linux网络服务[SSH安全远程管理]——————SSH的工作原理、账户密码登录、密钥对免密登录
文章目录
- 1. 什么是SSH
- 2.SSH的原理
- 2.1 账户密码
- 2.2 密钥对
- 3.用户密码验证
- 3.1 字符界面
- 3.1.1 输入用户名
- 3.1.2 不输入用户名
- 3.2 图形模式
- 4.密钥对登录
- 4.1 客户端操作
- 4.1.1 免密登录
- 4.1.2 私钥加密登录
- 4.2 服务端操作
1. 什么是SSH
SSH 为 Secure Shell 的缩写，SSH 为建立在应用层基础上的安全远程管理协议。
SSH 是较可靠，专为远程登录会话和其他网络服务提供安全性的协议。利用 SSH 协议可以有效防止远程管理过程中的信息泄露问题。
默认使用tcp的22端口，会采用加密的密文方式进行传输。
Telnet在网络中采用明文传输，所以容易被抓取查看，不安全，所以被SSH取代。
2.SSH的原理
两种登录方式：
- 账户密码（口令）
- 密钥对
这两种方式都是让客户与服务端安全的登录连接在一起，之间传输的数据用密文传输。
用户要SSH连接服务器，首先要知道服务其中的账户和密码：
- 账户：/etc/passwd
- 密码：/etc/shadow
用户通过工具，将服务端的账户名和密码通过密文的方式打包发送给服务端，服务端查看其中的用户名和密码，在自己的文件中进行比对成功，最终建立连接。
如果是使用Telnet，用户名和密码的包就是明文传输，会被其他人抓取查看到，所以不安全。
2.1 账户密码
基于密码的安全认证就是我们一直在用的，只要知道服务器的SSH连接账号和密码(当然也要知道服务器的IP和端口(默认22))，就可以通过客户端远程登录到主机了，所以的传输过程都是加密的
只要你知道自己的帐号和口令，就可以登录到远程主机。所有传输的数据都会被加密。
但是不能保证你正在连接的服务器就是你想连接的服务器。可能会有别的服务器在冒充真正的服务器，也就是受到“中间人攻击”这种方式的攻击。
2.2 密钥对
不再使用密码，双向密钥对。
你必须为自己创建一对密钥，并把公钥放在需要访问的服务器上。
如果你要连接到SSH服务器上，客户端软件就会向服务器发出请求，请求用你的公钥进行安全验证。询问服务器的系统下是否存有这个公钥？
服务器收到请求之后，先在该服务器上你的主目录下寻找你的公钥，然后把它和你发送过来的公钥进行比较。如果两个密钥一致，服务器就用公钥加密“质询”(challenge)并把它发送给客户端软件。
客户端软件收到“质询”之后就可以用你的私钥在本地解密再把它发送给服务器完成登录。
与第一种级别相比，第二种级别不仅加密所有传输的数据，也不需要在网络上传送口令，因此安全性更高，可以有效防止中间人攻击。
3.用户密码验证
环境准备：
- 两台虚拟机，一台作为服务端server，一台作为客户端client1。
- 关闭防火墙
- 永久关闭selinux
3.1 字符界面
3.1.1 输入用户名
1）查看客户端与服务端的IP
[root@client1 ~]# ip addr show eth0 # 客户端ip
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:00:05:0b brd ff:ff:ff:ff:ff:ff
inet 172.25.5.2/24 brd 172.25.5.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe00:50b/64 scope link
valid_lft forever preferred_lft forever
[root@server ~]# ip a # 服务端的ip
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:b2:1b:71 brd ff:ff:ff:ff:ff:ff
inet 172.25.5.10/24 brd 172.25.5.255 scope global ens3
valid_lft forever preferred_lft forever
inet6 fe80::4608:756c:3af9:e967/64 scope link
valid_lft forever preferred_lft forever
2）删除客户端和服务端当前用户下的家目录下的/.ssh目录
[root@client1 ~]# rm -fr .ssh # 表示从来没有ssh的连接信息了
[root@client1 ~]# ls -a
. .bash_logout .config Downloads Music Templates
.. .bash_profile .cshrc .esd_auth Pictures Videos
anaconda-ks.cfg .bashrc Desktop .ICEauthority Public .viminfo
.bash_history .cache Documents .local .tcshrc
[root@server ~]# rm -fr .ssh # 没有连接信息
[root@server ~]# ls -a
. .bash_profile .dbus .tcshrc 图片 音乐
.. .bashrc .esd_auth .viminfo 文档
anaconda-ks.cfg .cache .ICEauthority .xauthlmCsfD 桌面
.bash_history .config initial-setup-ks.cfg 下载 模板
.bash_logout .cshrc .local 公共 视频
3）客户端通过用户密码的方式进行ssh登录连接：
[root@client1 ~]# ssh [email protected]
The authenticity of host '172.25.5.10 (172.25.5.10)' can't be established.
ECDSA key fingerprint is 46:14:77:1e:a0:f2:23:c3:66:24:23:76:ff:81:21:e5.
Are you sure you want to continue connecting (yes/no)? yes
# 输入yes
Warning: Permanently added '172.25.5.10' (ECDSA) to the list of known hosts.
# 输入密码
[email protected]'s password: # 密码不回显
Last login: Tue Aug 18 11:44:50 2020 from gateway
[root@server ~]#
# 登录到server成功
4）查看客户端的/root/.ssh目录下的文件。
[root@client1 ~]# cd .ssh/
[root@client1 .ssh]# ls
known_hosts # 已经产生文件
[root@client1 .ssh]# cat known_hosts
# 已经记录登录server的信息
172.25.5.10 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBECr1LbKAUhgHXoqHrY6549RM3aNz1WjwamOJK9zrUD8wnEH0wyhljLoXB7LkHIDAbVJ7eYJk3VUpDlSxnNDRGM=
5）查看服务端的/root/.ssh目录下的文件。
[root@server ~]# cd .ssh # 没有这个文件
-bash: cd: .ssh: No such file or directory
6）尝试打开图像：
[root@server ~]# firefox
Error: no display specified
# 没有图形模式无法打开
3.1.2 不输入用户名
1）只输入ip：
[root@client1 ~]# ssh 172.25.5.10
# 不输入用户名直接登录root用户。
[email protected]'s password:
Last login: Tue Aug 18 12:16:01 2020 from 172.25.5.2
[root@server ~]#
3.2 图形模式
1）在客户端加上-X参数登录：
[root@client1 ~]# ssh [email protected] -X
# 二次登录不用再确认连接
[email protected]'s password:
Last login: Tue Aug 18 12:10:00 2020 from 172.25.5.2
2）打开图形
[root@client1 ~]# ssh [email protected] -X
[email protected]'s password:
Last login: Tue Aug 18 12:15:06 2020 from gateway
/usr/bin/xauth: file /root/.Xauthority does not exist
[root@server ~]# firefox # 打开 图形模式成功
[Parent 4512] WARNING: pipe error (64): Connection reset by peer: file /builddir/build/BUILD/firefox-45.4.0/firefox-45.4.0esr/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 459
[Parent 4512] WARNING: pipe error (67): Connection reset by peer: file /builddir/build/BUILD/firefox-45.4.0/firefox-45.4.0esr/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 459
总结：当用户登录远程服务器时：
- 首先输入yes确定询问
- server传输公钥
- 输入密码，使用server的公钥加密。
- server的私钥解密，查看密码比对。
- 建立连接。
- 客户端就包含有server的相关登录信息了。
- 不输入用户名默认连接root。
- 不加
-X无法打开图形模式 。
4.密钥对登录
rhel7默认已经安装了server与client：
[root@server ~]# yum install openssh-server.x86_64 openssh-clients.x86_64 -y
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
# 已经安装好了。
Package openssh-server-6.6.1p1-31.el7.x86_64 already installed and latest version
Package openssh-clients-6.6.1p1-31.el7.x86_64 already installed and latest version
Nothing to do
4.1 客户端操作
4.1.1 免密登录
1）客户端生成密钥对：
使用rsa加密1024位以内的长度，这种加密回被破解。
[root@client1 ~]# ssh-keygen -t rsa -b 2048 # 使用rsa加密方式2048加密长度生成密钥
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): # 保存位置/家目录/.ssh/id_rsa
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): # 私钥是否加密，这里我们不加密直接回车
Enter same passphrase again: # 再次输入密码
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
13:bb:ec:1d:80:11:5d:78:1b:92:32:25:e9:74:12:04 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
| Eo==.+. |
| *o* o |
| o.=.o o |
| .o o. |
| . S |
| . + |
| o . |
| . . . |
| . . |
+-----------------+
私钥加密时为了防止客户端不安全。
- 如果不加密：可以直接通过私钥登录服务端，就是免密登录了。
- 如果加密：登录前要输入私钥密码确定为客户本人再登录。
2）将公钥发送给服务器：
[root@client1 ~]# ssh-copy-id [email protected] # 将公钥发送给172.25.5.10的root用户，你要登录哪个用户就写哪个用户
The authenticity of host '172.25.5.10 (172.25.5.10)' can't be established.
ECDSA key fingerprint is 46:14:77:1e:a0:f2:23:c3:66:24:23:76:ff:81:21:e5.
Are you sure you want to continue connecting (yes/no)? yes # 建立连接
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: # 输入密码
Number of key(s) added: 1 # 添加公钥
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
3）查看对比：
- 查看客户端的公钥：
[root@client1 ~]# cd .ssh
[root@client1 .ssh]# ls
id_rsa id_rsa.pub known_hosts
[root@client1 .ssh]# cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHjWDv0W8ZaThylcKSMGOJ0WytLOOZZFQFQA+etKVZcfr03tg/MlJGhYsvXlSK0MGKcq+AJgNfmDhp4oOy9kIojG8x5oGG5wAgenWZAPZYUwXfo5C4RYIupypoQtrjwKrvTrQTEHx2c7otUnzTLl60EqtDuEg4ncmkcOa3CW5VFUPQ70gza1lm9s4kwudKmmrkfR+4vTYAeyt3rz+xz+p2ioBhnrSKJGheDcsGXxMZjojFWvHy/U1pfepforI1H0jpqCHGaA6zaRyaNpJ89zcmqWmCgrmEQqKsucg8kFWP31U+bbZw6R3m6/LsssS5Fo4ka/CmS4tLDEJyhlJviS5Z [email protected]
- 查看服务器收到的公钥：
[root@server ~]# cd .ssh
[root@server .ssh]# ls
authorized_keys
[root@server .ssh]# cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHjWDv0W8ZaThylcKSMGOJ0WytLOOZZFQFQA+etKVZcfr03tg/MlJGhYsvXlSK0MGKcq+AJgNfmDhp4oOy9kIojG8x5oGG5wAgenWZAPZYUwXfo5C4RYIupypoQtrjwKrvTrQTEHx2c7otUnzTLl60EqtDuEg4ncmkcOa3CW5VFUPQ70gza1lm9s4kwudKmmrkfR+4vTYAeyt3rz+xz+p2ioBhnrSKJGheDcsGXxMZjojFWvHy/U1pfepforI1H0jpqCHGaA6zaRyaNpJ89zcmqWmCgrmEQqKsucg8kFWP31U+bbZw6R3m6/LsssS5Fo4ka/CmS4tLDEJyhlJviS5Z [email protected]
- 两者完全相同，传输成功。
4）再登录就只需要密钥对了，免密登录了：
[root@client1 .ssh]# ssh 172.25.5.10
Last login: Tue Aug 18 12:20:37 2020 from 172.25.5.2
[root@server ~]#
4.1.2 私钥加密登录
1）客户端删除密钥和服务端删除客户端公钥：
[root@client1 ~]# rm -fr .ssh
[root@server ~]# rm -fr .ssh
2）客户端建立密钥：
[root@client1 ~]# ssh-keygen -t rsa -b 2048
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): # 私钥设定密码123456
Enter same passphrase again: # 私钥设定密码123456
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
61:17:d7:7f:56:40:9e:d3:79:b4:b2:d7:2b:ad:84:57 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
| . .oo..|
| o ..++|
| o . .+++|
| . o o.*|
| S . Eo|
| . + .|
| . + o |
| o o |
| . |
+-----------------+
2）客户端将公钥发送给服务端：
[root@client1 ~]# ssh-copy-id [email protected]
The authenticity of host '172.25.5.10 (172.25.5.10)' can't be established.
ECDSA key fingerprint is 46:14:77:1e:a0:f2:23:c3:66:24:23:76:ff:81:21:e5.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
3）查看对比：
- 查看客户端公钥：
[root@client1 ~]# cd .ssh
[root@client1 .ssh]# ls
id_rsa id_rsa.pub known_hosts
[root@client1 .ssh]# cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDkERIkH9hfaugeIjzxKo7VU5LV3lT4YFM8jzetJ2yoDsXRhH/PX/PvQ9++87Ik+M4Zv+BPK9J2E65evMIhtbANbUTcPh4Mn9ae8XsuybFRCbYRtzBRiZ1D0L9d9tpMOLPyYXE2NbiM4R6MJ9P3HhNZzzw5gz69knVILFeQuvTvTDY2Kjp6blVaVV+hbukABazbKSzG/x/PqWRFcGjJMFQga5U+/4GKqf/5wzGGabI8FDfvHjSCN58PNW4ot98tcTrrDFTsneheXCdNT3hWqBdOzdAvbUq+EPgVBa2G5PLXAbkueNf5k0lXo1CQaiTE8YCO6BKvzguiaTGXEstK7WTb [email protected]
- 查看服务端接收到的公钥：
[root@server ~]# cd .ssh
[root@server .ssh]# ls
authorized_keys
[root@server .ssh]# cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDkERIkH9hfaugeIjzxKo7VU5LV3lT4YFM8jzetJ2yoDsXRhH/PX/PvQ9++87Ik+M4Zv+BPK9J2E65evMIhtbANbUTcPh4Mn9ae8XsuybFRCbYRtzBRiZ1D0L9d9tpMOLPyYXE2NbiM4R6MJ9P3HhNZzzw5gz69knVILFeQuvTvTDY2Kjp6blVaVV+hbukABazbKSzG/x/PqWRFcGjJMFQga5U+/4GKqf/5wzGGabI8FDfvHjSCN58PNW4ot98tcTrrDFTsneheXCdNT3hWqBdOzdAvbUq+EPgVBa2G5PLXAbkueNf5k0lXo1CQaiTE8YCO6BKvzguiaTGXEstK7WTb [email protected]
- 两者完全相同
4）登录测试：
[root@client1 ~]# ssh 172.25.5.10
Enter passphrase for key '/root/.ssh/id_rsa': # 这次再登录需要输入私钥密码才可免密登录
Last login: Tue Aug 18 12:52:09 2020 from 172.25.5.2
[root@server ~]#
4.2 服务端操作
这样更加安全不用告诉客户端用户密码，他就可以连接更安全：
1）服务端生成密钥
[root@server ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
95:7d:16:c7:f2:9f:b4:84:b2:40:49:0d:c2:19:ba:ea [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
| .o+o+ ...|
| .o.o + .o.|
| . . o . +o |
| . o . + o.|
| . S . o o +|
| . . o.|
| . |
| . |
| E |
+-----------------+
2）服务端给自己传送公钥：
[root@server ~]# ssh-copy-id [email protected]
The authenticity of host '172.25.5.10 (172.25.5.10)' can't be established.
ECDSA key fingerprint is 46:14:77:1e:a0:f2:23:c3:66:24:23:76:ff:81:21:e5.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
3）服务端将私钥发送给客户端：
[root@server ~]# scp /root/.ssh/id_rsa [email protected]:/root/.ssh/
[email protected]'s password:
id_rsa
4）客户端直接测试登录
[root@client1 ~]# ssh [email protected]
The authenticity of host '172.25.5.10 (172.25.5.10)' can't be established.
ECDSA key fingerprint is 46:14:77:1e:a0:f2:23:c3:66:24:23:76:ff:81:21:e5.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.25.5.10' (ECDSA) to the list of known hosts.
Last login: Tue Aug 18 13:02:08 2020 from 172.25.5.2
[root@server ~]#
登录成功，免密登录。