Linux SSH登入互信配置

王林
發布: 2024-02-19 19:48:56
轉載
668 人瀏覽過

1. 做ssh互信的目的

1、在做叢集的時候是需要SSH互信,它有利於在另一個節點方便操作。

2、當使用scp遠端拷貝操作時,需要輸入目標伺服器的使用者名稱和密碼,這個時候可以做linux伺服器之間ssh互信配置, 這樣在多個linux伺服器之間做操作時就可以免密登陸。

2. ssh互信配置的原理

簡而言之,伺服器儲存目標主機的證書,以便自動完成認證,無需輸入密碼。

Linux SSH登录互信配置

#3. ssh互信設定步驟

1、各節點產生自己的公鑰、私鑰對。

2、將自己的公鑰檔案傳送給對方。

3、驗證互信配置是否成功。

4. 設定ssh互信

#這裡以MYDB01MYDB02兩台LINUX主機為例:

4.1產生公鑰私鑰對

在兩台主機上分別生成,提示輸入訊息時直接回車:

MYDB01主機:

[root@MYDB01 ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:lQex2+SbdmGGNBvU8vjaTKVCbfAmk8Eva+C6BPJ49G0 root@MYDB01
The key's randomart image is:
+---[RSA 2048]----+
|oo.. |
| == .|
|+ *@ |
| ..BB=B .|
|. o S..o=O+o |
| = o .. +=+. |
|. o o.E.+*.|
| . ... ...o|
|.. |
+----[SHA256]-----+
[root@MYDB01 ~]# 
登入後複製

MYDB02主機:

[root@MYDB02 ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:8DGfMHFZDrEOOYhcpFGXI8tndQXTE4FampR6cTowAo4 root@MYDB02
The key's randomart image is:
+---[RSA 2048]----+
|o++ o.+=+=+o |
| + =oo=+*+=.o|
|E =.o+OB.X.. |
|oo+XB. |
| oS.+. |
| |
| |
| |
| |
+----[SHA256]-----+
[root@MYDB02 ~]# 
登入後複製

這樣,就建立了公鑰和金鑰,會產生**id_rsaid_rsa.pub**兩個檔案。

產生ssh金鑰後,金鑰將預設儲存在家目錄下的**.ssh/目錄**。

私鑰和公鑰的權限分別為**600和644**。

.ssh目錄權限必須是700

選項:

-t rsa|dsa預設是rsa格式。

接著可以查看產生的公鑰和私鑰檔案:

[root@MYDB01 ~]# cd /root/.ssh
[root@MYDB01 .ssh]# pwd
/root/.ssh
[root@MYDB01 .ssh]# ll -sh
总用量 12K
4.0K -rw-------1 root root 1.7K 2月14 16:17 id_rsa
4.0K -rw-r--r--1 root root393 2月14 16:17 id_rsa.pub
[root@MYDB01 .ssh]# 
登入後複製

4.2將自己的公鑰檔案傳送給對方

# 指令格式:

ssh-copy-id [-i [identity_file]] [user@]machine
登入後複製

這個指令的功能是:將id_rsa.pub檔案內容傳送至對方的 .ssh目錄中,產生檔案名稱為authorized_keys 文件,並且會設定遠端主機使用者目錄的**.ssh和.ssh/authorized_keys**權限。

# 在MYDB01上執行下列操作:

[root@MYDB01 .ssh]# ssh-copy-id 192.168.250.194
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.250.194's password: 

Number of key(s) added: 1

Now try logging into the machine, with: "ssh '192.168.250.194'"
and check to make sure that only the key(s) you wanted were added.

[root@MYDB01 .ssh]# 
登入後複製

這裡在MYDB02主機上查看:

[root@MYDB02 ~]# cd /root/.ssh
[root@MYDB02 .ssh]# ll
总用量 12
-rw------- 1 root root393 2月14 16:41 authorized_keys
-rw------- 1 root root 1679 2月14 16:20 id_rsa
-rw-r--r-- 1 root root393 2月14 16:20 id_rsa.pub
[root@MYDB02 .ssh]# cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtQ+pBp1T9fHAkrifEShaOAfBJFT+HdljR8mBxl7wZ1a91g3Zuzu35gJKsUjD+NqP9JcdyKapE309SHPvosvsJjLfccF4PaEZAgqHryu+S3cBn8zqA6fm62hsx/qI4I80PV0btcqfwphsD+5+vgkDJWAsUGQtqZdmMClAIy5gs0He0K2jpciKHvxWWClB3+dTJ0e9yIuIkV7lM+jqVIqYFJD0bRyy0zgNsY5/cLYFllM42TQDos93hVdqGXOHREpWo01KX2Jd8MKj4yNeiqgnj2mDtiNFWOUSkAbHpcKInuUOErJMqkV7MP0er5UKY/NemDzuORr2RxYqSTWaz/T7N root@MYDB01
[root@MYDB02 .ssh]# 
登入後複製

上面的操作只是單方面信任,主機MYDB01登入主機MYDB02不需要輸入密碼,反過來不行,所以還需下面操作:

# 在主機MYDB02上將其金鑰複製到主機MYDB01上:

[root@MYDB02 .ssh]# ssh-copy-id 192.168.250.193
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.250.193 (192.168.250.193)' can't be established.
ECDSA key fingerprint is SHA256:vThEoRhUOECeD5jhE+m8TZA2+6OoElIoNOQ3XqtopZw.
ECDSA key fingerprint is MD5:97:40:b2:35:6e:07:5a:61:1f:73:f1:b2:6e:54:5b:7d.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.250.193's password: 

Number of key(s) added: 1

Now try logging into the machine, with: "ssh '192.168.250.193'"
and check to make sure that only the key(s) you wanted were added.

[root@MYDB02 .ssh]# 
登入後複製

4.3驗證互信

分別在MYDB01主機和MYDB02主機上透過SSH登錄,看是否需要輸入密碼:

MYDB01主機上登入MYDB02主機:

[root@MYDB01 .ssh]# ssh 192.168.250.194
Last login: Tue Jan 9 15:41:56 2023 from 192.168.250.193
[root@MYDB02 ~]# 
登入後複製

無密登入成功。

同樣,在MYDB02主機上登入MYDB01主機:

[root@MYDB02 .ssh]# ssh 192.168.250.193
Last failed login: Tue Feb 14 16:48:54 CST 2023 from 192.168.250.194 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Tue Jan 9 15:41:34 2024 from 192.168.250.194
[root@MYDB01 ~]# 
登入後複製

以上是Linux SSH登入互信配置的詳細內容。更多資訊請關注PHP中文網其他相關文章!

相關標籤:
來源:mryunwei.com
本網站聲明
本文內容由網友自願投稿,版權歸原作者所有。本站不承擔相應的法律責任。如發現涉嫌抄襲或侵權的內容,請聯絡admin@php.cn
熱門教學
更多>
最新下載
更多>
網站特效
網站源碼
網站素材
前端模板