Linux使用ssh公钥实现免密码登录实例
<p>ssh 无密码登录要使用公钥与私钥。linux下可以用用ssh-keygen生成公钥/私钥对，下面我以CentOS为例。</p>
<p>
有机器A(192.168.1.155)，B(192.168.1.181)。现想A通过ssh免密码登录到B。</p>
<p>
首先以root账户登陆为例。</p>
<p>
1.在A机下生成公钥/私钥对。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_526662">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># ssh-keygen -t rsa -P ''</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
-P表示密码，-P '' 就表示空密码，也可以不用-P参数，这样就要三车回车，用-P就一次回车。</p>
<p>
该命令将在/root/.ssh目录下面产生一对密钥id_rsa和id_rsa.pub。</p>
<p>
一般采用的ssh的rsa密钥:</p>
<ol>
<li>
id_rsa 私钥</li>
<li>
id_rsa.pub 公钥</li>
</ol>
<p>
下述命令产生不同类型的密钥</p>
<ol>
<li>
ssh-keygen -t dsa</li>
<li>
ssh-keygen -t rsa</li>
<li>
ssh-keygen -t rsa1</li>
</ol>
<p>
2.把A机下的/root/.ssh/id_rsa.pub 复制到B机的 /root/.ssh/authorized_keys文件里，先要在B机上创建好 /root/.ssh 这个目录，用scp复制。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_112939">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># scp /root/.ssh/id_rsa.pub root@192.168.1.181:/root/.ssh/authorized_keys</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">root@192.168.1.181's password:</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">id_rsa.pub 100% 223 0.2KB</code><code class="bash plain">/s</code> <code class="bash plain">00:00</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
由于还没有免密码登录的，所以要输入一次B机的root密码。</p>
<p>
3.authorized_keys的权限要是600!!!</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_895274">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># chmod 600 /root/.ssh/authorized_keys</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
4.A机登录B机。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_918908">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># ssh -l root 192.168.1.181</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">The authenticity of host </code><code class="bash string">'192.168.1.181 (192.168.1.181)'</code> <code class="bash plain">can't be established.</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">RSA key fingerprint is 00:a6:a8:87:eb:c7:40:10:39:cc:a0:eb:50:d9:6a:5b.</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash plain">Are you sure you want to </code><code class="bash keyword">continue</code> <code class="bash plain">connecting (</code><code class="bash functions">yes</code><code class="bash plain">/no</code><code class="bash plain">)? </code><code class="bash functions">yes</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash plain">Warning: Permanently added </code><code class="bash string">'192.168.1.181'</code> <code class="bash plain">(RSA) to the list of known hosts.</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash plain">Last login: Thu Jul 3 09:53:18 2008 from root</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash plain"></code><code class="bash comments">#</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
第一次登录是时要你输入yes。</p>
<p>
现在A机可以无密码登录B机了。</p>
<p>
小结：登录的机子可有私钥，被登录的机子要有登录机子的公钥。这个公钥/私钥对一般在私钥宿主机产生。上面是用rsa算法的公钥/私钥对，当然也可以用dsa(对应的文件是id_dsa，id_dsa.pub)</p>
<p>
想让A，B机无密码互登录，那B机以上面同样的方式配置即可。</p>
<p>
<strong>SSH-KeyGen 的用法</strong></p>
<p>
假设 A 为客户机器，B为目标机；</p>
<p>
要达到的目的：</p>
<p>
A机器ssh登录B机器无需输入密码；</p>
<p>
加密方式选 rsa|dsa均可以，默认dsa</p>
<p>
做法：</p>
<p>
1、登录A机器</p>
<p>
2、ssh-keygen -t ，将会生成密钥文件和私钥文件 id_rsa,id_rsa.pub或id_dsa,id_dsa.pub</p>
<p>
3、将 .pub 文件复制到B机器的 .ssh 目录， 并 cat id_dsa.pub >> ~/.ssh/authorized_keys</p>
<p>
4、大功告成，从A机器登录B机器的目标账户，不再需要密码了；</p>
<p>
ssh-keygen做密码验证可以使在向对方机器上ssh ,scp不用使用密码.</p>
<p>
具体方法如下:</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_633745">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash functions">ssh</code><code class="bash plain">-keygen -t rsa</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
然后全部回车,采用默认值.</p>
<p>
这样生成了一对密钥，存放在用户目录的~/.ssh下。</p>
<p>
将公钥考到对方机器的用户目录下，并拷到~/.ssh/authorized_keys中。</p>
<p>
要保证.ssh和authorized_keys都只有用户自己有写权限。否则验证无效。（今天就是遇到这个问题，找了好久问题所在），其实仔细想想，这样做是为了不会出现系统漏洞。</p>
<p>
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持。</p>
<p>
原文链接：http://www.cnblogs.com/Percy_Lee/p/5698603.html</p>
頁:
[1]