SSH 推送（使用隧道）联系方法

SSH Push (with tunnel) (ssh-push-tunnel) is used in environments where clients cannot reach the SUSE Multi-Linux Manager Server directly. In this environment, clients are located in a firewall-protected zone called a DMZ. No system within the DMZ is authorized to open a connection to the internal network, including the SUSE Multi-Linux Manager Server.

换句话说，SSH 推送（利用隧道）还会创建从客户端到 SUSE Multi-Linux Manager 服务器的反向隧道，而不仅是从服务器到客户端的隧道。

服务器使用 SSH 定期联系客户端，以签入和执行安排的操作和事件。

在使用 SSH 推送方法管理的客户端上，目前不支持使用置备模式重新安装系统。

隧道用于通过加密隧道提供对服务器的访问。指派给 SSH 推送客户端（使用隧道）的储存库只会通过此隧道提供，因此无法直接从客户端系统使用软件包管理器工具，因为储存库仅在隧道已启动时才可用。换而言之，仅当会话由服务器发起时才可访问储存库。客户端上的所有软件包管理操作只能从服务器端执行。

Use mgrctl term before running steps inside the server container.

For tunneling connections via SSH, a port number is required for tunneling via HTTPS. The port number used by default is 1233. To overwrite it, inside the container, you can add a custom port numbers greater than 1024 to /etc/rhn/rhn.conf:

ssh_push_port_https = high_port

After changing this configuration parameter you must restart services such as salt-secrets-config.service, tomcat.service, and taskomatic.service. To cover all needed services, it is the best to restart the SUSE Multi-Linux Manager Server as root. Outside of the container, from the container host, enter:

mgradm restart

出于安全原因，您可能需要结合使用 sudo 和 SSH，以非特权用户身份而不是 root 身份访问系统。

过程：配置非特权 SSH 访问

在每个客户端系统上，创建相应的非特权用户。
On each client system, edit the sudoers file:
```
sudo visudo
```

Grant sudo access to the user by adding this line at the end of the sudoers file. Replace <user> with the name of the user that is bootstrapping the client in the Web UI:

<user>  ALL=NOPASSWD: /usr/bin/python3, /var/tmp/venv-salt-minion/bin/python

This procedure grants root access without requiring a password, which is required for registering the client. When the client is successfully installed it runs with root privileges, so the access is no longer required. We recommend that you remove the line from the sudoers file after the client has been successfully installed.

Inside the SUSE Multi-Linux Manager Server container, edit the /etc/rhn/rhn.conf configuration file, and add or amend this line to include the unprivileged username:
```
ssh_push_sudo_user = <user>
```

mgradm restart

需要使用 Web UI 或 API 将这些客户端注册到 SUSE Multi-Linux Manager 服务器。

开始前，需要确保已指定要用于 SSH 隧道的端口。如果在更改端口号之前已注册客户端，则需要使用重新激活密钥再次注册客户端。

有关引导的详细信息，请参见使用引导脚本注册客户端。
有关引导的详细信息，请参见 client-configuration:activation-keys.adoc#activation-keys-reactivation。

示例：通过 API 使用 SSH 推送（利用隧道）方法

You can use the API to manage which contact method to use. This example Python code sets the contact method to ssh-push-tunnel.

client = xmlrpclib.Server(MLM_HOST + "/rpc/api", verbose=0)
key = client.auth.login(MLM_LOGIN, MLM_PASSWORD)
client.system.setDetails(key, 1000012345, {'contact_method' : 'ssh-push-tunnel'})

有效值为：

default (pull)
ssh-push
ssh-push-tunnel