基于密钥的ssh远程登录
使用client的xiaoming用户基于秘钥认证方式使用ssh登录server端的xiaoming用户和xiaohei用户。
1、创建用户
#创建xiaoxming用户
[root@server ~]# useradd xiaoming
#创建xiaohei用户
[root@server ~]# useradd xiaohei
#查看创建用户情况
[root@server ~]# id xiaoming
uid=1001(xiaoming) gid=1001(xiaoming) groups=1001(xiaoming)
[root@server ~]# id xiaohei
uid=1003(xiaohei) gid=1003(xiaohei) groups=1003(xiaohei)
#给xiaoxming和xiaohei用户设置登录密码
[root@server ~]# echo xiaoming:123 | chpasswd #设置xiaoming用户登录密码
[root@server ~]# passwd xiaohei #设置xiaohei用户登录密码
Changing password for user xiaohei.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.2、安装ssh服务
#安装ssh服务
[root@server ~]# yum install -y openssh-server
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use subscription-manager to register.
Last metadata expiration check: 3:12:13 ago on Fri 11 Nov 2022 09:46:32 AM CST.
Dependencies resolved.
========================================================================================
Package Architecture Version Repository Size
========================================================================================
Installing:
openssh-server x86_64 8.0p1-10.el8 BaseOS 485 k
Transaction Summary
========================================================================================
Install 1 Package
Total size: 485 k
Installed size: 1.0 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Running scriptlet: openssh-server-8.0p1-10.el8.x86_64 1/1
Installing : openssh-server-8.0p1-10.el8.x86_64 1/1
Running scriptlet: openssh-server-8.0p1-10.el8.x86_64 1/1
Verifying : openssh-server-8.0p1-10.el8.x86_64 1/1
Installed products updated.
Installed:
openssh-server-8.0p1-10.el8.x86_64
Complete!
#查看ssh安装情况
[root@server ~]# rpm -qa openssh-server
openssh-server-8.0p1-10.el8.x86_64
#开启ssh服务
[root@server ~]# systemctl start sshd
#查看ssh服务开启状态
[root@server ~]# systemctl status sshd
● sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enable>
Active: active (running) since Fri 2022-11-11 13:16:37 CST; 7s ago
Docs: man:sshd(8)
man:sshd_config(5)
Main PID: 24979 (sshd)
Tasks: 1 (limit: 11088)
Memory: 2.1M
CGroup: /system.slice/sshd.service
└─24979 /usr/sbin/sshd -D [email protected],chacha20-poly1305>
Nov 11 13:16:36 server systemd[1]: Starting OpenSSH server daemon...
Nov 11 13:16:36 server sshd[24979]: Server listening on 0.0.0.0 port 22.
Nov 11 13:16:36 server sshd[24979]: Server listening on :: port 22.
Nov 11 13:16:37 server systemd[1]: Started OpenSSH server daemon.3、登录xiaoming用户
#登录xiaoming用户
[root@server ~]# ssh [email protected]
[email protected]'s password:
Red Hat Enterprise Linux release 8.5 (Ootpa)
4.18.0-348.el8.x86_64
server
/bin/bash
Activate the web console with: systemctl enable --now cockpit.socket
This system is not registered to Red Hat Insights. See https://cloud.redhat.com/
To register this system, run: insights-client --register
Last login: Fri Nov 11 13:17:32 2022 from 192.168.32.1
[xiaoming@server ~]$4、生成公私密钥
#通过client的xiaoming生成公私密钥
[xiaoming@server ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/xiaoming/.ssh/id_rsa):
Created directory '/home/xiaoming/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/xiaoming/.ssh/id_rsa.
Your public key has been saved in /home/xiaoming/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:ojWYdO3qCU7IogUx6hLyRAYiNiBEbMOR3tlgFxsdqck xiaoming@server
The key's randomart image is:
+---[RSA 3072]----+
|%*o oo.o |
|=B.o .o+ |
|= * B.+ . |
|.* + E . |
|= . o + S |
|o* . o + |
|o.= + . |
|oo o o . |
|. . o |
+----[SHA256]-----+
#查看生成的密钥文件
[xiaoming@server ~]$ cat /home/xiaoming/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCsCfv5ljlB9Uk3b5mUoq9e3mwEiuWDsUXxtsrQTIEPn/06IYKAsD229M5CoUeLnmr6XNT3+TAcjsUyFQMFBad2BX6ATQ7CZ38q+PC8LIyZQFeVKDB8TOn3rhoYbn1aOeDyX7wh+5JuKlcKOb3cN27u2Zec1EytMbJQ4vxeRiSjhBBVcerrkJbz9Z5TWlcKkWi9j2TOsTN6U2ZpZXOejuAET2YdFKdpHjnEX5FOgywp3wu7+2XMryRHHDCFD5jQq8cR24UteCkIsMbpq8/Nvk6P569+w3okeNSxQhT0UwbNZWQCra5L+/tQeudghxIcd+CBC7UwD7uunSUgCyEolEkhCE3YUytkyuA/sjiamNfHM3LE1Y83pZW4IjZjrl/yTJQkArxuDwKQgOjL61TRhsUSEzfSsFX0pXl0MMFpP5iHkRjcfAg0Uk8X0oGbqYlO1RJxjS7Ymar7pbJTIg7SM6p8k8386+jpuF/s0MGJFpui71XuYyFnZmMcYsPrvQnXzC8= xiaoming@server5、将公钥文件发送给xiaohei
#将生成的公钥传给xiaohei用户
[xiaoming@server ~]$ ssh-copy-id [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/xiaoming/.ssh/id_rsa.pub"
The authenticity of host '192.168.32.123 (192.168.32.123)' can't be established.
ECDSA key fingerprint is SHA256:AKLb/ivVBepO796WfBJfBgfmyag2MnHs8fIUfwVAa5s.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
#在xiaohei家目录下查看密钥文件是否有xiaoming发送过来的公钥
[xiaohei@server ~]$ cat ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCsCfv5ljlB9Uk3b5mUoq9e3mwEiuWDsUXxtsrQTIEPn/06IYKAsD229M5CoUeLnmr6XNT3+TAcjsUyFQMFBad2BX6ATQ7CZ38q+PC8LIyZQFeVKDB8TOn3rhoYbn1aOeDyX7wh+5JuKlcKOb3cN27u2Zec1EytMbJQ4vxeRiSjhBBVcerrkJbz9Z5TWlcKkWi9j2TOsTN6U2ZpZXOejuAET2YdFKdpHjnEX5FOgywp3wu7+2XMryRHHDCFD5jQq8cR24UteCkIsMbpq8/Nvk6P569+w3okeNSxQhT0UwbNZWQCra5L+/tQeudghxIcd+CBC7UwD7uunSUgCyEolEkhCE3YUytkyuA/sjiamNfHM3LE1Y83pZW4IjZjrl/yTJQkArxuDwKQgOjL61TRhsUSEzfSsFX0pXl0MMFpP5iHkRjcfAg0Uk8X0oGbqYlO1RJxjS7Ymar7pbJTIg7SM6p8k8386+jpuF/s0MGJFpui71XuYyFnZmMcYsPrvQnXzC8= xiaoming@server6、通过密钥登录xiaohei用户
#在xiaoming的client通过密钥直接登录xiaohei用户
[xiaoming@server ~]$ ssh [email protected]
Red Hat Enterprise Linux release 8.5 (Ootpa)
4.18.0-348.el8.x86_64
server
/bin/bash
Activate the web console with: systemctl enable --now cockpit.socket
This system is not registered to Red Hat Insights. See https://cloud.redhat.com/
To register this system, run: insights-client --register
Last login: Fri Nov 11 13:28:02 2022 from 192.168.32.123
[xiaohei@server ~]$7、将xiaoming的client生成的公钥复制到xiaoming的~/.ssh/目录下
#将公钥复制到~/.ssh/authorized_keys文件
[xiaoming@server ~]$ cp /home/xiaoming/.ssh/id_rsa.pub ~/.ssh/authorized_keys
#查看~/.ssh/authorized_keys文件中的公钥是否一致
[xiaoming@server ~]$ cat ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCsCfv5ljlB9Uk3b5mUoq9e3mwEiuWDsUXxtsrQTIEPn/06IYKAsD229M5CoUeLnmr6XNT3+TAcjsUyFQMFBad2BX6ATQ7CZ38q+PC8LIyZQFeVKDB8TOn3rhoYbn1aOeDyX7wh+5JuKlcKOb3cN27u2Zec1EytMbJQ4vxeRiSjhBBVcerrkJbz9Z5TWlcKkWi9j2TOsTN6U2ZpZXOejuAET2YdFKdpHjnEX5FOgywp3wu7+2XMryRHHDCFD5jQq8cR24UteCkIsMbpq8/Nvk6P569+w3okeNSxQhT0UwbNZWQCra5L+/tQeudghxIcd+CBC7UwD7uunSUgCyEolEkhCE3YUytkyuA/sjiamNfHM3LE1Y83pZW4IjZjrl/yTJQkArxuDwKQgOjL61TRhsUSEzfSsFX0pXl0MMFpP5iHkRjcfAg0Uk8X0oGbqYlO1RJxjS7Ymar7pbJTIg7SM6p8k8386+jpuF/s0MGJFpui71XuYyFnZmMcYsPrvQnXzC8= xiaoming@server8、通过密钥登录xiaoming用户
#在xiaoming的client通过密钥直接登录xiaoming用户的server
[xiaoming@server ~]$ ssh [email protected]
Red Hat Enterprise Linux release 8.5 (Ootpa)
4.18.0-348.el8.x86_64
server
/bin/bash
Activate the web console with: systemctl enable --now cockpit.socket
This system is not registered to Red Hat Insights. See https://cloud.redhat.com/
To register this system, run: insights-client --register
Last login: Fri Nov 11 13:41:14 2022 from 192.168.32.123
[xiaoming@server ~]$