day 40 ssh服务

一、远程连接工具

• ssh
• telnet服务
  telnet [email protected] 23
  本地shell
  wireshark(wnndows+linux)抓包 /tupdump(linux)抓包
• http超文本传输协议
• https加密

二、相关的软件

    openssh-clients-7.4p1-16.el7.x86_64
    openssh-server-7.4p1-16.el7.x86_64

1.客户端命令

    ssh
        ssh客户端 远程连接 远程执行命令
        -p 指定端口号
            ssh -p22 [email protected] whoami
    scp
        远程传输数据
        scp remont cp 未加密
            -p
            -r 复制目录
    sftp
        lrzsz rz和sz 上传或下载
        -P  指定端口号
            shell ---ssh
            xftp---sftp

三、ssh服务端配置文件

/etc/ssh/sshd_config ssh服务端配置文件
        Port 22 端口号
        PermitRootLogin yes 是否禁止root远程登录
        PasswordAuthentication yes  是否开启通过密码登录（认证）
                                     以后开启秘钥认证
        PermitEmptyPasswords no 是否准许空密码
        GSSAPIAuthentication no 
        UseDNS no  解决远程连接慢
        ListenAddress 0.0.0.0
                监听的地址 用户可以通过那个地址（ip）远程连接
                监听本地网卡的ip地址

        不同网段 不同端口
  /etc/ssh/ssh_config ssh客户端

四、SSH认证方式

    密码认证
    秘钥认证
        免密码登录
        信任登录

五、批量管理

    Xshell
    pssh(epel)
        pssh
        prsync
        参数
            -h 指定被管理的主机列表
            -P 显示屏幕输出
            -A 用户的输入密码

六、实例过程

1.创建秘钥认证：

1）创建秘钥对

[root@m01 ~]# ssh-keygen -t dsa 
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_dsa.
Your public key has been saved in /root/.ssh/id_dsa.pub.
The key fingerprint is:
SHA256:VW1UamyTZ0YDIHQxi00U7DrtJAX/BN0k5cbuhNRRA58 root@m01
The key's randomart image is:
+---[DSA 1024]----+
|        .ooO**BB=|
|         .*+ooO==|
|         .=o.oBE+|
|         . +.++= |
|        S + o. o |
|         + o .o  |
|          =    . |
|           .     |
|                 |
+----[SHA256]-----+

2）检查 秘钥

[root@m01 ~]# ll ~/.ssh/
total 12
-rw------- 1 root root 668 May 27 12:13 id_dsa
-rw-r--r-- 1 root root 598 May 27 12:13 id_dsa.pub
-rw-r--r-- 1 root root 695 May 27 11:22 known_hosts

3）发送公钥

[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_dsa.pub  172.16.1.41 
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_dsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '172.16.1.41'"
and check to make sure that only the key(s) you wanted were added.

4）进行测试

[root@m01 ~]# ssh 172.16.1.41 hostname 
backup

5）批量并行执行命令

[root@m01 ~]# cat hosts.txt 
[email protected]:22
[email protected]:22
[root@m01 ~]# pssh -Ph hosts.txt hostname 
172.16.1.41: backup
[1] 12:42:51 [SUCCESS] [email protected]:22
172.16.1.7: web01
[2] 12:42:51 [SUCCESS] [email protected]:22

[root@m01 ~]# prsync -A -azh  hosts.txt   /etc/hostname  /tmp/
Warning: do not enter your password if anyone else has superuser
privileges or access to your account.
Password: 
[1] 12:52:11 [SUCCESS] [email protected]:22
[2] 12:52:11 [SUCCESS] [email protected]:22
[root@m01 ~]# 
[root@m01 ~]# 
[root@m01 ~]# pssh -A  -Ph hosts.txt cat /tmp/hostname 
Warning: do not enter your password if anyone else has superuser
privileges or access to your account.
Password: 
172.16.1.41: m01
[1] 12:52:32 [SUCCESS] [email protected]:22
172.16.1.7: m01
[2] 12:52:32 [SUCCESS] [email protected]:22