> $CONFIG
    echo "[alt_names]" >> $CONFIG
    numi=1
    numd=1
    cn_already_added=0

    # CN is added to the SAN list automatically
    for san in $CN  $subjectAltNames; do
        # if CN has already been seen, skip it
        if [ "$san" = "$CN" ]; then
            if [ $cn_already_added -eq 0 ]; then
                cn_already_added=1
            else
                continue     #skip to next SAN
            fi
        fi

        # determine if this looks like an IP or a DNS name
        echo $san | egrep '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$' &> /dev/null
    if [ $? -eq 0 ]; then
            echo "IP.$numi = $san" >> $CONFIG
            let numi++
        else
            echo "DNS.$numd = $san" >> $CONFIG
            let numd++
        fi
    done
fi

echo "Fill in certificate data"
openssl req -new -config $CONFIG -key $CN.key -out $CN.csr

rm -f $CONFIG

echo ""
echo "You may now run ./sign-server-cert.sh to get it signed"

#!/bin/bash
##
##  sign-server-cert.sh - sign using our root CA the server cert
##  Copyright (c) 2000 Yeak Nai Siew, All Rights Reserved.
##

HASHALGO="sha256"
VALID_DAYS=365
RANDOM_SRC=/dev/urandom

CN=$1
if [ $# -ne 1 ]; then
    echo "Usage: $0 <www.domain.com>"
    exit 1
fi
if [ ! -f $CN.csr ]; then
    echo "No $CN.csr found. You must create that first."
        exit 1
fi
# Check for root CA key
if [ ! -f ca.key -o ! -f ca.crt ]; then
        echo "You must have root CA key generated first."
        exit 1
fi

# Sign it with our CA key #

#   make sure environment exists
if [ ! -d ca.db.certs ]; then
    mkdir ca.db.certs
fi
if [ ! -f ca.db.serial ]; then
    echo '01' >ca.db.serial
fi
if [ ! -f ca.db.index ]; then
    cp /dev/null ca.db.index
fi


#  create the CA requirement to sign the cert
cat >ca.config <<EOT
[ ca ]
default_ca              = default_CA
[ default_CA ]
dir                     = .
certs                   = \$dir
new_certs_dir           = \$dir/ca.db.certs
database                = \$dir/ca.db.index
serial                  = \$dir/ca.db.serial
RANDFILE                = ${RANDOM_SRC}
certificate             = \$dir/ca.crt
private_key             = \$dir/ca.key
default_days            = ${VALID_DAYS}
default_crl_days        = 30
default_md              = $HASHALGO
preserve                = no
x509_extensions         = server_cert
policy                  = policy_anything
[ policy_anything ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional
[ server_cert ]
#subjectKeyIdentifier   = hash
authorityKeyIdentifier  = keyid:always
extendedKeyUsage        = serverAuth,clientAuth,msSGC,nsSGC
basicConstraints        = critical,CA:false
[req]
default_md              = $HASHALGO
req_extensions          = v3_req
[ v3_req ]
extendedKeyUsage        = serverAuth, clientAuth
EOT

# Test for Subject Alternate Names
subjaltnames="`openssl req -text -noout -in $CN.csr | sed -e 's/^ *//' | grep -A1 'X509v3 Subject Alternative Name:' | tail -1 | sed -e 's/IP Address:/IP:/g'`"
if [ "$subjaltnames" != "" ]; then
    echo "Found subject alternate names: $subjaltnames"
    echo ""
    echo "subjectAltName          = $subjaltnames" >> ca.config
fi

#  revoke an existing old certificate
if [ -f $CN.crt ]; then
    echo "Revoking current certificate: $CN.crt"
    openssl ca -revoke $CN.crt -config ca.config
fi

#  sign the certificate
echo "CA signing: $CN.csr -> $CN.crt:"
openssl ca -config ca.config -extensions v3_req -out $CN.crt -infiles $CN.csr
echo ""
echo "CA verifying: $CN.crt <-> CA cert"
openssl verify -CAfile ca.crt $CN.crt
echo ""

#  cleanup after SSLeay
rm -f ca.config
rm -f ca.db.serial.old
rm -f ca.db.index.old

$ cat a.test.org.crt | openssl x509 -noout -enddate

$ sudo apt-get install samba samba-common

# 配置一个用户(执行后输入密码即可)
$ sudo smbpasswd -a username

# 修改配置文件
$ sudo vim /etc/samba/smb.conf

$ sudo /etc/init.d/smbd restart

$ wget https://www.python.org/ftp/python/3.10.0/Python-3.10.0.tgz
# 解压文件
$ tar -zxf Python-3.10.0.tgz

$ cd Python-3.10.0 && ./configure prefix=/usr/local/python3
$ make && make install

$ ln -s /usr/local/python3/bin/python3 /usr/bin/python3
$ ln -s /usr/local/python3/bin/pip3 /usr/bin/pip3

$ python3 --version
Python 3.10.0