Linux-ssh-key验证

ssh登录验证方式介绍

ssh服务登录的常用验证方式

用户/口令
基于密钥

基于用户和口令登录验证

客户端发起ssh请求，服务器会把自己的公钥发送给用户
用户会根据服务器发来的公钥对密码进行加密
加密后的信息回传给服务器，服务器用自己的私钥解密，如果密码正确，则用户登录成功

基于密钥的登录方式

首先在客户端生成一对密钥（ssh-keygen）
并将客户端的公钥ssh-copy-id 拷贝到服务端
当客户端再次发送一个连接请求，包括ip、用户名
服务端得到客户端的请求后，会到authorized_keys中查找，如果有响应的IP和用户，就会随机生成一个字符串。
服务端将使用客户端拷贝过来的公钥进行加密，然后发送给客户端
得到服务端发来的消息后，客户端会使用私钥进行解密，然后将解密后的字符串发送给服务端
服务端接受到客户端发来的字符串后，跟之前的字符串进行对比，如果一致，就允许免密码登录

实现基于密钥的登录方式

再客户端生成密钥对

ssh-keygen -t rsa [-P 'password'] [-f “~/.ssh/id_rsa"]

把公钥文件传输至远程服务器对应用户的家目录

ssh-copy-id [-i [identity_file]] [user@]host

重设私钥口令：

ssh-keygen -p

验证代理（authentication agent）保密解密后的密钥，口令就只需要输入一次，在GNOME中，代理被自动提供给root用户

#启用代理

ssh-agent bash

#钥匙通过命令添加给代理

ssh-add

在SecureCRT或Xshell实现基于key验证

在SecureCRT工具—>创建公钥—>生成Identity.pub文件

转化为openssh兼容格式（适合SecureCRT，Xshell不需要转化格式），并复制到需登录主机上相应文件authorized_keys中,注意权限必须为600，在需登录的ssh主机上执行：

ssh-keygen  -i -f Identity.pub >> .ssh/authorized_keys

示例：实现key验证

1、生成密钥文件

[root@centos7-liyj ~]#ssh-keygen

Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id_rsa):  #回车，默认值

Created directory '/root/.ssh'.

Enter passphrase (empty for no passphrase): #回车，默认值，空密码

Enter same passphrase again: #回车，默认值

Your identification has been saved in /root/.ssh/id_rsa.

Your public key has been saved in /root/.ssh/id_rsa.pub.

The key fingerprint is:

SHA256:beb76jlNwNgyAjqbZWDfqwAUibQejOj/8GbU6cU1SeQ root@centos7-liyj

The key's randomart image is:

+---[RSA 2048]----+

|ooo       ..     |

|=o+ .     ..     |

|+= + o   +.E.    |

|+ + + o +.++     |

| + *  .oSo=..    |

|  =  ..o *  .    |

|   +... . .o     |

|    =o .  .o.    |

|    oo   .=+.    |

+----[SHA256]-----+

[root@centos7-liyj ~]#tree .ssh/

.ssh/

├── id_rsa

└── id_rsa.pub

0 directories, 2 files

[root@centos7-liyj ~]#ll .ssh/

total 8

-rw------- 1 root root 1675 Apr 29 15:32 id_rsa

-rw-r--r-- 1 root root  399 Apr 29 15:32 id_rsa.pub

[root@centos7-liyj ~]#cat .ssh/id_rsa.pub

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGYDO+EKw/2OteUi6IjyWPOoLkTsVhApCDhqA6b4Egpc1sdmwDKaIWz06gdPUncGkCTvKF35gEi+yT3SPdjJE+8/mbD3IVpFW7GUU5MWB3JvqJEI2kr4NBuO876ygxrFUe4sOnZLqIX28qwYeG31XWyYIvd27G7ycTfFFiULa20QeipsEtypKwTj3kw5+xVbqGNl6emSqRKWhvhk1AT4InuLy2Vxdz3ssRxLBUQLTbd/ltpRtv5M2+zJw7rUUfjDsXQrwN+y/N4CXbWS+2eX/OmVBA+jbc9IzHonJQu6DgO0Mr7ALEjAmk/8q4clejOECkbktZILf7R7hVzXu4Pmbf root@centos7-liyj

[root@centos7-liyj ~]#cat .ssh/id_rsa

-----BEGIN RSA PRIVATE KEY-----

MIIEowIBAAKCAQEAxmAzvhCsP9jrXlIuiI8ljzqC5E7FYQKQg4agOm+BIKXNbHZs

AymiFs9OoHT1J3BpAk7yhd+YBIvsk90j3YyRPvP5mw9yFaRVuxlFOTFgdyb6iRCN

pK+DQbjvO+soMaxVHuLDp2S6iF9vKsGHht9V1smCL3duxu8nE3xRYlC2ttEHoqbB

LcqSsE495MOfsVW6hjZenpkqkSlob4ZNQE+CJ7i8tlcXc97LEcSwVEC023f5baUb

b+TNvsycO61FH4w7F0K8DfsvzeAl21kvtnl/zplQQPo23PSMx6JyULug4DtDK+wC

xIwJpP/KuHJXozhApG5LWSC3+0e4Vc17uD5m3wIDAQABAoIBAHRAkFID502LS3N8

6bQxXytueKJe3yCYpiPN0zwreBqvz5COXYIE9e40ErnJkJlKMN+fcFSv0aBod323

jHsbE0s3IsGR7aNtKKh6iKyZmRR6jTuhrcAi8uKjA9+zUVy6xy9QaKRCTWX5t2Xx

AAE0BFPYxygV7585K0cqBW9+KXU8RRk49tnicBm/Wys3vrnqK39/2ikMxoUCAEGR

yk44+lY+ik3W15nbB0nwNPdSDEnmdeR5jO4zDRdDkIfV58xrZRUDuJD9lgfXdgYT

cLP57oC+M5YFdhjsunRDrcFnj6oEJuazdVW7agbGl5gEDbqEFiOo6+nbr1JG8Scx

Yny0uIECgYEA9N7ieevWzLAL4EiCyKWdTcl9VkwsLpqrFNLKv0D0HKGgEEwW4tTA

DaBT7P5bx9NwOYdKRqPJap07y71cAZFEtBd+w4Ch+/t+b6t57S48iSfHMPoLfer2

yljrQhusKsWiU1UZ89IF7RrxYdGgubBmMMKluIHm77qwSXMLRwKFH38CgYEAz2RX

WSR7SSOoRudGhP6EOTbQkH6jpS2I485PrdUaCwXshEkTM/azwy61JXTox/9cJrDc

Nwl1H+ZG+VgpFgAv3iEg1tUpskXEXSMoXP+kVK+Pt473tPhRbjnGu3+PWq8wUggM

6mYB66ArMIGjEOMCy/X/+yp3/ccMfD4ncg9GaKECgYEAiZO0YNXNYEFE2uVCfaL3

B14+Sj8Pz7tchZ2NBfljbbatLJrjfNwVb1J19MBQJqw38Ep/w8KABqOClgy05biN

hjVxJjxeRindtrX8EfMZVeIAexbxX/SkZbmhrAnKKFnTwsgcha2pYLbziYbyq4Fd

WOXzn/90FZqpMwss+d+DldcCgYA9aDuI1ImAnYM9A0vZIzdpbXaR4j14MiRfN35W

PUwJyYY/oReDgl+1wkW2wogOd+kEN8fsr+szN876E4WO0x1ZSzvbAKDo/UloPnm8

F6HDxXvrYPSta/1Iguj6KYn70vWexG12lh+pcfJ32Vq8LEtusvdJmkiPJvnma8zo

M+eoIQKBgGKw2S21ZjessqgvAqQ0itX30kLJOMGR883me1OoVjK7JlnA0gQi7dxk

e36ho72NOVutXEFmIh4H6UTJWC5jSnEOXkm5uWAaXYBybrx2PvOJ8j2AXOPszxW5

WZM8GtLHOgj9VwEkKUZT+k3E07qogt/EILxGuUi4QO+I3D2J9Vbs

-----END RSA PRIVATE KEY-----

生成的公钥和密钥

2、传送密钥文件至远程机器对应用户的家目录

[root@centos7-liyj ~]#ssh-copy-id -i /root/.ssh/id_rsa.pub root@10.0.0.88

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"

The authenticity of host '10.0.0.88 (10.0.0.88)' can't be established.

ECDSA key fingerprint is SHA256:znuk6BAInoe362ut3bwJWL5K6tg8VKfXj2EHZ/8mt8s.

ECDSA key fingerprint is MD5:a8:ca:c4:71:1a:11:6b:28:f5:f0:17:b6:a8:f4:49:e4.

Are you sure you want to continue connecting (yes/no)? yes

/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

root@10.0.0.88's password:  #输入远程用户的密码

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@10.0.0.88'"

and check to make sure that only the key(s) you wanted were added.

[root@centos8-liyj ~]#ll -a

total 23980

dr-xr-x---.  4 root root      188 Apr 29 13:38 .

dr-xr-xr-x. 19 root root      270 Apr 28 09:45 ..

-rw-------.  1 root root     1470 Apr 18 18:34 anaconda-ks.cfg

-rw-------.  1 root root     9755 Apr 28 19:08 .bash_history

-rw-r--r--.  1 root root       18 May 11  2019 .bash_logout

-rw-r--r--.  1 root root      176 May 11  2019 .bash_profile

-rw-r--r--.  1 root root      176 Apr 18 19:38 .bashrc

drwx------   4 root root       32 Apr 27 22:09 .config

-rw-r--r--.  1 root root      100 May 11  2019 .cshrc

-rw-r--r--   1 root root 24504320 Apr 28 10:02 -J

drwx------   2 root root       29 Apr 29 15:44 .ssh

-rw-r--r--.  1 root root      129 May 11  2019 .tcshrc

-rw-------   1 root root    11607 Apr 28 11:37 .viminfo

[root@centos8-liyj ~]#tree .ssh/

.ssh/

└── authorized_keys

0 directories, 1 file

[root@centos8-liyj ~]#cat .ssh/authorized_keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGYDO+EKw/2OteUi6IjyWPOoLkTsVhApCDhqA6b4Egpc1sdmwDKaIWz06gdPUncGkCTvKF35gEi+yT3SPdjJE+8/mbD3IVpFW7GUU5MWB3JvqJEI2kr4NBuO876ygxrFUe4sOnZLqIX28qwYeG31XWyYIvd27G7ycTfFFiULa20QeipsEtypKwTj3kw5+xVbqGNl6emSqRKWhvhk1AT4InuLy2Vxdz3ssRxLBUQLTbd/ltpRtv5M2+zJw7rUUfjDsXQrwN+y/N4CXbWS+2eX/OmVBA+jbc9IzHonJQu6DgO0Mr7ALEjAmk/8q4clejOECkbktZILf7R7hVzXu4Pmbf root@centos7-liyj

远程的机器

3、远程连接88号机器

[root@centos7-liyj ~]#ssh 10.0.0.88

Last login: Fri Apr 29 13:37:58 2022 from 10.0.0.1

[root@centos8-liyj ~]#

4、对私钥加密

[root@centos7-liyj ~]#ssh-keygen -p

Enter file in which the key is (/root/.ssh/id_rsa):  #默认

Enter new passphrase (empty for no passphrase):  #密码

Enter same passphrase again:   #再次确认密码

Your identification has been saved with the new passphrase.

[root@centos7-liyj ~]#ssh 10.0.0.88

Enter passphrase for key '/root/.ssh/id_rsa': #输入私钥密码

Last login: Fri Apr 29 15:58:51 2022 from 10.0.0.1

[root@centos8-liyj ~]#

5、启动ssh代理，只要不退出 ssh代理进程，基于同一个公钥远程连接机器的就一直免输密码

[root@centos7-liyj ~]#ssh-agent bash       #启用代理

[root@centos7-liyj ~]#ps aux |grep agent

root       1247  0.0  0.0  72552   784 ?        Ss   16:06   0:00 ssh-agent bash

root       1259  0.0  0.0 112812   980 pts/0    R+   16:06   0:00 grep --color=auto agent

[root@centos7-liyj ~]#ssh-add      #添加代理

Enter passphrase for /root/.ssh/id_rsa:     #私钥密码

Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)

[root@centos7-liyj ~]#ssh 10.0.0.88

Last login: Fri Apr 29 16:02:50 2022 from 10.0.0.77

6、退出代理，代理是进程性的，退出进程就不在生效

[root@centos7-liyj ~]#ssh-agent bash

[root@centos7-liyj ~]#ps aux |grep agent

root       1247  0.0  0.0  72552   784 ?        Ss   16:06   0:00 ssh-agent bash

root       1259  0.0  0.0 112812   980 pts/0    R+   16:06   0:00 grep --color=auto agent

[root@centos7-liyj ~]#ssh-add

Enter passphrase for /root/.ssh/id_rsa:

Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)

[root@centos7-liyj ~]#ssh 10.0.0.88

Last login: Fri Apr 29 16:02:50 2022 from 10.0.0.77

[root@centos8-liyj ~]#exit

logout

Connection to 10.0.0.88 closed.

[root@centos7-liyj ~]#exit

exit

[root@centos7-liyj ~]#ps aux |grep agent

root       1264  0.0  0.0 112812   976 pts/0    S+   16:10   0:00 grep --color=auto agent

[root@centos7-liyj ~]#

再次连接需输入私钥密码

范例：基于key验证实现批量主机管理

[root@centos7 ~]#cat hosts.txt

10.0.0.78

10.0.0.10

[root@centos7 ~]#for i in `cat hosts.txt`;do ssh $i hostname -I ;done

10.0.0.78

10.0.0.10

Linux-ssh-key验证的更多相关文章

linux ssh key配置方法
转自:http://blog.csdn.net/zzk197/article/details/7915307 一:简洁的配置文件[root@cisco ~]# vi /etc/ssh/sshd_con ...
Linux SSH: key, agent, keychain
以前遇到过一个问题,在用有些 Linux 发行版时,用 ssh-keygen 产生好了密钥对并上传到了目标服务器,但每次登录都要重新输入. 这与 ssh-agent 有关,看如下 man ssh-ag ...
Linux ssh命令详解
SSH(远程连接工具)连接原理:ssh服务是一个守护进程(demon),系统后台监听客户端的连接,ssh服务端的进程名为sshd,负责实时监听客户端的请求(IP 22端口),包括公共秘钥等交换等信息. ...
Linux ssh命令
SSH(远程连接工具)连接原理:ssh服务是一个守护进程(demon),系统后台监听客户端的连接,ssh服务端的进程名为sshd,负责实时监听客户端的请求(IP 22端口),包括公共秘钥等交换等信息. ...
创建SSH Key连接github或gitlab
mac下用SoureceTree下载github或gitlab上的项目时,需要进行ssh key验证.每次重装系统啥的都要重新弄,我在csdn上看到一篇不错的文章.转载一下,以后自己找起来也方便. 地 ...
（Git 学习）Git SSH Key 创建步骤
首先感谢segmentfalut上的朋友对我帮助. 首先:查看你是否有../ssh 这个文件:怎么查看:找到你的git安装目录,在安装目录下查看是否./ssh,以我的为例: 在C盘/Users/11/ ...
SSH公钥(public key)验证
安全的设置服务器登陆,之前用用户名和密码登陆服务器这样不安全 ,用SSH公钥(public key)验证这个办法能很好的解决登陆服务器和安全登陆服务器的特点: 目标: Client 免输 ...
linux ssh使用深度解析（key登录详解）
linux ssh使用深度解析(key登录详解) SSH全称Secure SHell,顾名思义就是非常安全的shell的意思,SSH协议是IETF(Internet Engineering Task ...
Linux配置使用SSH Key登录并禁用root密码登录(替换同理)
Linux系统大多说都支持OpenSSH,生成公钥.私钥的最好用ssh-keygen命令,如果用putty自带的PUTTYGEN.EXE生成会不兼容OpenSSH,从而会导致登录时出现server r ...
Linux配置使用SSH Key登录并禁用root密码登录
Linux系统大多数都支持OpenSSH,生成公钥.私钥的最好用ssh-keygen命令,如果用putty自带的PUTTYGEN.EXE生成会不兼容OpenSSH,从而会导致登录时出现server r ...

随机推荐

SpringBoot bean映射yml中的属性举例
pom:导入配置文件处理器,配置文件进行绑定就会有提示 <dependency> <groupId>org.springframework.boot</groupId&g ...
怎么根据Comparable方法中的compareTo方法的返回值的正负判断升序还是降序？
public int compareTo(Student o) { return this.age - o.age; // 比较年龄(年龄的升序) } 应该理解成return (-1)×(thi ...
Mac SVN Cornerstone 安装使用详解
Cornerstone 是收费软键,这里提供一个破解版 ,安装后需要输入安装密码:www.ifunmac.com 链接:https://pan.baidu.com/s/1LqY2s8vEJAQ9JJh ...
instanceof关键字使用的方法(解决转型异常ClassCastException)
一丶问题显现: 当你是父类的情况下,像使用子类的特定功能,就需要向下转型,但向下转型有可能会报错(ClassCastException) 而instanceof关键字就是解决异常的小能手,他能判断是否 ...
formSelects
formSelects-v4.js 链接:https://pan.baidu.com/s/1Qp-ez7CuA1cVdWhP37EA7Q 提取码:17iq只需要下文中的css文件和js文件引入到页面 ...
HTML5离线存储整理
前端html部分 //canvas.html <!DOCTYPE html> <html manifest="/test.appcache"> <he ...
css3 nth-child选择器
css3 nth-child选择器 css3的nth-child选择器,乍看起来很简单,其实不是那么容易. 简单用法 p:nth-child(n) // 选择属于其父元素的第n个子元素的每个 < ...
CentOS安装图形界面以及eclipse的安装
图形界面的安装,以GNOME为例: 1.首先运行命令:yum grouplist 会显示可安装的包,可以自己选择安装. 2.运行 yum gruopinstall "GNOME" ...
ES6(Promise)等一个函数执行完后再执行另一个函数
function text1(){ return new Promise((resolve, reject) => { setTimeout(function () { resolve(cons ...
CentOS7 Network Setting
#display devices[root@localhost ~]# nmcli d #set ipv4 address[root@localhost ~]# nmcli c modify eth0 ...

Linux-ssh-key验证

ssh登录验证方式介绍

实现基于密钥的登录方式

Linux-ssh-key验证的更多相关文章

随机推荐

热门专题