ssh首次登录避免输入yes、两台服务器间免密钥登录
user从服务器A首次登录服务器B，会被询问是否继续连接，这时输入yes才能继续，并把B的信息添加到A服务器user夹目录下的~/.ssh/known_hosts文件中。
即，服务器A（10.123.123.11）首次连服务器B（10.123.123.22）
[root@serverA Downloads]# ssh [email protected]
The authenticity of host '10.123.123.22 (10.123.123.22)' can't be established.
RSA key fingerprint is 78:8b:2d:20:cb:16:43:d7:b9:f5:27:c1:9c:1c:a0:66.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.123.123.22' (RSA) to the list of known hosts.
[email protected]'s password:输入密码成功连接后，A服务器的文件 ~/.ssh/known_hosts最后会新增一行 "10.123.123.22 ssh-rsa ACAAB……DWQQ=="
1.有的时候脚本中用ssh连接需要避免被询问
可以在ssh的时候带上 -o "StrictHostKeyChecking=no"参数。直接要求输入密码，连接后将Server B添加到 ~/.ssh/known_hosts
[root@serverA Downloads]# ssh -o StrictHostKeyChecking=no [email protected]
[email protected]'s password:
希望登录其它服务器避免被询问也可以在/etc/ssh/ssh_config中设置 "StrictHostKeyChecking no"，默认是注释掉的 "# StrictHostKeyChecking ask"。修改后不会被询问而直接要求输入密码，连接后同样会将Server B添加到 ~/.ssh/known_hosts
[root@serverA Downloads]# ssh [email protected]
Warning: Permanently added '10.123.123.22' (RSA) to the list of known hosts.
[email protected]'s password:
2.如果服务器B发生变化，比如重装了，服务器A再去连接服务器B就会失败，出现如下提示，
[root@serverA ~]# scp test.zip [email protected]:/root
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
6b:f4:e5:3d:52:e3:34:a7:77:54:45:0f:de:83:4b:37.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:159
RSA host key for 10.123.123.22 has changed and you have requested strict checking.
Host key verification failed.
lost connection
[root@serverA ~]#
根据提示，host key不对，去/root/.ssh/known_hosts这个文件将Server B 旧信息的那行删除就可以了。
3.两台服务器间配置免密钥登录
1）在服务器 A 上生成 rsa密钥。
登录服务器后，在任意路径下执行以下命令（要求输入 file in which to save the key 和 passphrase 时按回车）：
# ssh-keygen -t rsa
[root@serverA Downloads]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
a1:70:76:16:d7:60:3f:72:ee:9a:38:b4:bc:22:06:e8 root@serverA
The key's randomart image is:
+--[ RSA 2048]----+
| ..oo |
| o... |
| . o + . + |
| + . . + . |
| . . S . |
| . . .. |
| . . o .. |
| E o . ++ |
| . . .=o |
+-----------------+
[root@serverA Downloads]#
生成的 id_rsa.pub 默认存放在 /root/.ssh
2）将 id_rsa.pub 重命名为serverA.pub传到服务器B，需要输入服务器B的密码
# scp id_rsa.pub [email protected]:/root/.ssh/serverA.pub
登录服务器B,把该密钥追加到authorized_keys
# cd /root/.ssh/
# cat serverA.pub >> authorized_keys
至此，服务器B可以免密钥登录服务器A
3)同理在服务器 B 上生成 rsa密钥。
# ssh-keygen -t rsa
将 id_rsa.pub 重命名为serverA.pub传到服务器A
# scp id_rsa.pub [email protected]:/root/.ssh/serverB.pub
登录服务器A,把该密钥追加到authorized_keys
# cd /root/.ssh/
# cat serverB.pub >> authorized_keys
至此，服务器A和服务器B之间可以免密钥登录
注意：例子中用的是root用户，所以密钥默认放在/root/.ssh，其它用户生成的密钥也会默认放在自己的家目录下。
例如新建一个用户test，生成rsa密钥
[test@serverA ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/test/.ssh/id_rsa):
Created directory '/home/test/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/test/.ssh/id_rsa.
Your public key has been saved in /home/test/.ssh/id_rsa.pub.
The key fingerprint is:
dc:41:89:d6:f7:63:81:57:88:87:40:91:42:73:cf:c6 test@serverA
The key's randomart image is:
+--[ RSA 2048]----+
| .o+*= + o.|
| ++*+= = |
| . ...E+ . |
| . . o + |
| S . . . |
| |
| |
| |
| |
+-----------------+
[test@serverA ~]$