ssh远程连接主机及sshkey加密配置
2017-07-26 10:31
543 查看
客户端连接方式
sshkey加密配置
注:本次实验在两台虚拟机下进行,加密主机ip是172.25.254.132;客户端(获得私匙方)ip是172.25.254.232。
1.生成公钥及私钥
此时,可以看到在/root/.ssh/目录下生成了id_rsa及id_rsa.pub文件。id_rsa为私匙,id_rsa.pub为公匙。
2.添加key认证方式
3.分发钥匙给客户端
4.客户端下查看钥匙
至此,客户端便可实现免密登陆
提升openssh的安全级别
编辑/etc/hosts.allow文件,将远程主机的登陆信息输出到系统日志
当指定ip主机连接本台主机时,将会在屏幕上显示远程主机登陆信息,如下所示
ssh 远程主机用户@远程主机ip ##普通连接 ssh 远程主机用户@远程主机ip -X ##调用远程主机图形工具 ssh 远程主机用户@远程主机ip command ##直接在远程主机运行某条命令
sshkey加密配置
注:本次实验在两台虚拟机下进行,加密主机ip是172.25.254.132;客户端(获得私匙方)ip是172.25.254.232。
1.生成公钥及私钥
[root@Client Desktop]# ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: c9:52:14:ba:cf:b5:d5:9c:e9:e0:50:bc:c9:f8:aa:8d root@Client The key's randomart image is: +--[ RSA 2048]----+ | o. | | o . | | . . o | | + . + = o | | o S + * = | | + . * o | | o . o . | | o . | | E.o | +-----------------+
此时,可以看到在/root/.ssh/目录下生成了id_rsa及id_rsa.pub文件。id_rsa为私匙,id_rsa.pub为公匙。
[root@Client Desktop]# ls /root/.ssh/ authorized_keys id_rsa id_rsa.pub known_hosts
2.添加key认证方式
[root@Client Desktop]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.254.132 The authenticity of host '172.25.254.132 (172.25.254.132)' can't be established. ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@172.25.254.132's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'root@172.25.254.132'" and check to make sure that only the key(s) you wanted were added.
3.分发钥匙给客户端
[root@Client Desktop]# scp /root/.ssh/id_rsa root@172.25.254.232:/root/.ssh/ The authenticity of host '172.25.254.232 (172.25.254.232)' can't be established. ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '172.25.254.232' (ECDSA) to the list of known hosts. root@172.25.254.232's password: id_rsa 100% 1679 1.6KB/s 00:00
4.客户端下查看钥匙
root@server Desktop]# ls /root/.ssh/ authorized_keys id_rsa
至此,客户端便可实现免密登陆
[root@server Desktop]# ssh root@172.25.254.132 The authenticity of host '172.25.254.132 (172.25.254.132)' can't be established. ECDSA key fingerprint is eb:24:0e:07:96:26:b1:04:c2:37:0c:78:2d:bc:b0:08. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '172.25.254.132' (ECDSA) to the list of known hosts. Last login: Tue Jul 25 22:35:00 2017 [root@Client ~]#
提升openssh的安全级别
**修改openssh-server配置文件** /etc/ssh/sshd_config 78 PasswordAuthentication yes|no ##是否开启用户密码认证,yes为支持no为关闭 48 PermitRootLogin yes|no ##是否允许超级用户登陆 49 AllowUsers student westos ##用户白名单,只有在名单中出现的用户可以使用sshd建立shell 50 DenyUsers westos ##用户黑名单 注:白名单优先级较黑名单高 **控制ssh客户端访问** vim /etc/hosts.deny sshd:ALL ##拒绝所有人链接sshd服务 vim /etc/hosts.allow sshd:172.25.254.250 ##允许250主机链接sshd sshd:172.25.254.250,172.25.254.180 ##允许250和180链接 sshd:ALL EXCEPT 172.25.254.200 ##只不允许200链接sshd **ssh登陆提示修改** vim /etc/motd ##编辑登陆后显示的字符
编辑/etc/hosts.allow文件,将远程主机的登陆信息输出到系统日志
sshd:172.25.254.132 :spawn echo `date` from %c to %s >> /var/log/messages ##输出到当前终端设备 sshd:172.25.254.132 :spawn echo `date` from %c to %s >> /dev/pts/0
当指定ip主机连接本台主机时,将会在屏幕上显示远程主机登陆信息,如下所示
相关文章推荐
- ssh远程连接主机及sshkey加密配置
- ssh远程连接主机及sshkey加密配置
- ssh远程连接主机及sshkey加密配置
- ssh远程连接主机及sshkey加密配置
- RedHat系统下的网络配置,主机名的修改,进入单用户模式修改root密码和使用SSH远程连接工具
- SSH简介及配置使用SSH登陆远程主机
- 【Linux】SSH连接远程主机等待时间很长的解决办法
- 远程连接Linux (Ubuntu配置SSH服务) 端口22
- [ 转载 ] ssh连接远程主机执行脚本的环境变量问题
- ssh图形化连接远程主机时报错X11 forwarding request failed on channel 0
- Linux配置SSH服务以便实现远程连接
- VirtualBox安装Centos,配置网络(主机可以通过SSH连接虚拟机系统,同时虚拟机系统可以访问外网)
- SSH简介及配置使用SSH登陆远程主机
- java 通过SSH方式连接远程主机并上传和下载文件
- 华为配置远程ssh连接
- ssh(ssh-keygen)配置免输入密码登录远程主机的方法
- Notepad++远程连接ssh修改linux中配置文件
- ubuntu下ssh连接远程主机特别慢的解决办法
- SSH远程连接Linux配置
- linux下使用ssh远程主机连接