RHCSA课程培训第三天
第三天
第九章 配置和安全OpenSSH服务
Desktop不能自动获取IP地址解决方法：
win+r-->services.msc-->禁用，手动
ssh ip
ssh -X ip
ssh username@ip
ssh ip 'cmd'
[root@desktop0 Desktop]# ssh 172.25.0.254 #以字符化的方式打开对方的某个操作界面
[email protected]'s password:
Last login: Sat Sep 19 10:49:35 2015 from desktop0.example.com
[root@classroom ~]# ls
anaconda-ks.cfg classroom-rhce-post.log Documents Music selinux_modules
a.txt Desktop Downloads Pictures Templates
bin DHCP-ranges.txt ldap Public Videos
[root@desktop0 Desktop]# ssh -X 172.25.0.254 #以图形化的方式打开对方的某个操作界面
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Last failed login: Sat Sep 19 11:00:21 CST 2015 from desktop0.example.com on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Sat Sep 19 10:52:06 2015 from desktop0.example.com
[root@classroom ~]# firewall-config
** (firewall-config:2269): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-QQdlAbaFQ8: Connection refused
[root@classroom ~]# ssh [email protected] #以某个用户远程登录
Last failed login: Sun Sep 13 13:00:58 CST 2015 from :0 on :0
There was 1 failed login attempt since the last successful login.
Last login: Sun Sep 13 12:57:08 2015
[student@desktop0 ~]$ exit
logout
Connection to 172.25.0.10 closed.
不给私钥创建密码的操作步骤
[root@desktop0 Desktop]# ssh-keygen #生成密钥
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): #私钥存放位置
Enter passphrase (empty for no passphrase): #设置私钥密码
Enter same passphrase again: #再次设置确认私钥密码
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
5a:22:34:39:b9:4e:ea:9e:5b:7a:d8:46:39:ae:4c:23 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
| |
| o |
| * |
| . + |
| +.. S |
| ++. + |
|E +=o.. |
| =.== |
| .O= |
+-----------------+
[root@desktop0 Desktop]# ls ~/.ssh/
authorized_keys id_rsa id_rsa.pub known_hosts
[root@desktop0 Desktop]# ls ~/.ssh/id_rsa* -l
-rw-------. 1 root root 1679 Sep 19 11:17 /root/.ssh/id_rsa
-rw-r--r--. 1 root root 407 Sep 19 11:17 /root/.ssh/id_rsa.pub
[root@desktop0 Desktop]# ssh-copy-id 172.25.0.254 #复制公钥到指定IP
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '172.25.0.254'"
and check to make sure that only the key(s) you wanted were added.
[root@desktop0 Desktop]# ssh 172.25.0.254
Last login: Sat Sep 19 11:09:32 2015 from desktop0.example.com
[root@classroom ~]# clear
给私钥创建密码的操作步骤
[root@desktop0 Desktop]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
d4:81:35:d4:c7:92:7e:45:87:e8:e2:19:de:9f:65:b0 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
| +=. + oo|
| .. o= + o|
| . .o o . |
| . o o o |
| So = . o |
| + . E o|
| . + |
| o |
| |
+-----------------+
[root@desktop0 Desktop]# ssh-copy-id
Usage: /usr/bin/ssh-copy-id [-h|-?|-n] [-i [identity_file]] [-p port] [[-o <ssh -o options>] ...] [user@]hostname
[root@desktop0 Desktop]# ssh-copy-id 172.25.0.254
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '172.25.0.254'"
and check to make sure that only the key(s) you wanted were added.
[root@desktop0 Desktop]# ssh 172.25.0.254
Agent admitted failure to sign using the key.
[email protected]'s password:
Last login: Sat Sep 19 11:20:24 2015 from desktop0.example.com
[root@classroom ~]#
公钥文件的删除
Classroom
[root@classroom ~]# sed -i '/desktop/d' /root/.ssh/authorized_keys
[root@classroom ~]# grep desktop /root/.ssh/authorized_keys
Desktop
[root@desktop0 Desktop]# ssh 172.25.0.254
Agent admitted failure to sign using the key.
[email protected]'s password:
Last login: Sat Sep 19 11:20:24 2015 from desktop0.example.com
[root@classroom ~]#
不允许用户登录访问方法
Desktop
[root@desktop0 Desktop]#sed -i '/PermitRootLogin/s/#//' /etc/ssh/sshd_config
[root@desktop0 Desktop]#sed -i '/PermitRootLogin/s/yes/no/' /etc/ssh/sshd_config
[root@desktop0 Desktop]#grep Permit /etc/ssh/sshd_config
PermitRootLogin yes
#PermitEmptyPasswords no
the setting of "PermitRootLogin without-password".
#PermitUserEnvironment no
#PermitTunnel no
[root@desktop0 Desktop]# systemctl restart sshd.service
Classroom
[root@classroom ~]# ssh [email protected]
ssh: connect to host 172.25.0.10 port 22: Connection refused
[root@classroom ~]#
第十章 分析存储日志
/var/log/
messages日志:
secure日志:
maillog日志:
邮件的发送方法：
[root@desktop0 log]# echo subject|mail -s subject student
[root@desktop0 log]# tail -n 2 /var/log/maillog
Sep 19 13:43:14 localhost postfix/local[5468]: 4910E17E863: to=<[email protected]>, orig_to=<student>, relay=local, delay=0.18, delays=0.14/0.04/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Sep 19 13:43:14 localhost postfix/qmgr[1667]: 4910E17E863: removed
[root@desktop0 log]# mail studnet
Subject: xiangmu
neirong
guan yu xiangmu de yi xie zhi liao
.
EOT
rsyslog.conf文件:
[root@desktop0 log]# vim /etc/rsyslog.conf
[root@desktop0 log]# grep -vE '^$|#' /etc/rsyslog.conf |cat -n
1$WorkDirectory /var/lib/rsyslog
2$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
3$IncludeConfig /etc/rsyslog.d/*.conf
4$OmitLocalLogging on
5$IMJournalStateFile imjournal.state
6*.info;mail.none;authpriv.none;cron.none /var/log/messages
7authpriv.* /var/log/secure
8mail.* -/var/log/maillog
9cron.* /var/log/cron
10*.emerg :omusrmsg:*
11uucp,news.crit /var/log/spooler
12local7.* /var/log/boot.log
/etc/logrotate.d/日志分割文件:
时间服务器:
/etc/chrony.conf
[root@desktop0 logrotate.d]# timedatectl
Local time: Sat 2015-09-19 14:00:55 CST
Universal time: Sat 2015-09-19 06:00:55 UTC
RTC time: Sat 2015-09-19 14:00:55
Timezone: Asia/Shanghai (CST, +0800)
NTP enabled: yes
NTP synchronized: no
VIM 编辑器实现
[root@desktop0 logrotate.d]# vim /etc/chrony.conf
[root@desktop0 logrotate.d]# vim /etc/chrony.conf
server 172.25.0.254 iburst
sed 编辑实现
[root@desktop0 logrotate.d]# vim /etc/chrony.conf
:set nu
:3,7s/^/#/
<7>gg
yy
p
^
x
/4
9cw
172.25.0.254
ESC
17oot@desktop0 logrotate.d]# systemctl restart chronyd.service
[root@desktop0 logrotate.d]# timedatectl|grep NTP
NTP enabled: yes
NTP synchronized: yes
[root@desktop0 logrotate.d]# ssh 172.25.0.254 date;date
Agent admitted failure to sign using the key.
[email protected]'s password:
Sat Sep 19 14:18:02 CST 2015
Sat Sep 19 14:18:02 CST 2015
第十一章 红帽企业Linux网络管理
更改网卡名实现步骤:
[root@localhost Desktop]#find / -name 60-net.rules
/usr/lib/udev/rules.d/60-net.rules
[root@localhost Desktop]#rpm -qf /usr/lib/udev/rules.d/60-net.rules
initscripts-9.49.17-1.el7.x86_64
[root@localhost Desktop]#rpm -ql initscripts|grep rule
/usr/lib/udev/rules.d/60-net.rules
/usr/lib/udev/rules.d/81-kvm-rhel.rules
[root@localhost Desktop]#cp /usr/lib/udev/rules.d/60-net.rules /etc/udev/rules.d/
[root@localhost Desktop]#ifconfig #查看网卡的MAC地址并复制
[root@localhost Desktop]#vim 60-net.rules
ACTION=="add", SUBSYSTEM=="net", DRIVERS=="?*", ATTR{address}=="00:0c:29:ba:0d:60", PROGRAM="/lib/udev/rename_device", NAME="eth0"
[root@localhost Desktop]#sync #磁盘同步
[root@localhost Desktop]#shutdown -r 0 #重启系统
[root@localhost network-scripts]# tracepath www.baidu.com
1: 10.10.2.192 0.132ms pmtu 1500
1: 10.10.2.1 10.938ms
1: 10.10.2.1 5.322ms
2: no reply
[root@localhost network-scripts]# ip route
default via 10.10.2.1 dev eth0
10.10.2.0/24 dev eth0 proto kernel scope link src 10.10.2.192
169.254.0.0/16 dev eth0 scope link metric 1002
[root@localhost network-scripts]# ss -ta
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 100 127.0.0.1:smtp *:*
LISTEN 0 128 *:45313 *:*
LISTEN 0 128 *:sunrpc *:*
LISTEN 0 128 *:ssh *:*
LISTEN 0 128 127.0.0.1:ipp *:*
LISTEN 0 100 ::1:smtp :::*
LISTEN 0 128 :::sunrpc :::*
LISTEN 0 128 :::50261 :::*
LISTEN 0 128 :::ssh :::*
LISTEN 0 128 ::1:ipp :::*
[root@localhost network-scripts]# grep ^ssh /etc/services
ssh 22/tcp # The Secure Shell (SSH) Protocol
ssh 22/udp # The Secure Shell (SSH) Protocol
ssh 22/sctp # SSH
sshell 614/tcp # SSLshell
sshell 614/udp # SSLshell
ssh-mgmt 17235/tcp # SSH Tectia Manager
ssh-mgmt 17235/udp # SSH Tectia Manager
更改网卡配置:
方法1:nmcli命令
[root@localhost ~]# ls /etc/sysconfig/network-scripts/ifcfg-*
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysconfig/network-scripts/ifcfg-lo
[root@localhost ~]# nmcli connection add con-name zj
autoconnect ifname save type
[root@localhost ~]# nmcli connection add con-name zj ifname eth0 type ethernet autoconnect on ip4 172.25.0.228/16 gw4 172.25.0.254
Connection 'zj' (8473516c-dc4d-4851-ad3c-dbc914d1353e) successfully added.
[root@localhost ~]# ls /etc/sysconfig/network-scripts/ifcfg-*/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysconfig/network-scripts/ifcfg-lo
/etc/sysconfig/network-scripts/ifcfg-zj
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-zj
TYPE=Ethernet
BOOTPROTO=none
IPADDR0=172.25.0.228
PREFIX0=16
GATEWAY0=172.25.0.254
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_FAILURE_FATAL=no
NAME=zj
UUID=8473516c-dc4d-4851-ad3c-dbc914d1353e
DEVICE=eth0
ONBOOT=yes
[root@localhost ~]# nmcli connection modify zj +ipv4.addresses 10.1.1.1/8 ipv4.dns 8.8.8.8
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-zjTYPE=Ethernet
BOOTPROTO=none
IPADDR0=172.25.0.228
PREFIX0=16
GATEWAY0=172.25.0.254
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
NAME=zj
UUID=8473516c-dc4d-4851-ad3c-dbc914d1353e
DEVICE=eth0
ONBOOT=yes
IPADDR1=10.1.1.1
PREFIX1=8
DNS1=8.8.8.8
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
[root@localhost ~]# ls /etc/sysconfig/network-scripts/ifcfg-*
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysconfig/network-scripts/ifcfg-lo
/etc/sysconfig/network-scripts/ifcfg-zj
[root@localhost ~]# nmcli connection modify "System eth0" connection.autoconnect off
[root@localhost ~]# systemctl restart network
[root@localhost ~]# ip add show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:ba:0d:60 brd ff:ff:ff:ff:ff:ff
inet 10.10.2.192/24 brd 10.10.2.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:feba:d60/64 scope link
valid_lft forever preferred_lft forever
[root@localhost ~]# ip route
default via 10.10.2.1 dev eth0
default via 172.25.0.254 dev eth0 proto static metric 1024
10.10.2.0/24 dev eth0 proto kernel scope link src 10.10.2.192
169.254.0.0/16 dev eth0 scope link metric 1002
172.25.0.254 dev eth0 proto static scope link metric 1024
[root@localhost ~]# cat /etc/resolv.conf
nameserver 8.8.8.8
[root@localhost network-scripts]# nmcli con show #查看当前网络连接
NAME UUID TYPE DEVICE
eno16777736 7a3b19d2-1f3e-428d-b094-9edeb504ce27 802-3-ethernet --
方法2:图形界面配置方式
Applications-->System tools-->Settings-->Network-->Add Profile-->ipv4
方法3:nmtui配置方式
方法4:更改配置文件
/etc/sysconfig/network-scripts/ifcfg-eth0
更改主机名:
[root@localhost ~]# hostname
localhost.localdomain
[root@localhost ~]# hostnamectl set-hostname desktop.example.com
[root@localhost ~]# hostname
desktop.example.com
[root@localhost ~]# cat /etc/hostname
desktop.example.com
hosts文件：
[root@desktop0 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.254 classroom.example.com
172.25.254.254 content.example.com
[root@classroom ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.254 classroom.example.com
172.25.254.250 provision.example.com
[root@classroom ~]# host desktop0.example.com
desktop0.example.com has address 172.25.0.10
desktop0.example.com mail is handled by 10 smtp0.example.com.
[root@classroom ~]# host 172.25.0.10
10.0.25.172.in-addr.arpa domain name pointer desktop0.example.com.