Linux 下sftp配置之密钥方式登录详解
<p><strong>linux下sftp配置之密钥方式登录</strong></p>
<p>
由于vsftp采用明文传输，用户名密码可通过抓包得到，为了安全性，需使用sftp，锁定目录且不允许sftp用户登到服务器。由于sftp使用的是ssh协议，需保证用户只能使用sftp，不能ssh到机器进行操作，且使用密钥登陆、不是22端口。</p>
<p>
<strong>1. 创建sftp服务用户组,创建sftp服务根目录</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_659920">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">groupadd </code><code class="bash functions">sftp</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
#此目录及上级目录的所有者必须为root，权限不高于755，此目录的组最好设定为sftp</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_394359">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash functions">mkdir</code> <code class="bash plain">/data/sftp</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash functions">chown</code> <code class="bash plain">-r root:</code><code class="bash functions">sftp</code> <code class="bash plain">/data/sftp</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash functions">chmod</code> <code class="bash plain">-r 0755 </code><code class="bash plain">/data/sftp</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
2. 修改sshd配置文件</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_318892">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash functions">cp</code> <code class="bash plain">/etc/ssh/sshd_config</code><code class="bash plain">,_bk} </code><code class="bash comments">#备份配置文件</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash functions">sed</code> <code class="bash plain">-i </code><code class="bash string">'s@#port 22@port 22@'</code> <code class="bash plain">/etc/ssh/sshd_config</code> <code class="bash plain">#保证原来22端口可以</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_599285">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash functions">vi</code> <code class="bash plain">/etc/ssh/sshd_config</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
注释掉/etc/ssh/sshd_config文件中的此行代码：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_302514">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">subsystem </code><code class="bash functions">sftp</code> <code class="bash plain">/usr/libexec/openssh/sftp-server</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
添加如下代码：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_191991">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">port 2222</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">subsystem </code><code class="bash functions">sftp</code> <code class="bash plain">internal-</code><code class="bash functions">sftp</code> <code class="bash plain">-l info -f auth</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">match group </code><code class="bash functions">sftp</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash plain">chrootdirectory </code><code class="bash plain">/data/sftp/</code><code class="bash plain">%u</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash plain">x11forwarding no</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash plain">allowtcpforwarding no</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash plain">forcecommand internal-</code><code class="bash functions">sftp</code> <code class="bash plain">-l info -f auth</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
凡是在用户组sftp里的用户，都可以使用sftp服务；使用sftp服务连接上之后，可访问目录为/data/sftp/username</p>
<p>
举个例子：</p>
<p>
test是一个sftp组的用户，它通过sftp连接服务器上之后，只能看到/data/sftp/test目录下的内容</p>
<p>
test2也是一个sftp组的用户，它通过sftp连接服务器之后，只能看到/data/sftp/test2目录下的内容</p>
<p>
<strong>3. 创建sftp用户</strong></p>
<p>
#此例将创建一个名称为test的sftp帐号</p>
<p>
#创建test sftp家目录：test目录的所有者必须是root，组最好设定为sftp，权限不高于755</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_245691">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash functions">mkdir</code> <code class="bash plain">/data/sftp/test</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash functions">chmod</code> <code class="bash plain">0755 </code><code class="bash plain">/data/sftp/test</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash functions">chown</code> <code class="bash plain">root:</code><code class="bash functions">sftp</code> <code class="bash plain">/data/sftp/test</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash functions">useradd</code> <code class="bash plain">-g </code><code class="bash functions">sftp</code> <code class="bash plain">-s </code><code class="bash plain">/sbin/nologin</code> <code class="bash functions">test</code> <code class="bash comments">#添加用户，参数-s /sbin/nologin禁止用户通过命令行登录</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
创建test用户密钥对：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_490482">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash comments"># mkdir /home/test/.ssh</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash comments"># ssh-keygen -t rsa</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash comments"># cp /root/.ssh/id_rsa.pub /home/test/.ssh/authorized_keys</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash comments"># chown -r test.sftp /home/test</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
在test目录下创建一个可以写的upload目录</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_493791">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash functions">mkdir</code> <code class="bash plain">/data/sftp/test/upload</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash functions">chown</code> <code class="bash plain">-r </code><code class="bash functions">test</code><code class="bash plain">:</code><code class="bash functions">sftp</code> <code class="bash plain">/data/sftp/test/upload</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
<span><strong>注：</strong></span><strong>sftp服务的根目录的所有者必须是root，权限不能超过755(上级目录也必须遵循此规则)，sftp的用户目录所有者也必须是root,且最高权限不能超过755。</strong></p>
<p>
<strong>4. 测试sftp</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_323360">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">service sshd restart</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
test用户密钥登陆如下图：</p>
<p>
<img title="Linux 下sftp配置之密钥方式登录详解" alt="Linux 下sftp配置之密钥方式登录详解" src="https://zhuji.jb51.net/uploads/img/202305/ee10df8c9138adbd44d47b19ec562c1b.jpg"></p>
<p>
感谢阅读，希望能帮助到大家，谢谢大家对本站的支持！</p>
頁:
[1]