建站
咨詢(xún)
售后
建站咨詢(xún)
新聞中心
SSH 為 [Secure Shell](http://baike.baidu.com/item/Secure Shell) 的縮寫(xiě)，由 IETF 的網(wǎng)絡(luò)小組（Network Working Group）所制定；SSH 為建立在應(yīng)用層基礎(chǔ)上的安全協(xié)議。SSH 是目前較可靠，專(zhuān)為遠(yuǎn)程登錄會(huì)話和其他網(wǎng)絡(luò)服務(wù)提供安全性的協(xié)議。利用 SSH 協(xié)議可以有效防止遠(yuǎn)程管理過(guò)程中的信息泄露問(wèn)題，下面為大家分享一下SSH無(wú)密碼安全登錄具體方法。
今天我們通過(guò)使用ssh-kengen命令生成私鑰&公鑰對(duì)，目的：免密碼登錄SSH。其算法有兩種，分別是RSA和DSA。
RSA 是非對(duì)稱(chēng)加密算法，可以用來(lái)加密和簽名。
DSA(Digital Signature Algorithm) 只能用來(lái)數(shù)字簽名的算法。
以下操作適用于OS：Centos 7、Ubuntu 17，其他系統(tǒng)沒(méi)測(cè)，理論上都可以使用。
服務(wù)器:
10.10.204.63
10.10.204.64
1.如何生成ssh公鑰
登錄10.10.204.63服務(wù)器生成公私密鑰對(duì)：
[root@10-10-204-63 ~]# ssh-keygen -b 4096 -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:qLcoj2nSzq6G9ZpFQZ/OFqFT+oBDf3ousHkt82F1/xM root@10-10-204-63.10.10.204.63
The key's randomart image is: +---[RSA 4096]----+ | . . o | | . + = o | | o B = | | . X o | | . o B S . | | .= * . . . E | |.oo.B * . . | |oo+*.O o .. | |o*O+o o .. | +----[SHA256]-----+ 三次回車(chē)即可生成 ssh key。 注解：
-b 指定密鑰長(zhǎng)度。對(duì)于RSA密鑰，最小要求768位，默認(rèn)是2048位，最長(zhǎng)4096字節(jié)。
-t 指定要?jiǎng)?chuàng)建的密鑰類(lèi)型。可以使用：”rsa1″(SSH-1) “rsa”(SSH-2) “dsa”(SSH-2)。
2.查看生成的文件
[root@10-10-204-63 ~]# ll .ssh/
total 8
-rw------- 1 root root 3243 Nov 25 15:58 id_rsa
-rw-r--r-- 1 root root 758 Nov 25 15:58 id_rsa.pub
說(shuō)明：
id_rsa 私鑰
id_rsa.pub 公鑰
3.將公鑰上傳到10.10.204.64
[root@10-10-204-63 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@10.10.204.64
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '10.10.204.64 (10.10.204.64)' can't be established. ECDSA key fingerprint is SHA256:/YI/L4RT1QH7lkfxMCAkKnvniQslyUl15mOUKUo8K3k. ECDSA key fingerprint is MD5:6d:b6:f3:93:8e:48:53:24:9d:5d:c2:2a:5f:28:f4:d2. Are you sure you want to continue connecting (yes/no)? yes【輸入yes回車(chē)】 /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@10.10.204.64's password:【輸入服務(wù)器密碼回車(chē)】
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@10.10.204.64'"
and check to make sure that only the key(s) you wanted were added.
上傳成功。
4.修改SSH配置文件
登錄10.28.204.64修改，操作如下：
$ vim /etc/ssh/sshd_config
去除以下注釋?zhuān)?
RSAAuthentication yes
PubkeyAuthentication yes
5.重啟SSH服務(wù)
$ systemctl restart sshd
6.測(cè)試免密碼登錄10.10.204.64
[root@10-10-204-63 ~]# ssh 'root@10.10.204.64'
Last failed login: Sat Nov 25 16:09:48 CST 2017 from 83.234.149.66 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Sat Nov 25 15:57:33 2017 from 36.7.69.84
[root@10-10-204-64 ~]#
在不輸入密碼的情況下成功登錄。
登陸成功后，建議在10.10.204.64服務(wù)器上也生成ssh公鑰，并上傳到10.10.204.63服務(wù)器，這樣以來(lái)我們就可以相互免密碼SSH登陸。多臺(tái)服務(wù)器亦是如此。
7.查看公鑰
[root@10-10-204-64 ~]# ll /root/.ssh/
total 8
-rw------- 1 root root 758 Nov 25 16:08 authorized_keys
-rw-r--r--. 1 root root 175 Aug 9 09:19 known_hosts
authorized_keys是剛上傳過(guò)來(lái)的公鑰名稱(chēng)
8.如果公鑰丟失，可以使用私鑰再次生成公鑰，命令如下：
[root@10-10-204-63 ~]# ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub
網(wǎng)頁(yè)標(biāo)題：SSH無(wú)密碼安全登錄具體方法
路徑分享：http://www.dlmjj.cn/article/dhjgdos.html
