一起来学linux：SSH远程登陆

Posted 2020-10-12 一张红枫叶

在最早的远程连接技术，主要是telnet和RSH为主。缺点也很明显，就是明文传输。在网络上传输的数据会被截获。因此发展出了文字接口加密。以SSH为主。这种连接加密技术的机制简单来说就是采用非对称密钥系统，也就是公钥和私钥。在网络中传输的数据通过公钥来加密，在本端收到后用私钥解密。公钥是大家都能获取的。而私钥是存储在本地的不能外流。

首先我们来看下如何搭建一台可以远程访问的SSH服务器。SSH分为客户端和服务器端。如果你只是想登陆别的SSH只需要安装openssh-client. ubuntun默认是有安装的。如果没有则用apt-get install openssh-client。如果要使本机开放SSH服务器就需要安装openssh-server

apt-get install openssh-server 安装好后会在/etc/ssh下面会出现生成的秘钥

[email protected]:/etc/ssh# ls -al

total 356

drwxr-xr-x 2 root root 4096 Oct 27 22:35 .

drwxr-xr-x 148 root root 12288 Oct 27 22:35 ..

-rw-r--r-- 1 root root 300261 Mar 16 2017 moduli

-rw-r--r-- 1 root root 1756 Mar 16 2017 ssh_config

-rw-r--r-- 1 root root 2542 Oct 27 22:35 sshd_config

-rw------- 1 root root 672 Oct 27 22:35 ssh_host_dsa_key

-rw-r--r-- 1 root root 604 Oct 27 22:35 ssh_host_dsa_key.pub

-rw------- 1 root root 227 Oct 27 22:35 ssh_host_ecdsa_key

-rw-r--r-- 1 root root 176 Oct 27 22:35 ssh_host_ecdsa_key.pub

-rw------- 1 root root 411 Oct 27 22:35 ssh_host_ed25519_key

-rw-r--r-- 1 root root 96 Oct 27 22:35 ssh_host_ed25519_key.pub

-rw------- 1 root root 1675 Oct 27 22:35 ssh_host_rsa_key

-rw-r--r-- 1 root root 396 Oct 27 22:35 ssh_host_rsa_key.pub

-rw-r--r-- 1 root root 338 Oct 27 22:35 ssh_import_id

然后通过/etc/init.d/ssh start启动。访问方式如下：ssh 用户名@服务器地址

[email protected]:/etc/ssh# ssh [email protected]

[email protected]‘s password:

Welcome to Ubuntu 15.04 (GNU/Linux 3.19.0-84-generic i686)

* Documentation: https://help.ubuntu.com/

Last login: Tue Jul 25 11:05:08 2017

To run a command as administrator (user "root"), use "sudo <command>".

See "man sudo_root" for details.

[email protected]:~$ ls -al

前面访问的不是root用户，因为ubuntun是默认不启用root用户也不允许root远程登陆的。如果真的要使用root用户登陆，就要修改ssh_config的设置。找到PermitRootLogin no 这一行修改为PermitRootLogin yes 设置好后就可以访问了，否则访问的时候会提示Permission Denied.

[email protected]:/etc/ssh# ssh [email protected]

[email protected]‘s password:

Welcome to Ubuntu 15.04 (GNU/Linux 3.19.0-84-generic i686)

* Documentation: https://help.ubuntu.com/

Your Ubuntu release is not supported anymore.

For upgrade information, please visit:

http://www.ubuntu.com/releaseendoflife

New release ‘16.04.3 LTS‘ available.

Run ‘do-release-upgrade‘ to upgrade to it.

Last login: Wed Jul 26 10:19:13 2017

[email protected]:~#

退出的时候输入exit就可以了。

[email protected]:~# exit

logout

Connection to 192.168.0.9 closed.

这种密码登陆的方式每次都要输入密码，还是比较麻烦，我们可以用免密码登陆的方式，也就是通过证书认证的方式来进行登陆，那么首先就要在客户端先生成证书。通过ssh-keygen的方式生成证书。

[email protected]:~/.ssh# ssh-keygen -t rsa

Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id_rsa):

/root/.ssh/id_rsa already exists.

Overwrite (y/n)? y

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /root/.ssh/id_rsa.

Your public key has been saved in /root/.ssh/id_rsa.pub.

The key fingerprint is:

SHA256:bC9RjgrGUAL4+74XEkEeK09Mpvv7pANkvdi/kNDTRdM [email protected]

The key‘s randomart image is:

+---[RSA 2048]----+

|o...* o. |

|. O.o . .E |

| .+.=. . . |

| +Oo. o + |

| oo+Bo. S . |

| ++++.o o |

| o+oo.. . |

| o=o . |

| .==o. |

+----[SHA256]-----+

在/etc/ssh目录下能找到生成的证书

[email protected]:/home/zhf# cd /etc/ssh

[email protected]:/etc/ssh# ls -al

total 356

drwxr-xr-x 2 root root 4096 Oct 27 22:35 .

drwxr-xr-x 148 root root 12288 Oct 27 22:35 ..

-rw-r--r-- 1 root root 300261 Mar 16 2017 moduli

-rw-r--r-- 1 root root 1756 Mar 16 2017 ssh_config

-rw-r--r-- 1 root root 2542 Oct 27 22:35 sshd_config

-rw------- 1 root root 672 Oct 27 22:35 ssh_host_dsa_key

-rw-r--r-- 1 root root 604 Oct 27 22:35 ssh_host_dsa_key.pub

-rw------- 1 root root 227 Oct 27 22:35 ssh_host_ecdsa_key

-rw-r--r-- 1 root root 176 Oct 27 22:35 ssh_host_ecdsa_key.pub

-rw------- 1 root root 411 Oct 27 22:35 ssh_host_ed25519_key

-rw-r--r-- 1 root root 96 Oct 27 22:35 ssh_host_ed25519_key.pub

-rw------- 1 root root 1675 Oct 27 22:35 ssh_host_rsa_key

-rw-r--r-- 1 root root 396 Oct 27 22:35 ssh_host_rsa_key.pub

-rw-r--r-- 1 root root 338 Oct 27 22:35 ssh_import_id

然后我们需要将我们生成的公钥证书上传给服务器便于认证。 通过ssh-copy-id的方式进行证书上传。

[email protected]:~/.ssh# ssh-copy-id [email protected]

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"

/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys

[email protected]‘s password:

Number of key(s) added: 1

Now try logging into the machine, with: "ssh ‘[email protected]‘"

and check to make sure that only the key(s) you wanted were added.

在服务器端会发现生成了authorized_keys文件

[email protected]:~# ls -al /root/.ssh

total 24

drwx------ 2 root root 4096 Oct 27 23:11 .

drwx------ 10 root root 4096 Oct 27 22:11 ..

-rw------- 1 root root 396 Oct 27 23:11 authorized_keys

-rw------- 1 root root 1675 Oct 27 23:10 id_rsa

-rw-r--r-- 1 root root 406 Oct 27 23:10 id_rsa.pub

-rw-r--r-- 1 root root 222 Aug 31 22:17 known_hosts

查看文件可以看到是生成了客户端的公钥。

[email protected]:~/.ssh# cat ./authorized_keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDE9qGkCG+g6UUEHLKvr4lWSrwwyvVDLcWDhfNBiifkegSuDeOW258SOkDmti4nnMvF1OOazYbWKjnRkk1XEa3GK70PsP7I/wu0w+POnP+NBsIFdMhyJsETfT1WzC5Gnk6eAtbwQuAw50s25qoXmutW97Nq0mGr2Dk03ysoUyMjM1mWCAkiC2l50K4EDW4S28SC3e5hdhuQ285s62fCvaCEKcoj16Ewth4H2x+MKCi2zgL/m4yjXhAJIggDofXl3CugqDCmZY3aEVByF9q7HTUZbKd1tk9QMjGGqg0e/B55GL2F1POUVEVTxwGQ/W1z/DiEZCzpKzzmtNH8+h3KfWeP [email protected]

继续访问就不需要密码了，直接就可以登陆上远端电脑了。

[email protected]:/etc/ssh# ssh [email protected]

Welcome to Ubuntu 15.04 (GNU/Linux 3.19.0-84-generic i686)

* Documentation: https://help.ubuntu.com/

0 packages can be updated.

0 updates are security updates.

Your Ubuntu release is not supported anymore.

For upgrade information, please visit:

http://www.ubuntu.com/releaseendoflife

New release ‘16.04.3 LTS‘ available.

Run ‘do-release-upgrade‘ to upgrade to it.

Last login: Sun Oct 29 09:38:23 2017 from 192.168.0.11

[email protected]:~#

ssh命令只是远程连接的命令而已，如果想从远程服务器上下载或者是上传文件，那就要用到SFTP或者FTP命令了，命令的使用方式和FTP一样的。

[email protected]:/etc/ssh# sftp [email protected]

Connected to 192.168.0.9.

sftp> cd /home/zhf

sftp> dir

Desktop Documents

Downloads Music

Pictures Public

Templates VMwareTools-9.6.1-1378637.tar.gz

Videos examples.desktop

vmware-tools-distrib zhf

下载

sftp> pwd

Remote working directory: /home/zhf

sftp> cd ./zhf

sftp> dir

python_prj python_src tcpdumpresult.txt

下载tcpdumpresult文件

sftp> get tcpdumpresult.txt

Fetching /home/zhf/zhf/tcpdumpresult.txt to tcpdumpresult.txt

/home/zhf/zhf/tcpdumpresult.txt 100% 30KB 30.0KB/s 00:00

将本机的test.txt文件上传到远端电脑，远端电脑的存放路径为/root/test.txt

sftp> put /home/zhf/zhf/test.txt

Uploading /home/zhf/zhf/test.txt to /root/test.txt

/home/zhf/zhf/test.txt 100% 0 0.0KB/s 00:00

另外还有一种简洁的方式就是通过SCP的方式，如果知道远程服务器的目录。那么可以直接通过
scp 源文件路径 用户名@IP:目的文件路径的方式进行上传数据。

[email protected]:/home/zhf/zhf# scp /home/zhf/zhf/test1.txt [email protected]:/home/root

test1.txt 100% 2633KB 2.6MB/s 00:01

那么如果在window界面通过ssh的方式登陆linux呢，只需要下载相应的软件就可以了，常用的就是Puttygen软件，导入先前生成的私钥id_rsa,转换成putty所识别的格式(*.ppk),得到文件id_rsa.ppk.

windows上启动putty，进行如下配置
Session-Logging-Hostname:填上你的linux的ip
Windows －Translation － 在下拉菜单里选上UTF－8，这里不设置，登录后将会出现中文乱码。
Connection- Data - Auto login username:填上你登录ubuntu时用的用户名。
Connection- SSH-Auth-Private key file for authentication:选上id_rsa.ppk
保存Session配置。然后点击登陆就可以了