14 Sep 2015
目前的linux distribution基本都会预装openssh，我们会使用openssh自带的ssh-keygen命令来生成密钥。 密钥登陆除了方便不用输密码，还可以用于同时管理多台server。
ssh-keygen -b 1024 -t rsa # '-b'指定key的字节数，'-t'指定key的类型(rsa、dsa等) Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): # 配置key路径，默认即可 # key路径如果不是默认，需要用"ssh -i /path/to/keyfile user@ip"来指定，否则会报错 Enter passphrase (empty for no passphrase): # 配置密钥短语（重要），默认为空 Enter same passphrase again: # 二次重复密钥短语 Your identification has been saved in /root/.ssh/id_rsa. # 认证文件 Your public key has been saved in /root/.ssh/id_rsa.pub. # key文件 The key fingerprint is: # key的指纹 ed:bf:9b:32:3c:53:c8:b2:76:13:79:70:c6:29:48:38 root@localhost.localdomain The key\'s randomart image is: # key的随机图片验证 +--[ RSA 1024]----+ | . | | E . | | o . . . | | ..o = | | S..B | | ..= o | | +.+ | | o O. . | | . . *=o | +-----------------+ # ssh-keygen的具体语法可以man ssh-keygen查看 # -b 指定的是key字节数，越长越安全，不过1024足够了 # -t 指定的是key类型，详细可以看man ssh-keygen # passphrase最好指定，设定为空的话不安全。（passphrase > key > password 会增强安全度）
手动拷贝
# 拷贝密钥文件 scp /root/.ssh/id_rsa.pub root@192.168.0.96:/root/.ssh/authorized_keys # 修改密钥文件权限 ssh root@192.168.0.96 chmod 600 /root/.ssh/authorized_keys # 修改~/.ssh目录权限 ssh root@192.168.0.96 chmod 700 /root/.ssh ## 记得关闭目标机器的selinux ## 记得把目标机器的ssh端口在防火墙开启
ssh-copy-id命令拷贝
ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.0.96 /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@192.168.0.96\'s password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'root@192.168.0.96'" and check to make sure that only the key(s) you wanted were added. # 登陆目标机器 ssh root@192.168.0.96 Enter passphrase for key '/root/.ssh/id_rsa': # 输入密码短语 Last login: Mon Sep 14 11:01:57 2015 from 192.168.0.213 ll .ssh/ total 12 -rw------- 1 root root 240 Sep 14 11:01 authorized_keys -rw-r--r-- 1 root root 175 Aug 10 09:54 known_hosts # 新方法ssh-copy-id -i 公玥文件 username@domain/ip # 相当于用一个命令取代了上面的拷贝文件、修改名称、修改权限的操作
# 启动ssh-agent eval $(ssh-agent) Agent pid 8865 # 增加/root/.ssh/id_rsa的agent ssh-add Enter passphrase for /root/.ssh/id_rsa: Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa) #ssh-add 没有参数的时候会默认添加以下文件 # ~/.ssh/id_rsa, ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/identity. # 查看当前的agent 连接 ssh-add -l 1024 ed:bf:9b:32:3c:53:c8:b2:76:13:79:70:c6:29:48:38 /root/.ssh/id_rsa (RSA) # 关闭agent 连接 ssh-agent -k unset SSH_AUTH_SOCK; unset SSH_AGENT_PID; echo Agent pid 8865 killed; ssh-add -l Could not open a connection to your authentication agent.
# 配置文件类型 # ~/.ssh/config :用户私有的配置文件，相应配置优先级高于全局文件中的配置 # /etc/ssh/ssh_config:全局配置文件 # 禁用密码登陆 vim /etc/ssh/sshd_config ************************** PasswordAuthentication no ChallengeResponseAuthentication no ************************** # 根据host分配认证文件 vim ~/.ssh/config ************************** Host server1 HostName 172.16.2.3 User root Port 22 IdentityFile /root/.ssh/172.16.2.3 ************************** # Host:自定义字段，就是一个名称，用ssh匹配到此名称后使用此Host段的配置 # HostName: ip地址或域名 # User: 登陆用户名 # Port: 登陆端口 # IdentityFile: 指定私有key路径 # 直接用server1关键字访问 ssh server1