Linux 利用 SSH ControlPersist 加速連線：多主機管理效能優化實戰

Ansible 等自動化工具同時管理數百台伺服器時，SSH 連線建立延遲會顯著拖慢整體執行時間。啟用 ControlMaster + ControlPersist 可複用 TCP 連線，避免重複握手驗證，單機節省約 1 秒，百機累積可省數分鐘。本文詳述 CentOS 6 編譯安裝新版 OpenSSH 並配置多路複用的完整流程。

原理與效益

• ControlMaster=auto：首次連線建立 Unix Socket (~/.ssh/control-%r@%h:%p)，後續連線複用
• ControlPersist=60s：Socket 保持 60 秒，期間新連線零握手延遲
• 僅需客戶端支援：受控端無需升級 OpenSSH

CentOS 6 編譯 OpenSSH 6.6p1 RPM (含 ControlPersist)

1. 安裝建置工具與依賴

sudo yum -y groupinstall "Development Tools"
sudo yum -y install pam-devel rpm-build rpmdevtools zlib-devel krb5-devel \
  tcp_wrappers tcp_wrappers-devel tcp_wrappers-libs

2. 設定 RPM 建置環境

mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS,TMP}
cat > ~/.rpmmacros <<'EOF'
%_topdir /home/dong.guo/rpmbuild
%_tmppath /home/dong.guo/TMP
EOF

3. 升級 OpenSSL 至最新

sudo yum update openssl

4. 下載源碼與驗證

cd ~/rpmbuild/SOURCES
wget https://mirror.team-cymru.org/pub/OpenBSD/OpenSSH/portable/openssh-6.6p1.tar.gz
wget https://mirror.team-cymru.org/pub/OpenBSD/OpenSSH/portable/openssh-6.6p1.tar.gz.asc
openssl dgst -sha1 openssh-6.6p1.tar.gz
# 對照官方 SHA1: b850fd1af704942d9b3c2eff7ef6b3a59b6a6b6e

5. 處理 SPEC 檔並建置

cd ~/rpmbuild/SPECS
tar xfz ../SOURCES/openssh-6.6p1.tar.gz openssh-6.6p1/contrib/redhat/openssh.spec
mv openssh-6.6p1/contrib/redhat/openssh.spec openssh-6.6p1.spec
rm -rf openssh-6.6p1

# 修改 SPEC：停用 GNOME/X11 askpass、更新 BuildRequires 語法
sed -i 's/%define no_gnome_askpass 0/%define no_gnome_askpass 1/' openssh-6.6p1.spec
sed -i 's/%define no_x11_askpass 0/%define no_x11_askpass 1/' openssh-6.6p1.spec
sed -i 's/BuildPreReq/BuildRequires/g' openssh-6.6p1.spec

rpmbuild -ba openssh-6.6p1.spec

6. 安裝生成的 RPM

cd ~/rpmbuild/RPMS/x86_64
sudo rpm -e openssh-askpass openssh-ldap 2>/dev/null
sudo rpm -Fvh openssh*6.6p1-1*rpm

客戶端配置 ~/.ssh/config

Host *
    ControlMaster auto
    ControlPath ~/.ssh/control-%r@%h:%p
    ControlPersist 60s
    # 可加入壓縮加速低頻寬連線
    Compression yes
    ServerAliveInterval 30
    ServerAliveCountMax 3

驗證多路複用生效

ssh -v user@host  # 首次連線看到 "Setting up multiplexing master"
ssh -O check user@host  # 檢查 master 狀態
ssh -O exit user@host   # 手動關閉 master

Ansible 整合

ansible.cfg 設定：

[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=~/.ssh/control-%r@%h:%p
pipelining = True
control_path = ~/.ssh/control-%r@%h:%p