Linux系统设置SSH免密连接

Secure Shell 协议，简称 SSH，是一种加密网络协议，用于客户端和主机之间的安全连接，并支持各种身份验证机制，目前最实用的身份验证机制就是基于密码的身份验证和基于公钥的身份验证两种。不过今天小编带来的是，Linux系统如何设置基于 SSH 密钥的身份验证。

SSH秘钥登录采用的是非对称加密
特点：
1、公钥加的密，私钥才能解。私钥加的密，公钥才能解。
2、公钥对外开放，任何人都可以获取，私钥不可泄露。

张三是个linux 运维人员，管理100台linux 服务器，为了安全每台服务器的密码都不一样还没有规律可循，每次登录查找密码，这认他很恼火。ssh服务支持秘钥登录，于是张三生成了一对属于自己的秘钥对，将公钥放在每一台服务器上。张三登录时 linux服务器找到张三的公钥，看公钥是否可以解开张三的密文窜，如果可以解开就说明是张三登录。

查看是否已经有秘钥对：
ls ~/.ssh
如果存在这两个文件id_rsa（私钥） 、id_rsa.pub（公钥） 说明秘钥对已经有了.

详细操作步骤：

#不输入密码不可登录
macBook-Pro:~ hongshicheng$ ssh -p 2222   [email protected]
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
[email protected]: Permission denied (publickey,password).


#查看是否已有秘钥对
macBook-Pro:~ hongshicheng$ ls ~/.ssh
known_hosts
macBook-Pro:~ hongshicheng$ 

#创建秘钥对，后面写上自己的邮箱 ,然后一路回车键
macBook-Pro:~ hongshicheng$ ssh-keygen -t rsa -C "[email protected]"
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/hongshicheng/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /Users/hongshicheng/.ssh/id_rsa.
Your public key has been saved in /Users/hongshicheng/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:Ov/9yi1Hk1T+caZV0CS4TB3GLW7c2+/vvYdyJ/WLJqk [email protected]
The key's randomart image is:
+---[RSA 2048]----+
|             +=*.|
|            o.+.=|
|           o + =.|
|            o =.*|
|        S    o =*|
|       .      =.+|
|      o     .. +o|
|       o   =oo* *|
|        .Eo *OoBX|
+----[SHA256]-----+
macBook-Pro:~ hongshicheng$ 


#查看是否生成秘钥对
macBook-Pro:~ hongshicheng$ ls ~/.ssh
id_rsa		id_rsa.pub	known_hosts
macBook-Pro:~ hongshicheng$ 

#查看公钥内容
macBook-Pro:~ hongshicheng$ cat ~/.ssh/id_rsa.pub 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRlGglNYPprvtNrhJlqNuNLz92EufI7WwBeoP1PmjPckpLk7HS7sNHBreF+6KwOVZW8EY4skpWKHji8eRidEnLKSI3XJlTFCYvUzjODWEEMsG0Wlshl/s6ARzqlGhoQBzyOsVJv4Agp10wMpDy69skc86xgkZ1WXE5eUggzWGc892sojcveFmXnJfASo6dFA/SmbIw7VA3ko91E5VEv7bnA3mzHUuibbSjAcBlox3CoLN5yBfkoewUfeMrm2CcQtA0H/lJ9YMaJCxZ/h4r3de7nUwh0x99TbutHZcWtHNyeVnkri1q2Pd0GuMD+wzEuM+SX4nidj01jJEHC+NzuorL [email protected]
macBook-Pro:~ hongshicheng$ 


#将公钥copy到服务器
macBook-Pro:~ hongshicheng$ ssh-copy-id -p 2222 [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/hongshicheng/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:   #输入服务器密码
Number of key(s) added:        1
Now try logging into the machine, with:   "ssh -p '2222' '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
macBook-Pro:~ hongshicheng$ 

#开始无密码登录
macBook-Pro:~ hongshicheng$ ssh -p 2222   [email protected]
Linux 05cfdbd4cb25 4.19.76-linuxkit #1 SMP Thu Oct 17 19:31:58 UTC 2019 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Jul 11 16:27:21 2020 from 172.17.0.1
root@05cfdbd4cb25:~# 

#现在已经成功登陆到服务器上，刚才有一步是把公钥copy到了服务器上，张三的公钥被放在那里呢？
root@05cfdbd4cb25:~# ls ~/.ssh
authorized_keys
root@05cfdbd4cb25:~# 

#查看服务器上的用户公钥，比对一下完全一样
root@05cfdbd4cb25:~# cat ~/.ssh/authorized_keys 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRlGglNYPprvtNrhJlqNuNLz92EufI7WwBeoP1PmjPckpLk7HS7sNHBreF+6KwOVZW8EY4skpWKHji8eRidEnLKSI3XJlTFCYvUzjODWEEMsG0Wlshl/s6ARzqlGhoQBzyOsVJv4Agp10wMpDy69skc86xgkZ1WXE5eUggzWGc892sojcveFmXnJfASo6dFA/SmbIw7VA3ko91E5VEv7bnA3mzHUuibbSjAcBlox3CoLN5yBfkoewUfeMrm2CcQtA0H/lJ9YMaJCxZ/h4r3de7nUwh0x99TbutHZcWtHNyeVnkri1q2Pd0GuMD+wzEuM+SX4nidj01jJEHC+NzuorL [email protected]
root@05cfdbd4cb25:~#