Linux集群内SSH免密码访问的快速配置方法
<p><img src="https://img.jbzj.com/file_images/article/201806/2018062515445933.png" alt="" /></p><p>日常无论测试环境还是生产环境，在进行多台服务器（集群）安装配置的时候，经常需要对集群内服务器SSH访问做免密码设置。比如Hadoop、HBase等集群的安装配置，或者多台服务器为便于后续运维也需要做SSH免密配置。</p>
<p>结合近期搭建测试环境的过程，对如何快速给多台服务器做相互SSH访问免密配置做一个说明。主要分为几个步骤：修改主机名称、配置汇聚服务器的秘钥、汇聚其他服务器秘钥、拷贝汇聚秘钥文件、生成know_hosts文件、拷贝know_hosts文件。<br />
</p>
<p><strong>1、集群规划</strong></p>
<p>
<table cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td nowrap="nowrap">
<p>主机IP</p>
</td>
<td nowrap="nowrap">
<p>主机名称</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.101</p>
</td>
<td nowrap="nowrap">
<p>dmz01</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.102</p>
</td>
<td nowrap="nowrap">
<p>dmz02</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.103</p>
</td>
<td nowrap="nowrap">
<p>inside01</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.104</p>
</td>
<td nowrap="nowrap">
<p>inside02</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.105</p>
</td>
<td nowrap="nowrap">
<p>inside03</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.106</p>
</td>
<td nowrap="nowrap">
<p>inside04</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.107</p>
</td>
<td nowrap="nowrap">
<p>inside05</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.108</p>
</td>
<td nowrap="nowrap">
<p>inside06</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.109</p>
</td>
<td nowrap="nowrap">
<p>inside07</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.110</p>
</td>
<td nowrap="nowrap">
<p>inside08</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.111</p>
</td>
<td nowrap="nowrap">
<p>inside09</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.112</p>
</td>
<td nowrap="nowrap">
<p>inside10</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.113</p>
</td>
<td nowrap="nowrap">
<p>inside11</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.114</p>
</td>
<td nowrap="nowrap">
<p>inside12</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.115</p>
</td>
<td nowrap="nowrap">
<p>inside13</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.116</p>
</td>
<td nowrap="nowrap">
<p>inside14</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.117</p>
</td>
<td nowrap="nowrap">
<p>inside15</p>
</td>
</tr>
<tr>
<td nowrap="nowrap">
<p>10.141.93.118</p>
</td>
<td nowrap="nowrap">
<p>inside16</p>
</td>
</tr>
</tbody>
</table>
</p>
<p>该集群共有18台服务器，划分为DMZ区2台，INSIDE区16台。主要用于web服务器和应用服务器、数据库、缓存等。为了部署应用、管理集群服务器方便，将18台服务器做SSH互访免密码配置。<br />
</p>
<p><strong>2、修改主机名称</strong></p>
<p>无论初装系统或云主机，其主机名称“localhost”或“VM_75_173_centos”都不容易进行区分服务器作用。所以便于安装、部署、维护方便，会重新修改主机名称hostname。<br />
修改主机名称可以使用下面命令：</p>
<blockquote>
<p>hostnamectl set-hostname inside01</p>
</blockquote>
<p>使用上述命令修改主机名称后重新ssh登陆，即可看到主机名称已经修改。</p>
<p><strong>3、配置汇聚服务器秘钥</strong></p>
<p>此处所谓汇聚服务器就是选定集群中的一台服务器，然后其他服务器与其做SSH免密码信任。本文选定dmz01（10.141.93.101）作为汇聚服务器。关系图如下所示：</p>
<p><img src="https://img.jbzj.com/file_images/article/201806/2018062515445934.png" data-s="300,640" data-type="png" data-ratio="0.4766666666666667" data-w="900" alt="" /></p>
<p>其他服务器向dmz01做SSH登陆免密码信任配置。此处dmz01就是汇聚服务器。</p>
<p>配置汇聚服务器秘钥的命令如下所示：</p>
<p># <code>ssh-keygen -t rsa</code></p>
<p>Generating public/private rsa key pair.</p>
<p>Enter file in which to save the key (/root/.ssh/id_rsa): </p>
<p>Enter passphrase (empty for no passphrase): </p>
<p>Enter same passphrase again: </p>
<p>Your identification has been saved in /root/.ssh/id_rsa.</p>
<p>Your public key has been saved in /root/.ssh/id_rsa.pub.</p>
<p>The key fingerprint is:</p>
<p>43:0d:08:18:ec:9e:d6:1f:ea:5f:04:30:0f:66:26:41 root@dmz01</p>
<p>The key's randomart image is:</p>
<p>+--[ RSA 2048]----+</p>
<p>| oE+O. .. |</p>
<p>| o= =. o |</p>
<p>| . o . . |</p>
<p>| . o |</p>
<p>| . o S |</p>
<p>| + . .. . |</p>
<p>| . o .. |</p>
<p>| . .. |</p>
<p>| .... |</p>
<p>+------------------+</p>
<p>进入“/root/.ssh”目录，拷贝生成“authorized_keys”文件，使用命令如下：</p>
<blockquote>
<p>cat id_rsa.pub >> authorized_keys</p>
</blockquote>
<p>结果如下所示：</p>
<p># ll<br />
total 12<br />
-rw-r--r-- 1 root root 395 Nov 12 16:25 authorized_keys<br />
-rw------- 1 root root 1675 Nov 12 16:24 id_rsa<br />
-rw-r--r-- 1 root root 395 Nov 12 16:24 id_rsa.pub</p>
<p><strong>4、拷贝其他服务器秘钥</strong></p>
<p>经过第3节配置汇聚服务器秘钥后，需要依次配置dmz02，inside01，…，inside16等17台服务器的秘钥。方法同第三节命令。<br />
配置完成其他17台服务器的秘钥后，需要将该17台服务器的秘钥复制拷贝到汇聚服务器dmz01上。其拷贝命令如下：</p>
<p># ssh-copy-id -i dmz01<br />
# ssh-copy-id -i dmz01</p>
<p>依次将17台的秘钥汇聚拷贝到dmz01上。</p>
<p><strong>5、拷贝汇聚秘钥文件</strong></p>
<p>从汇聚服务器将汇聚的秘钥文件依次拷贝到其他17台服务器的“/root/.ssh”目录下面，命令如下所示：</p>
<blockquote>
<p># scp authorized_keys dmz02:/root/.ssh/<br />
# scp authorized_keys inside01:/root/.ssh/<br />
…<br />
# scp authorized_keys inside16:/root/.ssh/<br />
root@inside16's password:<br />
authorized_keys 100% 7104 6.9KB/s 00:00</p>
</blockquote>
<p>如上所示进行scp拷贝秘钥文件“authorized_keys”，该过程需要输入密码。<br />
Ssh免密码验证：</p>
<blockquote>
<p># ssh dmz02<br />
The authenticity of host 'dmz02 (10.141.68.179)' can't be established.<br />
ECDSA key fingerprint is 22:49:b2:5c:7c:8f:73:56:89:29:8a:bd:56:49:74:66.<br />
Are you sure you want to continue connecting (yes/no)? yes<br />
Warning: Permanently added 'dmz02,10.141.68.179' (ECDSA) to the list of known hosts.<br />
Last login: Sat Nov 12 17:19:19 2016 from 10.141.93.186</p>
</blockquote>
<p>由上面可以看出“ssh dmz02”，ssh登陆dmz02服务器时，没有再需要输入密码。但是提示需要将dmz02添加到dmz01的“know hosts”列表文件中。这样下次ssh访问dmz02就不会再提示需要加入know hosts列表了。<br />
</p>
<p><strong>6、生成know_hosts文件</strong></p>
<p>从汇聚服务器依次ssh其他17台服务器，经过前面的免密码设置。不需要再输入密码，但是都有加入know hosts列表的提示。<br />
注意：为了把自己dmz01也加入到know hosts文件中，也需要“# ssh dmz01”一下。</p>
<p>最后生成的know_hosts文件内容如下所示：</p>
<p><img src="https://img.jbzj.com/file_images/article/201806/2018062515445935.jpg" data-s="300,640" data-type="png" data-ratio="0.3933333333333333" data-w="900" alt="" /></p>
<p>查看know_hosts文件行数：</p>
<blockquote>
<p># wc -l known_hosts<br />
18 known_hosts</p>
</blockquote>
<p>可以看出每个主机一行内容，表示dmz01知道了包括自己在内的所有18台服务器。<br />
</p>
<p><strong>7、拷贝know_hosts文件</strong></p>
<p>经过第六节生成18台服务器对dmz01的know host设置，将dmz01的/root/.ssh/know_hosts文件scp拷贝到其他17台服务器上。<br />
ssh免密码登陆验证：</p>
<blockquote>
<p># ssh inside10<br />
Last login: Tue Nov 15 15:01:18 2016 from 10.141.93.186<br />
# ssh inside15<br />
Last login: Sat Nov 12 17:52:29 2016 from 10.141.93.186<br />
# ssh dmz02<br />
Last login: Sat Nov 12 20:05:59 2016 from 10.141.93.186<br />
# ssh dmz01<br />
Last login: Thu Nov 17 23:56:05 2016 from 218.10.89.246<br />
# ssh inside15<br />
Last login: Fri Nov 18 00:23:54 2016 from 10.141.114.152</p>
</blockquote>
<p>ssh免密码登陆顺序：dmz01àinside10àinside15àdmz02àdmz01àinside15。<br />
</p>
<p>8、总结</p>
<p>本文主要涉及以下几个命令：</p>
<blockquote>
<p>hostnamectl set-hostname inside01<br />
ssh-keygen -t rsa<br />
ssh-copy-id -i dmz01</p>
</blockquote>
<p>这篇文章就介绍到这了，希望大家以后多多支持琼殿技术社区。</p>
頁:
[1]