ssh服务详解

写作目标

• 理解ssh服务的两种认证方式
• 掌握ssh服务的基本配置

• 掌握ssh服务客户端工具的使用
  -

  一、SSH介绍

• SSH是Linux下远程管理的工具，相比Telnet安全，运维人员必备的神器！
• SSH的全称Secure Shell，安全的shell，是Client/Server架构，默认端口号为22，TCP/IP协议

二、SSH加密算法

• des 对称的公钥加密算法,安全低，数据传输速度快；使用同一个秘钥进行加密或解密
• rsa 非对称的公钥加密算法,安全,数据传输速度慢 ，SSH默认的加密算法

补充了解：

DSA数字签名,非对称加密的另一种实现。

​ DSA-Digital Signature Algorithm 是Schnorr和ElGamal签名算法的变种。简单的说,这是一种更高级的验证方式,用作数字签名。不单单只有公钥、私钥,还有数字签名。私钥加密生成数字签名,公钥验证数据及签名。如果数据和签名不匹配则认为验证失败!数字签名的作用就是校验数据在传输过程中不被修改。

三、SSH服务的认证方式
基于用户密码的认证

[root@MissHou ~]# ssh 192.168.10.171
The authenticity of host '192.168.10.171 (192.168.10.171)' can't be established.
RSA key fingerprint is 9f:71:de:3c:86:25:dd:f0:06:78:ab:ba:96:5a:e4:95.
Are you sure you want to continue connecting (yes/no)?

提示信息：无法确认主机192.168.10.171的真实性，指纹是9f:71:de:3c:86:25:dd:f0:06:78:ab:ba:96:5a:e4:95.，你确定想要继续吗？

说明： 理论上应该是对公钥的确认，由于公钥通过RSA算法加密，太长，不好直接比较，所以给公钥生成一个hash的指纹，方便比较。

[root@MissHou ~]# ssh 192.168.10.171
The authenticity of host '192.168.10.171 (192.168.10.171)' can't be established.
RSA key fingerprint is 9f:71:de:3c:86:25:dd:f0:06:78:ab:ba:96:5a:e4:95.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.10.171' (RSA) to the list of known hosts.
[email protected]'s password: 

说明：

当客户端输入yes确认对方的公钥指纹后，server端的公钥就会被存放到客户机的用户家目录里~/.ssh/known_hosts文件中，下次再访问就直接通过密码登录，不需要再确认公钥。

[root@client ~]# su - stu1
[stu1@client ~]$ ssh 10.1.1.2
The authenticity of host '10.1.1.2 (10.1.1.2)' can't be established.
RSA key fingerprint is 9f:71:de:3c:86:25:dd:f0:06:78:ab:ba:96:5a:e4:95.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.1.1.2' (RSA) to the list of known hosts.
[email protected]'s password: 

//ssh工具指定用户名访问
[stu1@client ~]$ ssh [email protected]
[email protected]'s password: 
Last login: Mon Apr 16 15:12:45 2018 from 10.1.1.3
[root@MissHou ~]# exit

四、SSH服务基本配置

• 基于秘钥对认证（免密码登录）——>重点掌握

需求：client端有一个用户user01,该用户使用root用户免密码登录server端

环境：需要一台云服务器，我用的是3A网络，部署简单，适合小白。

client：10.1.1.3

server：10.1.1.2

思路：

• client端生成一对秘钥
• 将生成的公钥远程拷贝到server端

步骤：

1. client端的user01用户生成一对秘钥对

[root@client ~]# useradd user01
[root@client ~]# su - user01
[user01@client ~]$ ls -a
.  ..  .bash_logout  .bash_profile  .bashrc  .emacs  .gnome2  .mozilla
[user01@client ~]$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user01/.ssh/id_rsa): 
Created directory '/home/user01/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/user01/.ssh/id_rsa.
Your public key has been saved in /home/user01/.ssh/id_rsa.pub.
The key fingerprint is:
df:5b:4f:f8:26:38:0f:5f:f0:df:4c:78:54:bd:94:9e user01@client
The key's randomart image is:

将刚刚生成的公钥远程拷贝到server端的root家目录里指定位置

[user01@client ~]$ scp .ssh/id_rsa.pub [email protected]:/root/.ssh/authorized_keys
或者
[user01@client ~]$ ssh-copy-id -i .ssh/id_rsa.pub [email protected]    （推荐）
The authenticity of host '10.1.1.2 (10.1.1.2)' can't be established.
RSA key fingerprint is 9f:71:de:3c:86:25:dd:f0:06:78:ab:ba:96:5a:e4:95.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.1.1.2' (RSA) to the list of known hosts.
[email protected]'s password: 
Now try logging into the machine, with "ssh '[email protected]'", and check in:

测试验证

[user01@client ~]$ ssh [email protected]
Last login: Mon Apr 16 16:00:55 2018 from 10.1.1.1
[root@server ~]#