ssh远程登录

1. 配置ssh免密登陆：客户端主机通过redhat用户基于秘钥验证方式进行远程连接服务器的root用户

[root@zxw-c ~]# useradd redhat
[root@zxw-c ~]# su - redhat[root@zxw-c ~]# useradd redhat
[root@zxw-c ~]# su - redhat
[redhat@zxw-c ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/redhat/.ssh/id_rsa): 
Created directory '/home/redhat/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/redhat/.ssh/id_rsa.
Your public key has been saved in /home/redhat/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:EQb7fKujqufWy14v+A7x+O5wpVOc08y5xRsHFYo/SOk redhat@zxw-c
The key's randomart image is:
+---[RSA 3072]----+
|      ..o      .o|
|       o .  o .. |
|      . .  + ..  |
|       o oo=oo . |
|      . S BE=o+ .|
|       + = o o.+ |
|     .+.* . . .  |
|    o.o*o+       |
|  .=oo=BBo.      |
+----[SHA256]-----+
[redhat@zxw-c ~]$ ssh-copy-id [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/redhat/.ssh/id_rsa.pub"
The authenticity of host '192.168.32.130 (192.168.32.130)' can't be established.
ECDSA key fingerprint is SHA256:KqisMxCfUJh5e+OJ0OT3g11ilulapnGErY3xd9xaCQk.
Are you sure you want to continue connecting (yes/no/[fingerprint])? y
Please type 'yes', 'no' or the fingerprint: yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

2. 两台机器：第一台机器作为客户端，第二台机器作为服务器，在第一台使用rhce用户免密登录第二台机器

配置

ssh-keygen -t rsa -b 2048：产生一对密钥，公钥和私钥

如果没有ssh文件，手动创建，如如下图

查看，产生的公私密钥

ssh-copy-id -i rootssh-copy-id -i [email protected]（服务器的IP)：将公钥给服务器端

注：如果第二台要免密登录第一台，重复以上操作即可

2.禁止root用户远程登录和设置三个用户sshuser1, sshuser2, sshuser3， 只允许sshuser3登录，不允许sshuser1, sshuser2登录

vim /etc/ssh/sshd_config：进入到该配置文件中

到配置文件的最后一行，添加AllowUsers sshuser3

添加用户sshuser1,sshuser2,sshuser3

为每个用户设置密码

测试root用户

新建一个连接，尝试sshuser3远程登录，输入密码后，显示登录成功

新建一个连接，尝试sshuser1和sshuser2远程登录