ssh publickey，publickey
ssh publickey，publickey
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 |
我的博客已迁移到xdoujiang.com请去那边和我交流
一、基础信息
1、要求从117免密码登录到160 使用帐号jimmy
2、10.1.10.117发行版本
cat /etc/debian_version
7.8
3、内核版本
uname -r
3.2.0-4-amd64
4、ssh版本
1:6.0p1-4+deb7u2
5、10.1.10.160发行版本
cat /etc/debian_version
5.0.10
6、内核版本
uname -r
2.6.26-2-amd64
7、ssh版本
1:5.1p1-5
二、ssh免密码配置
1、先查询下PubkeyAuthentication和PreferredAuthentications设置情况
cat /etc/ssh/ssh_config|egrep "PubkeyAuthentication|PreferredAuthentications"
2、开启公钥和私钥认证，在/etc/ssh/ssh_config添加或修改以下内容
PubkeyAuthentication yes
3、优先使用publickey身份验证，在/etc/ssh/ssh_config添加或修改以下内容
PreferredAuthentications publickey,password
4、切换到jimmy用户
su - jimmy
5、创建.ssh目录
mkdir .ssh -p
6、产生公钥和私钥
ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/jimmy/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/jimmy/.ssh/id_rsa.
Your public key has been saved in /home/jimmy/.ssh/id_rsa.pub.
The key fingerprint is:
98:4c:31:6d:60:9b:e6:f0:11:d4:79:d7:6b:71:63:03 jimmy@debian
The key s randomart image is:
+--[ RSA 2048]----+
| .B+ . E. |
| . *= . . o+.|
| . *. . . .+o|
| B + o |
| * S . |
| |
| |
| |
| |
+-----------------+
PS:生成密钥的时候,不输入任何口令,直接3次回车
7、查看生成公钥和私钥
jimmy@debian:~$ ls .ssh/
id_rsa id_rsa.pub
8、传送key
ssh-copy-id -i jimmy@10.1.10.160
The authenticity of host '10.1.10.160 (10.1.10.160)' can't be established.
RSA key fingerprint is e0:6b:ef:86:c1:1d:bf:70:e4:cb:48:5b:9c:32:87:0f.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.1.10.160' (RSA) to the list of known hosts.
jimmy@10.1.10.160's password:
Now try logging into the machine, with "ssh 'jimmy@10.1.10.160'", and check in:
~/.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
9、需要查看下10.1.10.160机器上的/etc/ssh/sshd_config是否有配置过PubkeyAuthentication
cat /etc/ssh/sshd_config|grep "PubkeyAuthentication"
PubkeyAuthentication yes
说明支持pubkey验证
10、测试登录
jimmy@debian:~$ ssh 10.1.10.160
Linux 10.1.10.160 2.6.26-2-amd64 #1 SMP Sun Mar 4 21:48:06 UTC 2012 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
jimmy@10:~$
jimmy@10:~$ /sbin/ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:d0:6a:30
inet addr:10.1.10.160 Bcast:10.1.10.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fed0:6a30/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:21054 errors:0 dropped:0 overruns:0 frame:0
TX packets:786 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2269960 (2.1 MiB) TX bytes:104811 (102.3 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
三、常用sshd配置说明
cat /etc/ssh/sshd_config
#使用SSHv2协议
Protocol 2
#设置监听端口
Port 55000
#设置监听地址
ListenAddress 1.1.1.1
#关闭kerberos验证
kerberosauthentication no
kerberosorlocalpasswd no
kerberosticketcleanup no
#关闭质疑-应答
ChallengeResponseAuthentication no
#关闭gssapi身份验证
GSSAPIAuthentication no
GSSAPICleanupCredentials yes
#使用pubkey验证
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
#关闭hostbased和rhostsrsa验证方式
HostbasedAuthentication no
IgnoreUserKnownHosts yes
IgnoreRhosts yes
#支持密码验证
PasswordAuthentication yes
#关闭对X11的端口转发
X11Forwarding no
#关闭除loopback外的其它网络接口转发
GatewayPorts no
#不允许转发
AllowTcpForwarding no
#调整日志级别为VERBOSE
LogLevel VERBOSE
SyslogFacility AUTH
#不启用环境变量传递
AcceptEnv none
AllowUsers *
DenyUsers daemon bin sys sync games man lp mail news uucp proxy www-data backup list irc gnats nobody Debian-exim statd identd sshd libuuid snmp
#登录之前显示在用户屏幕上
Banner /etc/issue
#不需要显示每一次成功登录后/etc/motd中的信息
PrintMotd no
#不需要显示每一次成功登录后最后一位用户的登录信息
PrintLastLog no
#指定支持的数据对称加密算法及指定支持的消息摘要算法
ciphers aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,arcfour128,arcfour256,arcfour,blowfish-cbc,cast128-cbc
macs hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96
#每300秒向客户端发送一次alive消息
clientaliveinterval 300
#如果两次alive消息都没有到达目的主机则断开连接
clientalivecountmax 2
#关闭tcpkeepalive
tcpkeepalive no
#允许未认证连接1000次
MaxStartups 1000
#认证时限20秒
LoginGraceTime 20
#允许输错3次密码
MaxAuthTries 3
#开启压缩
Compression yes
#不使用dns反向解析
UseDNS no
#使用/etc/pam.d/sshd配置
UsePAM yes
#在连接前检查权限等,预防可能出现的低级错误
strictmodes yes
#不允许root用户使用ssh登陆
PermitRootLogin no
#不允许root用户空口令登录系统
PermitEmptyPasswords no
#防止通过有缺陷的子进程提升权限
UsePrivilegeSeparation yes
#不使用login程序登录
UseLogin no
#启用sftp服务
Subsystem sftp /usr/lib/openssh/sftp-server
PidFile /var/run/sshd.pid
#HostKey指定主机的私钥文件
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
四、常用ssh配置说明
cat /etc/ssh/ssh_config
#针对所有主机配置
Host *
#支持所有协议族
AddressFamily any
#支持SSHv2/v1,优先使用SSHv2协议
Protocol 2,1
#设置监听端口
Port 55000
#调整日志级别为VERBOSE
LogLevel VERBOSE
#关闭批处理登录方式
BatchMode no
#不检查known_hosts中主机公钥的正确性
HashKnownHosts yes
#防止DNS欺骗
CheckHostIP yes
#ssh客户端自动接受新主机的hostkey
StrictHostKeyChecking no
#允许三次尝试密码登录
NumberOfPasswordPrompts 3
#仅使用hmac-md5做为消息摘要算法
MACs hmac-md5
#仅使用arcfour(rc4)做为数据加密算法
Ciphers arcfour
#关闭质疑-应答
ChallengeResponseAuthentication no
#关闭hostbased和rhostsrsa验证方式
HostbasedAuthentication no
EnableSSHKeysign no
NoHostAuthenticationForLocalhost no
#关闭gssapi身份验证
GSSAPIAuthentication no
GSSAPIDelegateCredentials no
#支持pubkey验证
PubkeyAuthentication yes
#支持密码验证
PasswordAuthentication yes
#身份验证方式的优先顺序
PreferredAuthentications publickey,password
#客户端发现SSH服务端timeout后,3秒后断开连接
ConnectTimeout 3
#每300秒向客户端发送一次alive消息
serveraliveinterval 300
#如果两次alive消息都没有到达目的主机则断开连接
serveralivecountmax 2
#关闭tcpkeepalive
tcpkeepalive no
#关闭X11转发
ForwardX11 no
ForwardX11Trusted no
#关闭除loopback外的其它网络接口转发
GatewayPorts no
#关闭转发代理
ForwardAgent no
#关闭ssh tunnel
tunnel no
#不支持压缩
Compression no
#设置退出符号Q(因和ipmi默认退出符号一致 所以更改为Q)
EscapeChar Q
|
本文转自 xdoujiang 51CTO博客，原文链接：http://blog.51cto.com/7938217/1680308，如需转载请自行联系原作者
评论暂时关闭