SSH 与 HTTPS 双通道加速机制对比与 443 端口混淆穿透实战

    <section id="ssh-vs-https-comparison" class="space-y-4">
      <h2 class="text-xl sm:text-2xl font-bold text-slate-900 dark:text-white flex items-center gap-2">
        <span class="w-2 h-6 bg-brand-500 rounded-full"></span>
        1. SSH 与 HTTPS 双通道深度技术特性对比
      </h2>
      <div class="overflow-x-auto my-4">
        <table class="w-full text-left border-collapse text-xs sm:text-sm">
          <thead>
            <tr class="border-b dark:border-slate-800 bg-slate-100 dark:bg-slate-900/60 text-slate-900 dark:text-white">
              <th class="p-3">对比维度</th>
              <th class="p-3">SSH 协议 ([email protected])</th>
              <th class="p-3">HTTPS 协议 (https://github.com)</th>
            </tr>
          </thead>
          <tbody class="divide-y divide-slate-200 dark:divide-slate-800 text-slate-600 dark:text-slate-300">
            <tr>
              <td class="p-3 font-semibold text-slate-900 dark:text-white">默认网络端口</td>
              <td class="p-3 font-mono text-amber-600">TCP 22（易被局域网封禁）</td>
              <td class="p-3 font-mono text-emerald-600">TCP 443（全网通用放行）</td>
            </tr>
            <tr>
              <td class="p-3 font-semibold text-slate-900 dark:text-white">身份认证方式</td>
              <td class="p-3">非对称公私钥对 (id_ed25519)</td>
              <td class="p-3">Personal Access Token (PAT) / 凭证管理器</td>
            </tr>
            <tr>
              <td class="p-3 font-semibold text-slate-900 dark:text-white">反向代理与中继</td>
              <td class="p-3">难以被七层 HTTP 反向代理加速</td>
              <td class="p-3 text-emerald-600 font-semibold">可完美被 ghproxy.icu 等流式网关加速</td>
            </tr>
            <tr>
              <td class="p-3 font-semibold text-slate-900 dark:text-white">推送性能 (Push)</td>
              <td class="p-3">双向长连接，交互握手更快</td>
              <td class="p-3">分块 POST，受限于 http.postBuffer 大小</td>
            </tr>
          </tbody>
        </table>
      </div>
    </section>

    <!-- Section 2 -->
    <section id="ssh-over-443" class="space-y-4">
      <h2 class="text-xl sm:text-2xl font-bold text-slate-900 dark:text-white flex items-center gap-2">
        <span class="w-2 h-6 bg-brand-500 rounded-full"></span>
        2. 443 端口混淆实战：SSH over HTTPS Port 443
      </h2>
      <p class="text-slate-600 dark:text-slate-300 leading-relaxed text-sm sm:text-base">
        如果你坚持习惯使用 SSH 密钥做权限管理，但当前所处的 Wi-Fi 或企业网禁掉了 22 端口，GitHub 官方提供了一个极少人知晓的备用隧道域名：<strong>ssh.github.com</strong>，该域名专门监听在标准的 HTTPS 443 端口上运行 SSH 协议！
      </p>

      <div class="bg-slate-900 text-slate-200 p-4 rounded-xl text-xs sm:text-sm font-mono overflow-x-auto border border-slate-800">
        <div class="text-slate-400"># 编辑本地用户 SSH 配置文件：~/.ssh/config（Windows 为 C:\Users\用户名\.ssh\config）</div>
        <div>Host github.com</div>
        <div class="text-emerald-400">    Hostname ssh.github.com</div>
        <div class="text-emerald-400">    Port 443</div>
        <div>    User git</div>
        <div>    PreferredAuthentications publickey</div>
        <div>    IdentityFile ~/.ssh/id_ed25519</div>
      </div>

      <h3 class="text-base font-bold text-slate-900 dark:text-white mt-4">连通性验证：</h3>
      <div class="bg-slate-900 text-slate-200 p-3 rounded-lg text-xs font-mono overflow-x-auto">
        <div>$ ssh -T -p 443 [email protected]</div>
        <div class="text-emerald-400">Hi username! You've successfully authenticated, but GitHub does not provide shell access.</div>
      </div>
      <p class="text-slate-600 dark:text-slate-300 leading-relaxed text-sm sm:text-base">
        配置完成后，所有针对 <code>[email protected]:org/repo.git</code> 的 <code>clone</code> 与 <code>push</code> 指令都会自动转换为连接 443 端口，从容绕过防火墙对 22 端口的封锁。
      </p>
    </section>

    <!-- Section 3 -->
    <section id="ssh-proxycommand" class="space-y-4">
      <h2 class="text-xl sm:text-2xl font-bold text-slate-900 dark:text-white flex items-center gap-2">
        <span class="w-2 h-6 bg-brand-500 rounded-full"></span>
        3. 配合本地 ProxyCommand 穿透高阻断网络
      </h2>
      <p class="text-slate-600 dark:text-slate-300 leading-relaxed text-sm sm:text-base">
        若本地已搭建开发代理客户端，可在 SSH 配置中挂载 <code>ProxyCommand</code> 实现底层 TCP 流量的无缝接力：
      </p>
      <div class="bg-slate-900 text-slate-200 p-4 rounded-xl text-xs sm:text-sm font-mono overflow-x-auto border border-slate-800">
        <div class="text-slate-400"># macOS / Linux (使用 nc / netcat)</div>
        <div>Host github.com</div>
        <div>    User git</div>
        <div class="text-emerald-400">    ProxyCommand nc -X 5 -x 127.0.0.1:7890 %h %p</div>
        <div class="text-slate-400 mt-3"># Windows (使用 connect 命令)</div>
        <div>Host github.com</div>
        <div>    User git</div>
        <div class="text-emerald-400">    ProxyCommand connect -S 127.0.0.1:7890 %h %p</div>
      </div>
    </section>

    <!-- Section 4 -->
    <section id="selection-advice" class="space-y-4">
      <h2 class="text-xl sm:text-2xl font-bold text-slate-900 dark:text-white flex items-center gap-2">
        <span class="w-2 h-6 bg-brand-500 rounded-full"></span>
        4. 架构师选型建议：何时选 HTTPS，何时选 SSH？
      </h2>
      <div class="p-4 rounded-xl border border-slate-200 dark:border-slate-800 bg-white dark:bg-slate-900 text-xs sm:text-sm space-y-2">
        <ul class="list-disc list-inside space-y-2 text-slate-600 dark:text-slate-300">
          <li><strong>只读拉取、CI/CD 构建与服务器部署</strong>：一律推荐 <strong>HTTPS + ghproxy.icu 加速前缀</strong>，免密钥分发维护，速度最快；</li>
          <li><strong>日常个人开发提交（Push/Commit）</strong>：推荐 <strong>SSH over Port 443</strong>，配合 Ed25519 秘钥免输 Token，兼具安全性与端口连通率；</li>
          <li><strong>开源大型项目贡献</strong>：本地配置 <code>insteadOf</code> 规则，拉取走 HTTPS 加速镜像，推流走 SSH 官方认证通道。</li>
        </ul>
      </div>
    </section>