Linux下密钥认证

Posted 2020-10-12

1.1 生成密钥

ssh2同时支持RSA和DSA密钥，但是ssh1仅支持RSA密钥。

[[email protected] ~]# ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_dsa.
Your public key has been saved in /root/.ssh/id_dsa.pub.
The key fingerprint is:
15:91:d4:10:10:62:a8:1d:66:50:36:21:87:30:62:a2 [email protected]node1.example.com
The key‘s randomart image is:
+--[ DSA 1024]----+
|=oo+*oo o+**     |
|=..+=o .  ...    |
|E  = .    .      |
|  . .    .       |
|        S        |
|                 |
|                 |
|                 |
|                 |
+-----------------+
[[email protected]-node1 ~]# ll .ssh/
total 12
-rw------- 1 root root 410 Mar 29 20:04 authorized_keys
-rw------- 1 root root 668 Apr 27 20:52 id_dsa          钥匙    （私钥）
-rw-r--r-- 1 root root 618 Apr 27 20:52 id_dsa.pub      锁      （公钥）

1.2 分发密钥把公钥传到客户端

id_dsa（钥匙）留到管理机，id_dsa.pub（锁）发送到所有的被管理机

ssh-copy-id原理：

将id_dsa.pub（锁）发送到所有的被管理机，改名为~/.ssh/authorized_keys

同时权限是600, ~/.ssh权限为700

[[email protected] ~]# grep authorized /etc/ssh/sshd_config
#AuthorizedKeysFile .ssh/authorized_keys

被管理机：

[[email protected] tmp]# ll ~/.ssh/authorized_keys
-rw------- 1 root root 598 Oct  9 12:31 /root/.ssh/authorized_keys
[[email protected] tmp]# ll -ld ~/.ssh
drwx------ 2 root root 4096 Oct  9 12:31 /root/.ssh

1.3 单个密钥分发

[[email protected] ~]# ssh-copy-id -i .ssh/id_dsa.pub [email protected]172.16.1.41
The authenticity of host ‘172.16.1.41 (172.16.1.41)‘ can‘t be established.
RSA key fingerprint is ce:6b:ba:e5:83:74:fe:d4:a1:ef:3a:3e:10:b0:63:14.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘172.16.1.41‘ (RSA) to the list of known hosts.
Address 172.16.1.41 maps to bogon, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
[email protected]172.16.1.41‘s password:
Now try logging into the machine, with "ssh ‘[email protected]‘", and check in: 
  .ssh/authorized_keys
 to make sure we haven‘t added extra keys that you weren‘t expecting.