(1)实验环境
两台CentOS7:
youxi1 192.168.1.6
youxi2 192.168.1.7
这里我将防火墙关闭进行实验,如果防火墙开启,请将端口加入到防火墙规则中。
(2).目标
在ssh端口不为22的情况下,进行单向免密登录或双向免密登录(端口不一致)
(3).实验
首先修改两台服务器的端口,vim /etc/ssh/sshd_config,找到如下部分
将#去除,22改为想要的端口号。这里我将youxi1的ssh端口号改为2890,youxi2的ssh端口号改为2891。
接着使用命令systemctl restart sshd重启服务。再使用netstat -tlunp | grep sshd查看端口号(如果没有netstat请安装net-tools)
1 2 3 4 5 6 |
[root@youxi1 Packages]# netstat -tlunp | grep sshd //youxi1 tcp 0 0 0.0.0.0:2890 0.0.0.0:* LISTEN 9953/sshd tcp6 0 0 :::2890 :::* LISTEN 9953/sshd [root@youxi2 ~]# netstat -tlunp | grep sshd //youxi2 tcp 0 0 0.0.0.0:2891 0.0.0.0:* LISTEN 17526/sshd tcp6 0 0 :::2891 :::* LISTEN 17526/sshd |
1)单向免密登录
youxi1使用ssh远程youxi2不需要密码,但youxi2使用ssh远程youxi1需要密码
在yousi1上使用ssh-keygen生成公钥和私钥(这里使用默认的rsa),一路默认即可
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
[root@youxi1 ~]# ssh-keygen -t rsa //默认指定的是rsa,所以可以没有-t rsa Generating public / private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): //选项没有指定生成地址时,此处也可以指定 Created directory '/root/.ssh' . Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is : SHA256:ia+le9ZX3cAxztmIINJbWnEGrK9lq4lY4pYNevgqecM root@youxi1 The key's randomart image is : +---[RSA 2048]----+ | . .ooo | | . o =o o | | . B . = * | | .+. . B .| | . S. o.| | . . + . o| | o o.+. o= . . | |o E.++.=+.o . | | o.*+ =+o. . | +----[SHA256]-----+ |
在没有指定生成地址时,会默认生成到家目录下的.ssh/目录下。使用rsa就会生成id_rsa和id_rsa.pub两个文件,如果使用的是dsa则生成的是id_dsa和id_dsa.pub两个文件。
1 2 |
[root@youxi1 ~]# ls /root/.ssh/ id_rsa id_rsa.pub |
接着使用命令ssh-copy-id命令将公钥发到youxi2服务器上
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
[root@youxi1 ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2891 [email protected] //-p选项指定被远程的服务器的端口号 /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub" The authenticity of host '[192.168.1.7]:2891 ([192.168.1.7]:2891)' can't be established. ECDSA key fingerprint is SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg. ECDSA key fingerprint is MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20. Are you sure you want to continue connecting (yes/no)? yes //yes继续 /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys [email protected]'s password: //输入192.168.1.7服务器上的root用户的密码 Number of key(s) added: 1 Now try logging into the machine, with: "ssh -p '2891' '[email protected]'" and check to make sure that only the key(s) you wanted were added. |
公钥传完后虽然会在本地生成.ssh/known_hosts文件,但并不生效。而在youxi2服务器的root用户的家目录下生成.ssh目录,并含有authorized_keys文件。
1 2 |
[root@youxi1 ~]# ls .ssh/ authorized_keys |
此时youxi1上的id_rsa.pub文件与youxi2是上的authorized_keys文件相同。
最后测试:在youxi1上ssh远程youxi2,会发现并不需要输入密码
1 2 3 4 |
[root@youxi1 ~]# ssh -p 2891 [email protected] Last login: Sun May 12 17:46:49 2019 from youxi1.cn [root@youxi2 ~]# ls .ssh/ authorized_keys |
注意:是本机生成的公钥发给被远程的服务器,在发送公钥和远程服务器时,都需要指定被远程的服务器的端口号。
2)双向免密登录
双向免密就是互换公钥即可,这里接着上面把youxi2的公钥发送到youxi1上,并进行测试。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
[root@youxi2 ~]# ssh-keygen Generating public / private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is : SHA256:9+woxNPvkE99zGUEZNcI+DJaUUIZXXMKb7k/Y6kPiJU root@youxi2 The key's randomart image is : +---[RSA 2048]----+ | .+*++*.+| | +..+.B.| | o = .| | + o. o | | .S+.E . o| | =.++.. =o| | . ooo+..==| | . *. +.o| | ...+... | +----[SHA256]-----+ [root@youxi2 ~]# ssh-copy-id -i .ssh/id_rsa.pub -p2890 [email protected] /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub" The authenticity of host '[192.168.1.6]:2890 ([192.168.1.6]:2890)' can't be established. ECDSA key fingerprint is SHA256:j3ee8eoTo2XEv0QxCYmxphMipcNRxC+IONPmt1HwRLg. ECDSA key fingerprint is MD5:25:e2:b4:08:f2:79:7d:6e:42:84:b5:78:3d:6a:81:20. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys [email protected]'s password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh -p '2890' '[email protected]'" and check to make sure that only the key(s) you wanted were added. [root@youxi2 ~]# ssh -p 2890 [email protected] Last login: Sun May 12 17:24:54 2019 from youxi2.cn [root@youxi1 ~]# |
Centos7利用rsync实现文件同步
0x01 测试环境
CentOS 7.4 Rsync服务端:192.168.204.130
CentOS 7.4 Rsync客户端:192.168.204.168
0x02 rsync同步方式
第一种方式:rsync通过ssh方式同步
1、Rsync服务端和客户端都需要安装rsync
[root@localhost ~]# yum -y install rsync
2、使用
前提:需知道远程服务器开启ssh端口和账号密码
A、推文件:
[root@localhost tmp]# rsync -av /etc/passwd 192.168.204.168:/tmp/passwd.txt
B、拉文件
[root@localhost tmp]# rsync -av 192.168.204.168:/tmp/passwd.txt /tmp/test.txt
#指定ssh端口
[root@localhost tmp]# rsync -av -e "ssh -p 22" 192.168.204.168:/tmp/passwd.txt /tmp/a.txt
第二种方式:rsync通过服务的方式同步
服务端配置:
1、编辑配置文件/etc/rsyncd.conf
motd file = /etc/rsyncd.motd
transfer logging = yes
log file = /var/log/rsyncd.log
port = 873
address = 192.168.204.130
uid = nobody
gid = nobody
use chroot = no
read only = no
max connections = 10
[common]
comment = rsync info
path = /tmp
ignore errors
auth users = admin
secrets file = /etc/rsyncd.secrets
hosts allow = 192.168.204.0/255.255.255.0
hosts deny = *
list = false
2、创建用户密码文件
echo "admin:123456" > /etc/rsyncd.secrets
chmod 600 /etc/rsyncd.secrets
3、创建提示信息文件:
echo "rsync info" > /etc/rsyncd.motd
4、启动服务:
rsync --daemon
echo "rsync --daemon" >> /etc/rc.local
客户端配置:
创建密码文件(免密码输入):
echo "123456" > /root/passwd
chmod 600 /root/passwd
拉取:
rsync -avz --password-file=/root/passwd [email protected]::common /tmp
推送:
rsync -avz --password-file=/root/passwd /tmp/ [email protected]::common
定时任务:
1、新建一个rsync.sh文件,在文件中写入执行同步的命令:
rsync -avz --password-file=/root/passwd [email protected]::common /tmp >/dev/null 2>&1
chmod 755 rsync.sh
2、执行命令:crontab -e
在定时文件中写入定时执行任务,实例如下:
* * * * * /home/rsync.sh 每分钟执行一次同步脚本;
0 * * * * /home/rsync.sh 每小时执行一次同步脚本;
0 0 * * * /home/rsync.sh 每天零点执行一次同步脚本;
0 9,18 * * * /home/rsync.sh 每天的9AM和6PM执行一次同步脚本;
TIPS:匿名访问测试
列举整个同步目录或指定目录:
rsync 10.0.0.12 ::
rsync 10.0.0.12 :: www /
下载文件或目录到本地:
rsync – avz 10.0.0.12 :: WWW/ /var/tmp
rsync – avz 10.0.0.12 :: www/ /var/tmp
上传本地文件到服务端:
rsync -avz webshell 10.0.0.12 :: WWW /