在CentOS / RHEL上设置 SSH 免密码登录的方法
<p>作为系统管理员，你计划在 Linux 上使用 OpenSSH，完成日常工作的自动化，比如文件传输、备份数据库转储文件到另一台服务器等。为实现该目标，你需要从主机 A 能自动登录到主机 B。自动登录也就是说，要在 shell 脚本中使用ssh，而无需要输入任何密码。</p>
<p>
本文会告诉你怎样在 CentOS/RHEL 上设置 SSH 免密码登录。自动登录配置好以后，你可以通过它使用 SSH （Secure Shell）和安全复制 （SCP）来移动文件。</p>
<p>
SSH 是开源的，是用于远程登录的最为可靠的网络协议。系统管理员用它来执行命令，以及通过 SCP 协议在网络上向另一台电脑传输文件。</p>
<p>
通过配置 SSH 免密码登录，你可以享受到如下的便利：</p>
<ol>
<li>
用脚本实现日常工作的自动化。</li>
<li>
增强 Linux 服务器的安全性。这是防范虚拟专用服务器（VPS）遭受暴力破解攻击的一个推荐的方法，SSH 密钥单凭暴力破解是几乎不可攻破的。</li>
</ol>
<p>
<strong>什么是 ssh-keygen</strong></p>
<p>
ssh-keygen 是一个用来生成、创建和管理 SSH 认证用的公私钥的工具。通过 ssh-keygen 命令，用户可以创建支持SSH1 和 SSH2 两个协议的密钥。ssh-keygen 为 SSH1 协议创建 RSA 密钥，SSH2 则可以是 RSA 或 DSA。</p>
<p>
<strong>什么是 ssh-copy-id</strong></p>
<p>
ssh-copy-id 是用来将本地公钥拷贝到远程的 authorized_keys 文件的脚本命令，它还会将身份标识文件追加到远程机器的 ~/.ssh/authorized_keys 文件中，并给远程主机的用户主目录适当的的权限。</p>
<p>
<strong>SSH 密钥</strong></p>
<p>
SSH 密钥为登录 Linux 服务器提供了更好且安全的机制。运行 ssh-keygen 后，将会生成公私密钥对。你可以将公钥放置到任意服务器，从持有私钥的客户端连接到服务器的时，会用它来解锁。两者匹配时，系统无需密码就能解除锁定。</p>
<p>
<strong>在 CentOS 和 RHEL 上设置免密码登录 SSH</strong></p>
<p>
以下步骤在 CentOS 5/6/7、RHEL 5/6/7 和 Oracle Linux 6/7 上测试通过。</p>
<p>
节点1 : 192.168.0.9 节点2 : 192.168.l.10</p>
<p>
<strong>步骤1 :</strong></p>
<p>
测试节点1到节点2的连接和访问：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_316028">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># ssh root@192.168.0.10</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">The authenticity of host </code><code class="bash string">'192.168.0.10 (192.168.0.10)'</code> <code class="bash plain">can't be established.</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">RSA key fingerprint is 6d:8f:63:9b:3b:63:e1:72:b3:06:a4:e4:f4:37:21:42.</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash plain">Are you sure you want to </code><code class="bash keyword">continue</code> <code class="bash plain">connecting (</code><code class="bash functions">yes</code><code class="bash plain">/no</code><code class="bash plain">)? </code><code class="bash functions">yes</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash plain">Warning: Permanently added </code><code class="bash string">'192.168.0.10'</code> <code class="bash plain">(RSA) to the list of known hosts.</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash plain">root@192.168.0.10's password:</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash plain">Last login: Thu Dec 10 22:04:55 2015 from 192.168.0.1</code>
</div>
<div class="line number8 index7 alt1">
<code class="bash plain"></code><code class="bash comments">#</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>步骤二：</strong></p>
<p>
使用 ssh-key-gen 命令生成公钥和私钥，这里要注意的是可以对私钥进行加密保护以增强安全性。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_661479">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># ssh-keygen</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">Generating public</code><code class="bash plain">/private</code> <code class="bash plain">rsa key pair.</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">Enter </code><code class="bash functions">file</code> <code class="bash keyword">in</code> <code class="bash functions">which</code> <code class="bash plain">to save the key (</code><code class="bash plain">/root/</code><code class="bash plain">.</code><code class="bash functions">ssh</code><code class="bash plain">/id_rsa</code><code class="bash plain">):</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash plain">Enter passphrase (empty </code><code class="bash keyword">for</code> <code class="bash plain">no passphrase):</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash plain">Enter same passphrase again:</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash plain">Your identification has been saved </code><code class="bash keyword">in</code> <code class="bash plain">/root/</code><code class="bash plain">.</code><code class="bash functions">ssh</code><code class="bash plain">/id_rsa</code><code class="bash plain">.</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash plain">Your public key has been saved </code><code class="bash keyword">in</code> <code class="bash plain">/root/</code><code class="bash plain">.</code><code class="bash functions">ssh</code><code class="bash plain">/id_rsa</code><code class="bash plain">.pub.</code>
</div>
<div class="line number8 index7 alt1">
<code class="bash plain">The key fingerprint is:</code>
</div>
<div class="line number9 index8 alt2">
<code class="bash plain">b4:51:7e:1e:52:61:</code><code class="bash functions">cd</code><code class="bash plain">:fb:b2:98:4b:ad:a1:8b:31:6d root@node1.ehowstuff.</code><code class="bash functions">local</code>
</div>
<div class="line number10 index9 alt1">
<code class="bash plain">The key's randomart image is:</code>
</div>
<div class="line number11 index10 alt2">
<code class="bash plain">+--[ RSA 2048]----+</code>
</div>
<div class="line number12 index11 alt1">
<code class="bash plain">| . ++ |</code>
</div>
<div class="line number13 index12 alt2">
<code class="bash plain">| o o o |</code>
</div>
<div class="line number14 index13 alt1">
<code class="bash plain">| o o o . |</code>
</div>
<div class="line number15 index14 alt2">
<code class="bash plain">| . o + .. |</code>
</div>
<div class="line number16 index15 alt1">
<code class="bash plain">| S . . |</code>
</div>
<div class="line number17 index16 alt2">
<code class="bash plain">| . .. .|</code>
</div>
<div class="line number18 index17 alt1">
<code class="bash plain">| o E oo.o |</code>
</div>
<div class="line number19 index18 alt2">
<code class="bash plain">| = ooo. |</code>
</div>
<div class="line number20 index19 alt1">
<code class="bash plain">| . o.o. |</code>
</div>
<div class="line number21 index20 alt2">
<code class="bash plain">+-----------------+</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>步骤三：</strong></p>
<p>
用 ssh-copy-id 命令将公钥复制或上传到远程主机，并将身份标识文件追加到节点2的 ~/.ssh/authorized_keys 中：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_770887">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># ssh-copy-id -i ~/.ssh/id_rsa.pub 192.168.0.10</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">root@192.168.0.10's password:</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">Now try logging into the machine, with </code><code class="bash string">"ssh '192.168.0.10'"</code><code class="bash plain">, and check </code><code class="bash keyword">in</code><code class="bash plain">:</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash plain">.</code><code class="bash functions">ssh</code><code class="bash plain">/authorized_keys</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash plain">to </code><code class="bash functions">make</code> <code class="bash plain">sure we haven</code><code class="bash string">'t added extra keys that you weren'</code><code class="bash plain">t expecting.</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>步骤四：</strong></p>
<p>
验证免密码 SSH 登录节点2：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_145287">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># ssh root@192.168.0.10</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">Last login: Sun Dec 13 14:03:20 2015 from www.ehowstuff.</code><code class="bash functions">local</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
希望这篇文章能帮助到你，为你提供 SSH 免密码登录 CentOS / RHEL 的基本认知和快速指南。谢谢大家对本站的支持！</p>
<p>
原文链接：https://linux.cn/article-6901-1.html</p>
頁:
[1]