sshd服务搭建与管理

sshd服务搭建与管理

环境：两台centos7 分别作为server端与client端且关闭iptables和selinux

hostname	ip
server	192.168.220.138
client	192.168.220.139

一、sshd安装

[root@server ~]# yum install openssh -y
[root@server ~]# systemctl start sshd
[root@server ~]# systemctl enable sshd
Created symlink from /etc/systemd/system/multi-user.target.wants/sshd.service to /usr/lib/systemd/system/sshd.service.

[root@server ~]# netstat -tuanp | grep sshd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      15670/sshd          
tcp        0     52 192.168.220.138:22      192.168.220.1:50243     ESTABLISHED 12831/sshd: root@pt 
tcp6       0      0 :::22                   :::*                    LISTEN      15670/sshd  

二、SSH服务器端与客户端连接步骤(鸟哥linux私房菜)

1. 服务器建立公钥档： 每一次启动 sshd 服务时，该服务会主动去找 /etc/ssh/ssh_host* 的档案，若系统刚刚安装完成时，由于没有这些公钥档案，因此 sshd 会主动去计算出这些需要的公钥档案，同时也会计算出服务器自己需要的私钥档；

2. 客户端主动联机要求： 若客户端想要联机到 ssh 服务器，则需要使用适当的客户端程序来联机，包括 ssh, pietty 等客户端程序；

3. 服务器传送公钥档给客户端： 接收到客户端的要求后，服务器便将第一个步骤取得的公钥档案传送给客户端使用 (此时应是明码传送，反正公钥本来就是给大家使用的)；

4. 客户端记录/比对服务器的公钥数据及随机计算自己的公私钥： 若客户端第一次连接到此服务器，则会将服务器的公钥数据记录到客户端的用户家目录内的 ~/.ssh/known_hosts 。若是已经记录过该服务器的公钥数据，则客户端会去比对此次接收到的与之前的记录是否有差异。若接受此公钥数据， 则开始计算客户端自己的公私钥数据；

5. 回传客户端的公钥数据到服务器端： 用户将自己的公钥传送给服务器。此时服务器：『具有服务器的私钥与客户端的公钥』，而客户端则是： 『具有服务器的公钥以及客户端自己的私钥』，你会看到，在此次联机的服务器与客户端的密钥系统 (公钥+私钥) 并不一样，所以才称为非对称式密钥系统喔。

6. 开始双向加解密： (1)服务器到客户端：服务器传送数据时，拿用户的公钥加密后送出。客户端接收后，用自己的私钥解密； (2)客户端到服务器：客户端传送数据时，拿服务器的公钥加密后送出。服务器接收后，用服务器的私钥解密。

三、SSH进行免密连接

1. 生成密钥文件

[root@server ~]# ssh-keygen ##一路回车即可
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):  #密钥文件存放位置
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:4rzD+i1+uCXlfZURw7N2lU2oRxSQbz+czs0LCV2ObDo root@server
The key's randomart image is:
+---[RSA 2048]----+
|            .==++|
|            . =+o|
|             +.+.|
|            + Xo.|
|      . S  . O++.|
|     o + .  +..+.|
|     .+.o .E.oo.o|
|      ==.  .. .oo|
|    .+==.      ..|
+----[SHA256]-----+

[root@client ~]# ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:ivMSUjEHDR5Vf4HKBu8qFwhcS9//WGVUoV8uapqHATs root@client
The key's randomart image is:
+---[RSA 2048]----+
|    +=...  ..  oo|
|   .=.+  ..  .o  |
| . o.* = .. .o  .|
|  o o . B  .  +..|
|   o . oS+   o...|
|  . o...E o .. . |
|   .o..o . *o    |
|    ooo   o+o    |
|     +.   o.     |
+----[SHA256]-----+

2. 传递公钥

[root@server ~]# ssh-copy-id 192.168.220.139
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.220.139 (192.168.220.139)' can't be established.
ECDSA key fingerprint is SHA256:/6JO29NCHl8uxOYuVCh1+YyB5zKFJqNTSvRuF5jl9F8.
ECDSA key fingerprint is MD5:18:50:d5:2e:eb:37:29:1f:b0:91:18:36:73:6b:a9:df.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:   #输入client端密码

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '192.168.220.139'"
and check to make sure that only the key(s) you wanted were added.


[root@client ~]# ssh-copy-id 192.168.220.138
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.220.138 (192.168.220.138)' can't be established.
ECDSA key fingerprint is SHA256:/6JO29NCHl8uxOYuVCh1+YyB5zKFJqNTSvRuF5jl9F8.
ECDSA key fingerprint is MD5:18:50:d5:2e:eb:37:29:1f:b0:91:18:36:73:6b:a9:df.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: 	#输入server端密码

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '192.168.220.138'"
and check to make sure that only the key(s) you wanted were added.

3. 测试

[root@server ~]# ssh [email protected]
Last login: Sat Jul 20 16:27:15 2019 from 192.168.220.138
[root@client ~]# exit
登出
Connection to 192.168.220.139 closed.

四、修改默认SSH端口号

[root@server ~]# vim /etc/ssh/sshd_config #ssh配置文件  #开头的为默认配置值
 17 #Port 22  #默认端口
 18 #AddressFamily any
 19 #ListenAddress 0.0.0.0  #ipv4监听地址
 20 #ListenAddress ::		#ipv6监听地址

 17 #Port 22
 18 Port 222   ##添加一行
 19 #AddressFamily any
 20 #ListenAddress 0.0.0.0
 21 #ListenAddress ::
 
[root@server ~]# systemctl restart sshd
[root@server ~]# netstat -tuanp | grep sshd
tcp        0      0 0.0.0.0:2222            0.0.0.0:*               LISTEN      70358/sshd          
tcp        0     52 192.168.220.138:22      192.168.220.1:50243     ESTABLISHED 12831/sshd: root@pt 
tcp6       0      0 :::2222                 :::*                    LISTEN      70358/sshd

再次通过client端连接测试

[root@client ~]# ssh [email protected]  
ssh: connect to host 192.168.220.138 port 22: Connection refused
这时需要指定连接端口只需加上-p参数即可
[root@client ~]# ssh -p 2222 [email protected]
Last login: Sat Jul 20 16:27:21 2019 from 192.168.220.139
[root@server ~]# 

五、SSH部分部分配置文件介绍

 [root@server ~]# vim /etc/ssh/sshd_config
 31 #SyslogFacility AUTH
 32 SyslogFacility AUTHPRIV
 33 #LogLevel INFO	#日志等级
 
日志存放位置可以通过rsyslog查看
[root@server ~]# vim /etc/rsyslog.conf
 56 # The authpriv file has restricted access.
 57 authpriv.*                                              /var/log/secure

[root@server ~]# vim /etc/ssh/sshd_config
 37 #LoginGraceTime 2m		#登陆时输入密码限定时长
 38 #PermitRootLogin yes	#是否允许Root登陆
 63 #PasswordAuthentication yes	#是否通过密码验证
 64 #PermitEmptyPasswords no	#是否允许空密码登陆
 105 #PrintMotd yes			#登陆时显示一些信息内容 /etc/motd 中配置
 106 #PrintLastLog yes		#显示上一次登陆信息
 117 #PidFile /var/run/sshd.pid		#放置PID的文件